View Issue Details [ Jump to Notes ] [ Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0014319CMakeQtDialogpublic2013-07-29 10:422014-06-02 08:37
ReporterPeter Boettcher 
Assigned ToBen Boeckel 
PrioritynormalSeveritycrashReproducibilityalways
StatusclosedResolutionfixed 
PlatformOSOS Version
Product VersionCMake 2.8.11.2 
Target VersionFixed in VersionCMake 2.8.12 
Summary0014319: Access before VARIABLE_WATCH crashes GUI on second Configure
DescriptionRepeatable qt-dialog crash: set a variable, then add a watch. On second and following Configure (in the same session), the set() accesses invalid memory, and crashes the GUI about 20% of the time. valgrind shows the bad access on every run after the first.

Analysis: The VARIABLE_WATCH command object itself is used as the client_data for the cmVariableWatchCommandVariableAccessed callback function, but the WatchCommand data structures do not own this data. When a second Configure is run, the generator is torn down, which deletes the cmVariableWatchCommand object. The list of watches is not deleted however, so the next SET() triggers the watch and tries to access the deleted cmVariableWatchCommand through the callback data.
Steps To ReproduceCMakeLists.txt:

SET(MYVAR 0)
VARIABLE_WATCH(MYVAR)

Run cmake-gui and click "Configure" until crash. Or, run cmake-gui in valgrind, and watch for invalid access on second Configure.
Additional InformationRepeatable on at least Linux with Makefiles, and Windows with Visual Studio generator.
TagsNo tags attached.
Attached Files

 Relationships

  Notes
(0033661)
Ben Boeckel (developer)
2013-08-02 16:11

 I wasn't able to reproduce a crash, but valgrind was saying things weren't going as expected. I've gotten valgrind to be quiet with the dev/fix-variable-watch-crash branch I just pushed (commit 7207d8c50b0ae3c10f48526198e04fef11057f87). It basically makes the variable watch class own the client data for callbacks instead of just passing around a bare pointer.
(0033666)
Peter Boettcher (reporter)
2013-08-05 09:59

 Crash reproduction for me involved clicking "Configure" repeatedly. Crash would occur somewhere between 5 and 10 clicks. I just verified that dev/fix-variable-watch-crash fixes both valgrind and crash issues for me.
(0034506)
Ben Boeckel (developer)
2013-11-20 16:40

 Merged.

commit aaadc280c94dc8b08395616dfa3fec573076676f
Merge: d422ee3 6aa0c21
Author: Brad King <brad.king@kitware.com>
Date: Thu Aug 8 13:55:25 2013 -0400

    Merge topic 'dev/fix-variable-watch-crash'
(0036020)
Robert Maynard (manager)
2014-06-02 08:37

 Closing resolved issues that have not been updated in more than 4 months.

 Issue History
Date Modified Username Field Change
2013-07-29 10:42 Peter Boettcher New Issue
2013-08-02 08:45 Brad King Assigned To => Ben Boeckel
2013-08-02 08:45 Brad King Status new => assigned
2013-08-02 16:11 Ben Boeckel Note Added: 0033661
2013-08-05 09:59 Peter Boettcher Note Added: 0033666
2013-11-20 16:40 Ben Boeckel Note Added: 0034506
2013-11-20 16:40 Ben Boeckel Status assigned => resolved
2013-11-20 16:40 Ben Boeckel Resolution open => fixed
2013-11-20 16:40 Ben Boeckel Fixed in Version => CMake 2.8.12
2014-06-02 08:37 Robert Maynard Note Added: 0036020
2014-06-02 08:37 Robert Maynard Status resolved => closed

Copyright © 2000 - 2018 MantisBT Team