You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Python version of df104_CSV frequently crashes on Ubuntu when Cppyy queries types for unordered_map<string,char>. Although a TClass for this might exist, a query for
might not normalise to the same class, so another TClass instance is created. During its creation, it deletes the instance for unordered_map<string,char>, leading to a dangling pointer and a use-after-free crash.
Reproducer
auto first = TClass::GetClass("unordered_map<string,char>", true, true);
std::unordered_map<std::string, char> map;
auto second = first->GetActualClass(&map);
EXPECT_EQ(first, second);
ROOT version
Master and v6.36
Installation method
Source
Operating system
All, but the crash manifests on Ubuntu
Additional context
No response
The text was updated successfully, but these errors were encountered:
When looking up a TClass via name compared to via typeid, the lookup
returned a name without default template arguments in the former, and
with default arguments in the latter case.
This lead to a situation where
tclass->GetActualClass(std::map<x,y>*)
could delete itself while performing the lookup, since a new instance
was created that replaced the existing instance.
To make type name normalisation stable, the following was changed in
TClassEdit:
- Improve the handling of a trailing const in the allocator definition.
- Make default allocator check more robust w.r.t. spaces in type
definition.
- Improve detection of std::basic_string, std::__cxx11::basic_string and
similar types with/without const and std::
- Add another stripping step to remove default template arguments of STL
containers when they were looked up in the interpreter.
Fixroot-project#18654.
hageboeck
added a commit
to hageboeck/root
that referenced
this issue
May 9, 2025
When looking up a TClass via name compared to via typeid, the lookup
returned a name without default template arguments in the former, and
with default arguments in the latter case.
This lead to a situation where
tclass->GetActualClass(std::map<x,y>*)
could delete itself while performing the lookup, since a new instance
was created that replaced the existing instance.
To make type name normalisation stable, the following was changed in
TClassEdit:
- Improve the handling of a trailing const in the allocator definition.
- Make default allocator check more robust w.r.t. spaces in type
definition.
- Improve detection of std::basic_string, std::__cxx11::basic_string and
similar types with/without const and std::
- Add another stripping step to remove default template arguments of STL
containers when they were looked up in the interpreter.
Fixroot-project#18654.
Check duplicate issues.
Description
The Python version of df104_CSV frequently crashes on Ubuntu when Cppyy queries types for
unordered_map<string,char>
. Although a TClass for this might exist, a query formight not normalise to the same class, so another TClass instance is created. During its creation, it deletes the instance for
unordered_map<string,char>
, leading to a dangling pointer and a use-after-free crash.Reproducer
ROOT version
Master and v6.36
Installation method
Source
Operating system
All, but the crash manifests on Ubuntu
Additional context
No response
The text was updated successfully, but these errors were encountered: