crash in wxLua_wxBoxSizer_delete_function

[gongchengjinlove]

Thread 1 received signal SIGSEGV, Segmentation fault.
0x0057053e in wxLua_wxBoxSizer_delete_function (p=0xdfff07c)
at D:\AINO\wxlua\wxLua\modules\wxbind\src\wxcore_sizer.cpp:3380
warning: Source file is more recent than executable.
3380 delete o;
(gdb) bt
#0 0x0057053e in wxLua_wxBoxSizer_delete_function (p=0xdfff07c)
at D:\AINO\wxlua\wxLua\modules\wxbind\src\wxcore_sizer.cpp:3380
#1 0x005c23a6 in wxluaO_deletegcobject (L=0x102101c8, stack_idx=1, flags=0)
at D:\AINO\wxlua\wxLua\modules\wxlua\wxllua.cpp:434
#2 0x005bbd58 in wxlua_wxLuaBindClass__gc (L=0x102101c8) at D:\AINO\wxlua\wxLua\modules\wxlua\wxlbind.cpp:113
#3 0x00a04c38 in lj_BC_FUNCC ()

source:
wxcore_sizer.cpp:3380
3377 void wxLua_wxBoxSizer_delete_function(void** p)
3378 {
3379 wxBoxSizer* o = (wxBoxSizer*)(*p);
3380 delete o;
3381 }

wxBoxSizer maybe delete by wxwidgets

wxLua: latest
wxwidgets: 3.3.1
Toolchain: mingw32 i686-15.2.0-release-posix-dwarf-ucrt-rt_v13-rev0 gcc 15.2.0

[pkulchenko]

Thank you for the report. Do you have any example of what was happening in the Lua code that led to this error? Also, what's the version of wxwidgets and wxlua that you're using?

[gongchengjinlove]

Thank you for the report. Do you have any example of what was happening in the Lua code that led to this error? Also, what's the version of wxwidgets and wxlua that you're using?

demo.lua

timerA = wx.wxTimer()
timerA:Connect(wx.wxEVT_TIMER, function()
	for i=1, 10000, 1 do
		-- wx.wxFont(...)
		wx.wxColour("red")
	end
end)
timerA:Start(1000)

wxllua.cpp
bool LUACALL wxluaO_deletegcobject(lua_State *L, int stack_idx, int flags)

if (wxString(wxlClass->name) == "wxBoxSizer") {
    bool is_in = wxluaO_isgcobject(L, obj_ptr);

    // get true wxl_type 获取它在表里真实的 TypeID
    lua_pushlightuserdata(L, &wxlua_lreg_gcobjects_key);
    lua_rawget(L, LUA_REGISTRYINDEX);
    lua_pushlightuserdata(L, obj_ptr);
    lua_rawget(L, -2);

    int real_type_id = -1;
    if (lua_isnumber(L, -1)) real_type_id = (int)lua_tonumber(L, -1);
    lua_pop(L, 2); // pop value and table

    wxString report;
    report.Printf("Target Ptr: %p\nIsGC: %d\nReal TypeID in Table: %d\nExpected TypeID: %d", 
                  obj_ptr, (int)is_in, real_type_id, *(wxlClass->wxluatype));
   wxPrint(report);
}

Target Ptr: 0x3bf3a50
IsGC: 1
Real TypeID in Table: 153
Expected TypeID: 129
----------------

wxBoxSizer is not in the gcobjects table, but wxColour is. This causes the code to enter wxlClass->delete_fn(&obj_ptr), resulting in a double free.