MantisBT - CMake
View Issue Details
0014319CMakeQtDialogpublic2013-07-29 10:422014-06-02 08:37
Peter Boettcher 
Ben Boeckel 
normalcrashalways
closedfixed 
CMake 2.8.11.2 
CMake 2.8.12 
0014319: Access before VARIABLE_WATCH crashes GUI on second Configure
Repeatable qt-dialog crash: set a variable, then add a watch. On second and following Configure (in the same session), the set() accesses invalid memory, and crashes the GUI about 20% of the time. valgrind shows the bad access on every run after the first.

Analysis: The VARIABLE_WATCH command object itself is used as the client_data for the cmVariableWatchCommandVariableAccessed callback function, but the WatchCommand data structures do not own this data. When a second Configure is run, the generator is torn down, which deletes the cmVariableWatchCommand object. The list of watches is not deleted however, so the next SET() triggers the watch and tries to access the deleted cmVariableWatchCommand through the callback data.
CMakeLists.txt:

SET(MYVAR 0)
VARIABLE_WATCH(MYVAR)

Run cmake-gui and click "Configure" until crash. Or, run cmake-gui in valgrind, and watch for invalid access on second Configure.
Repeatable on at least Linux with Makefiles, and Windows with Visual Studio generator.
No tags attached.
Issue History
2013-07-29 10:42Peter BoettcherNew Issue
2013-08-02 08:45Brad KingAssigned To => Ben Boeckel
2013-08-02 08:45Brad KingStatusnew => assigned
2013-08-02 16:11Ben BoeckelNote Added: 0033661
2013-08-05 09:59Peter BoettcherNote Added: 0033666
2013-11-20 16:40Ben BoeckelNote Added: 0034506
2013-11-20 16:40Ben BoeckelStatusassigned => resolved
2013-11-20 16:40Ben BoeckelResolutionopen => fixed
2013-11-20 16:40Ben BoeckelFixed in Version => CMake 2.8.12
2014-06-02 08:37Robert MaynardNote Added: 0036020
2014-06-02 08:37Robert MaynardStatusresolved => closed

Notes
(0033661)
Ben Boeckel   
2013-08-02 16:11   
I wasn't able to reproduce a crash, but valgrind was saying things weren't going as expected. I've gotten valgrind to be quiet with the dev/fix-variable-watch-crash branch I just pushed (commit 7207d8c50b0ae3c10f48526198e04fef11057f87). It basically makes the variable watch class own the client data for callbacks instead of just passing around a bare pointer.
(0033666)
Peter Boettcher   
2013-08-05 09:59   
Crash reproduction for me involved clicking "Configure" repeatedly. Crash would occur somewhere between 5 and 10 clicks. I just verified that dev/fix-variable-watch-crash fixes both valgrind and crash issues for me.
(0034506)
Ben Boeckel   
2013-11-20 16:40   
Merged.

commit aaadc280c94dc8b08395616dfa3fec573076676f
Merge: d422ee3 6aa0c21
Author: Brad King <brad.king@kitware.com>
Date: Thu Aug 8 13:55:25 2013 -0400

    Merge topic 'dev/fix-variable-watch-crash'
(0036020)
Robert Maynard   
2014-06-02 08:37   
Closing resolved issues that have not been updated in more than 4 months.