Re: [fltk.coredev] Double free of groups - Forums

On Wednesday, March 15, 2023 at 8:46:15 AM UTC-7 Albrecht Schlosser wrote:

OK, after a little research I found OpenVSP on GitHub (which appears to be the project you mentioned) and a newer version of the Cartesian library here: https://sourceforge.net/p/rfltk/code/HEAD/tree/cartesian/

Great. You are correct -- that is my program.

I saw your first email. I figured I would respond to the second (this) one first and then go back and try to answer your questions in the first message too.

OpenVSP is not exactly a MWE of any particular bug. I'll try to point you at the right spots.

Meanwhile I also found out that this library adds more than one FLTK widget to its parent group (or window) - which may cause the double free under certain circumstances - and I could indeed make the provided example program crash with double free if I only delete the main window after `Fl::run()`.

Source code: https://sourceforge.net/p/rfltk/code/HEAD/tree/cartesian/test/example.cpp

Modified like this (see comment):
```

Fl_Double_Window *w = new Fl_Double_Window(580, 380, "Cartesian graphics example");
// ... more code here ...
w->end();
w->show(argc, argv);
Fl::add_timeout(0, next_freq);
Fl::run();
delete w; // ADDED only this statement
return 0;
```

This is an example I can work with, and I'll investigate this issue. Please don't expect quick results though, today my time is very much limited. I hope I can find something more tomorrow.

Great -- I agree that a Cartesian example will be a much better MWE.

No hurry, my 'release' versions will still ship with an older version of FLTK. I'm trying to occasionally keep up with the tip of master so I'll be ready for 1.4 -- when I find something awry, I try to bring it up so it can get fixed.

I.e. this is not urgent to me, but hopefully it will get fixed on the 1.4.0 timescale.

Current status of investigation:

1. the modified Cartesian example crashes with double free when built with FLTK 1.4.0 (git)
2. it does not crash with FLTK 1.3.x (not sure which git commit exactly), i.e. it exits silently

Note that this doesn't mean (yet) that the program doesn't *attempt* a double free in FLTK 1.3. So far it only means that this is *not diagnosed* by my current build of 1.3.x. I'll need to use a memory checker to verify this and I need more time to debug it.

I was running with the address sanitizer and I bisected the git commits down before I posted the message blaming one specific commit. In my testing, the immediately previous commit exited cleanly from an Address Sanitizer point of view.

I'll let you know when I have more info.

Thanks much,

Rob