[Octave-bug-tracker] [bug #52666] Segfault when closing a figure inside a "deletefcn" callback

[Pantxo Diribarne]

URL:
  <http://savannah.gnu.org/bugs/?52666>

                 Summary: Segfault when closing a figure inside a "deletefcn"
callback
                 Project: GNU Octave
            Submitted by: pantxo
            Submitted on: Thu 14 Dec 2017 07:14:05 PM UTC
                Category: Plotting
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: Segfault, Bus Error, etc.
                  Status: None
             Assigned to: None
         Originator Name: 
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
                 Release: 4.2.1
        Operating System: GNU/Linux

    _______________________________________________________

Details:

The following crashes both stable and dev Octave with any toolkit:


fcn = @(h) close (ancestor (h, "figure"));
hl = line ("deletefcn", fcn);
delete (hl)


For some reason I can't get a usable backtrace, it looks like this (address
sanitizer enabled):


==17665== ERROR: AddressSanitizer: heap-use-after-free on address
0x600c00c3b808 at pc 0x7ffff47a46b7 bp 0x7fffd3359c90 sp 0x7fffd3359c88
READ of size 8 at 0x600c00c3b808 thread T2 (QThread)
    #0 0x7ffff47a46b6
(/home/pantxo/Documents/On/octavebuild/libgui/.libs/liboctgui.so.2.0.0+0x34e6b6)
    #1 0x7ffff3968fa1
(/home/pantxo/Documents/On/octavebuild/libinterp/.libs/liboctinterp.so.4.0.0+0x1212fa1)
    #2 0x7ffff3816109
(/home/pantxo/Documents/On/octavebuild/libinterp/.libs/liboctinterp.so.4.0.0+0x10c0109)
    #3 0x7ffff3992958
(/home/pantxo/Documents/On/octavebuild/libinterp/.libs/liboctinterp.so.4.0.0+0x123c958)
    #4 0x7ffff3816e8d
(/home/pantxo/Documents/On/octavebuild/libinterp/.libs/liboctinterp.so.4.0.0+0x10c0e8d)
    #5 0x7ffff3816f62
(/home/pantxo/Documents/On/octavebuild/libinterp/.libs/liboctinterp.so.4.0.0+0x10c0f62)
    #6 0x7ffff3817024
(/home/pantxo/Documents/On/octavebuild/libinterp/.libs/liboctinterp.so.4.0.0+0x10c1024)
    #7 0x7ffff3953075
(/home/pantxo/Documents/On/octavebuild/libinterp/.libs/liboctinterp.so.4.0.0+0x11fd075)



I tried to play with the "interruptible" property of the line object but it
does not seam to do the job.




    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?52666>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/