Re: [boost] [shifted_ptr][3.0] Important bugs fixes

From: Steven Watanabe (watanabesj_at_[hidden])
Date: 2008-04-25 15:53:38

AMDG

Phil Bouchard wrote:
> "Steven Watanabe" <watanabesj_at_[hidden]> wrote in message 
> news:4810B429.4090008_at_providere-consulting.com...
>
> [...]
>
>   
>> I noticed that you included a modified form
>> of my list example.  It is not equivalent.  Because you are not
>> setting front in insert(), the test if(front.get() == 0) will always
>> be true.  As a result the list will always have size 1 which defeats the
>> purpose of the test. The original crashes on msvc 9.0.
>>
>> HEAP[shifted_ptr.exe]: HEAP: Free Heap block 3f6680 modified at 3f66ac
>> after it was freed
>>     
>
> This is a nasty bug because everything is processed like it should but 
> crashes and ends differently with various debuggers.  On MSVC it crashes on 
> the deletion of the last object of type "owned<node>" but the pointer is 
> perfectly valid.
>
> I'll check this out again this weekend.
>   

The problem is that you are manipulating the reference count
of a block after it is freed.  The first node is deleted.  The second
node is then deleted which decrements the reference count of the
first block which is already deleted.

Here's the stack trace at the point the error actually occurs.

     shifted_ptr.exe!boost::detail::sp_counted_base::release()  Line 
77    C++
     
shifted_ptr.exe!boost::detail::sh::shifted_ptr_base<node>::~shifted_ptr_base<node>()  
Line 131    C++
     
shifted_ptr.exe!boost::detail::sh::shifted_ptr<node,boost::detail::sh::shifted_ptr_base>::~shifted_ptr<node,boost::detail::sh::shifted_ptr_base>()  
Line 238 + 0xf bytes    C++
     shifted_ptr.exe!node::~node()  Line 19 + 0x1a bytes    C++
     shifted_ptr.exe!node::`scalar deleting destructor'()  + 0x2b 
bytes    C++
     shifted_ptr.exe!boost::detail::sh::owned<node>::dispose<node>(node 
* p=0x003f67f8, const boost::integral_constant<bool,0> & 
__formal={...})  Line 186    C++
     shifted_ptr.exe!boost::detail::sh::owned<node>::dispose()  Line 142 
+ 0x38 bytes    C++
     shifted_ptr.exe!boost::detail::sh::owned<node>::~owned<node>()  
Line 141 + 0x5a bytes    C++
     shifted_ptr.exe!boost::detail::sh::owned<node>::`scalar deleting 
destructor'()  + 0x2b bytes    C++
     shifted_ptr.exe!boost::detail::sh::set::release()  Line 89 + 0x39 
bytes    C++
     
shifted_ptr.exe!boost::detail::sh::shifted_ptr<node,boost::detail::sh::shifted_ptr_base>::release(bool 
d=false)  Line 246 + 0xb bytes    C++
     
shifted_ptr.exe!boost::detail::sh::shifted_ptr<node,boost::detail::sh::shifted_ptr_base>::reset()  
Line 233    C++
     shifted_ptr.exe!list::clear()  Line 33    C++
     shifted_ptr.exe!main()  Line 56    C++
     shifted_ptr.exe!__tmainCRTStartup()  Line 582 + 0x19 bytes    C
     shifted_ptr.exe!mainCRTStartup()  Line 399    C
     kernel32.dll!7c816fd7()    
     [Frames below may be incorrect and/or missing, no symbols loaded 
for kernel32.dll]   

In Christ,
Steven Watanabe