Update of bug #68552 (group groff):
Category: None => Core
Severity: 2 - Minor => 4 - Important
Status: Need Info => Confirmed
Assigned to: None => gbranden
Summary: [not our problem?] null pointer dereference in
`write_any_trailer_and_exit()` using Clang on Termux => [troff] double-free
via `exit()` in `write_any_trailer_and_exit()` using Clang on Termux
_______________________________________________________
Follow-up Comment #2:
[https://lists.gnu.org/archive/html/groff/2026-07/msg00044.html Bruno steered
me well.]
> I happened upon a baffling bug today.
>
> https://savannah.gnu.org/bugs/?68552
exit() runs the destructors of global C++ objects [1], while quick_exit()
doesn't [2].
Does the crash persist of you call quick_exit() instead of exit()?
Bruno
[1] https://en.cppreference.com/cpp/utility/program/exit
[2] https://en.cppreference.com/cpp/utility/program/quick_exit
The bug disappears if I replace `exit()` with `quick_exit()` _and_ it does not
reproduce from a _groff_ 1.24.1 distribution archive build, which means this
really is a regression, and likely one I introduced. Damn.
The sun will become a red giant before I can achieve a build-demanding
bisection of 1,000+ commits on my tablet.
I'll have to find out if I can get LLDB to tell me _which_ object's destructor
is attempting the redundant free/delete. Maybe ASAN can help with that.
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68552>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
