Opened 19 years ago

Closed 16 years ago

#1400 closed defect (fixed)

layerObj.delete() crashes in Java/MapScript

Reported by: umn-ms@… Owned by: sdlime
Priority: high Milestone:
Component: MapScript-SWIG Version: 4.6
Severity: normal Keywords:
Cc:

Description (last modified by hobu)

Thread "Java VM Crashes using the Mapscript API" in Mapserver-users-List

Christian reported a crash in layerObj.delete() which I 
also detected. 
I think I understood the following: 

Let's say, we have an initialized  mapObj mO; 

layerObj lO = new layerObj(mO); 
// Say lO is the 5th layer now. 
// Now lO.swigCMemOwn == true and 
//     lO.swigCPtr points onto the mO.swigCPtr->layers[4] 

... 
// now the mapObj is deleted but the Java-layerObj continues to live. 
// the C-layer-Object mO.swigCPtr->layers[4] will deleted and freed also! 
mO.delete() 
// From now on O.swigCPtr points into invalid piece of C-memory. 
... 

Later on the Java-garbage-collector finalizes the layerObj. 

Because of "lO.swigCMemOwn == true" and "lO.swigCPtr!=0" the finalize-method calls 
layerObj.delete(). This method frees lO.swigCPtr which is invalid memory. 

Same story about layerObj/classObj.

Change History (6)

comment:1 by sdlime, 19 years ago

Component: MapScriptMapScript-SWIG

comment:2 by szekerest, 18 years ago

This bug was fixed for C# in

http://mapserver.gis.umn.edu/bugs/show_bug.cgi?id=1743

I will look after how to fix it generally for mapscript.

Tamas

comment:3 by unicoletti, 17 years ago

Cc: unicoletti@… added

comment:4 by hobu, 17 years ago

Description: modified (diff)

What is the status on this one now that RFC 24 is in place?

in reply to:  4 comment:5 by unicoletti, 17 years ago

Replying to hobu:

What is the status on this one now that RFC 24 is in place?

It should be fixed, but I'm waiting to add another couple of features to rfc24 before closing it.

comment:6 by unicoletti, 16 years ago

Resolution: fixed
Status: newclosed

Fixed by RFC-24, closing

Note: See TracTickets for help on using tickets.