Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix crashes related to TabWidget::removeTab() that were reported by #1029 #1030

Open
wants to merge 1 commit into
base: RB-2.6
Choose a base branch
from

Conversation

acolwell
Copy link
Collaborator

Thanks for submitting a pull request! Please provide enough information so that others can review your pull request. Additionally, make sure you've done all of these things:

PR Description

What type of PR is this? (Check one of the boxes below)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Improvement (non-breaking change which does not add functionality nor fixes a bug but improves Natron in some way)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • My change requires a change to the documentation
    • I have updated the documentation accordingly

What does this pull request do?

Fix crashes related to TabWidget::removeTab() that were reported by #1029

  • Add code to ~PyPanel() to unregister itself.
  • Added code in TabWidget::removeTab() to specifically handle PyPanel objects. The code was crashing in cases where the removeTab() call was deleting the last reference to the PyPanel object and Python was destroying the object. The new code avoids use-after-free crashes in this situation.
  • Updated documentation to properly indicate that PyPanel objects may be destroyed if removeTab() deletes the last reference.
  • Changed TabWidget::removeTab() return value since the function can't guarantee a valid object for the type it was returning. Only one call site needed to be updated and it was effectively ignoring the value anyways.

Have you tested your changes (if applicable)? If so, how?

Yes. I've verified locally that the crashes mentioned in #1029 no longer occur. I also successfully built the Windows installer and verified that all the tests still pass and this build does not crash with the bug repro.

Futher details of this pull request

This fix is primarily just dealing with use-after-free issues. PyPanel objects would register themselves in their constructor, but never unregistered on destruction. This was causing code like the loop in PanelWidget::takeClickFocus() to make calls on PyPanel object pointers that were already destroyed.

Some crashes were also caused by TabWidget::removeTab() trying to call w->setVisible(false) on objects that have already been destroyed. This can happen when the removeTabToPython() call, that removes the reference to the panel on the app.pane2 object, causes the PyPanel object to actually be destroyed. This happens when the Python code does not keep another reference to the panel when it makes a call to remove the tab. The fix for this was to simply return right after the removeTabToPython() call in the PyPanel case. This avoids the crash and skips a bunch of code that doesn't appear to apply to the PyPanel case.

I updated the docs for removeTab() to make it a little clearer that the tab object can be destroyed within the call if it is the last reference.

- Add code to ~PyPanel() to unregister itself.
- Added code in TabWidget::removeTab() to specifically handle PyPanel objects.
  The code was crashing in cases where the removeTab() call was deleting
  the last reference to the PyPanel object and Python was destroying the
  object. The new code avoids use-after-free crashes in this situation.
- Updated documentation to properly indicate that PyPanel objects may be
  destroyed if removeTab() deletes the last reference.
- Changed TabWidget::removeTab() return value since the function can't
  guarantee a valid object for the type it was returning. Only one
  call site needed to be updated and it was effectively ignoring the
  value anyways.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant