Opened 19 years ago

Last modified 16 years ago

#1400 closed defect

layerObj.delete() crashes in Java/MapScript — at Initial Version

Reported by: umn-ms@… Owned by: sdlime
Priority: high Milestone:
Component: MapScript-SWIG Version: 4.6
Severity: normal Keywords:
Cc:

Description

Thread "Java VM Crashes using the Mapscript API" in Mapserver-users-List

Christian reported a crash in layerObj.delete() which I 
also detected. 
I think I understood the following: 

Let's say, we have an initialized  mapObj mO; 

layerObj lO = new layerObj(mO); 
// Say lO is the 5th layer now. 
// Now lO.swigCMemOwn == true and 
//     lO.swigCPtr points onto the mO.swigCPtr->layers[4] 

... 
// now the mapObj is deleted but the Java-layerObj continues to live. 
// the C-layer-Object mO.swigCPtr->layers[4] will deleted and freed also! 
mO.delete() 
// From now on O.swigCPtr points into invalid piece of C-memory. 
... 

Later on the Java-garbage-collector finalizes the layerObj. 

Because of "lO.swigCMemOwn == true" and "lO.swigCPtr!=0" the finalize-method calls 
layerObj.delete(). This method frees lO.swigCPtr which is invalid memory. 

Same story about layerObj/classObj.

Change History (0)

Note: See TracTickets for help on using tickets.