On Sat, Oct 16, 2010 at 12:32 AM, Martin Sustrik <[email protected]> wrote:
> Good spot! Can you please sign off the patch so that I can apply it?
Attached is the signed off patch.
> However, while the above is definitely a bug, I don't think it can actually
> cause the pure virtual method to be called. Or am I missing something.
This is related to the way instances of derived classes are
constructed/destroyed which is a multi-step process. First the base
class constructor is called and this refers to the virtual method
table (vtbl) of base class. Then - before the derived constructor is
called - this is reset to the vtbl of the derived class. When an
instance is deleted the process is reversed, so after the derived
destructor finishes, this refers to the base class vtbl and the base
class destructor is invoked.
Now what we have here is that in poller_base_t::execute_timers() we
use a (dangling) pointer to a base class i_poll_events after the
instance has been deleted. Technically this results in undefined
behaviour but if the memory is still available, then the object the
pointer points to will refer only to the base class vtbl because the
destructor chain finished like described above which thus causes the
pure virtual method error when we call
i_poll_events::timer_event(int). But - this being undefined behaviour
- it could as well result in a segmentation fault instead.
> I would rather say the problem is caused by deleting the pgm_sender_t object
> without calling unplug beforehand.
AFAICS pgm_sender_t is deleted like this:
void zmq::pgm_sender_t::terminate ()
{
unplug ();
delete this;
}
Cheers,
Toralf
From 044e58b0870fe7adef3afa198d019b744f970f25 Mon Sep 17 00:00:00 2001
From: Toralf Wittner <[email protected]>
Date: Sat, 16 Oct 2010 00:44:41 +0200
Subject: [PATCH] Cancel tx_timer_id in pgm_sender_t::out_event().
Signed-off-by: Toralf Wittner <[email protected]>
---
src/pgm_sender.cpp | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/pgm_sender.cpp b/src/pgm_sender.cpp
index 55a8d4e..957de6d 100644
--- a/src/pgm_sender.cpp
+++ b/src/pgm_sender.cpp
@@ -174,9 +174,9 @@ void zmq::pgm_sender_t::out_event ()
put_uint16 (out_buffer, offset == -1 ? 0xffff : (uint16_t) offset);
}
- if (has_rx_timer) {
- cancel_timer (rx_timer_id);
- has_rx_timer = false;
+ if (has_tx_timer) {
+ cancel_timer (tx_timer_id);
+ has_tx_timer = false;
}
// Send the data.
--
1.7.3.1
_______________________________________________
zeromq-dev mailing list
[email protected]
http://lists.zeromq.org/mailman/listinfo/zeromq-dev
