[bug #61727] Premature cleanup in NSPopUpButtonCell -dealloc crashes application

[Yavor Doganov]

URL:
  <https://savannah.gnu.org/bugs/?61727>

                 Summary: Premature cleanup in NSPopUpButtonCell -dealloc
crashes application
                 Project: GNUstep
            Submitted by: yavor
            Submitted on: Thu 23 Dec 2021 05:40:10 PM EET
                Category: Gui/AppKit
                Severity: 3 - Normal
              Item Group: Bug
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:

GTAMSAnalyzer crashes with GUI 0.29; backtrace at
https://bugs.debian.org/1001537.  Cannot reproduce with earlier GUI versions. 
Relevant valgrind output:


==6853== Process terminating with default action of signal 11 (SIGSEGV)
==6853==  Access not within mapped region at address 0xDEADFB0E
==6853==    at 0x569CD55: objc_msg_lookup (sendmsg.c:442)
==6853==    by 0x4AD1DBA: _i_NSApplication__targetForAction_to_from_
(NSApplication.m:2294)
==6853==    by 0x4B93B67: _i_NSMenu___autoenableItem_ (NSMenu.m:1179)
==6853==    by 0x4B98D36: _i_NSMenu__update (NSMenu.m:1255)
==6853==    by 0x4BBE5E0: _i_NSPopUpButtonCell__setMenuItem_
(NSPopUpButtonCell.m:640)
==6853==    by 0x4BBEDEB:
_i_NSPopUpButtonCell__synchronizeTitleAndSelectedItem
(NSPopUpButtonCell.m:842)
==6853==    by 0x4BBFA1A: _i_NSPopUpButtonCell__dealloc
(NSPopUpButtonCell.m:152)
==6853==    by 0x4B2B1C0: _i_NSControl__dealloc (NSControl.m:125)
==6853==    by 0x4C46BDB: _i_NSView__removeSubview_ (NSView.m:965)
==6853==    by 0x4C55B6F: _i_NSView__dealloc (NSView.m:745)
==6853==    by 0x4C46BDB: _i_NSView__removeSubview_ (NSView.m:965)
==6853==    by 0x4C55B6F: _i_NSView__dealloc (NSView.m:745)


If I revert commit b7f5fb2, the problem goes away.  I think what is happening
is exactly as described in the code comment which was deleted in that commit:


/* 
 * We don't use methods here to clean up the selected item, the menu
 * item and the menu as these methods internally update the menu,
 * which tries to access the target of the menu item (or of this cell). 
 * When the popup is relases this target may already have been freed, 
 * so the local reference to it is invalid and will result in a 
 * segmentation fault. 
 */





    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?61727>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/