[zeromq-dev] pure virtual method called

[Toralf Wittner]

On Sat, Oct 16, 2010 at 12:32 AM, Martin Sustrik <sustrik at 250bpm.com> wrote:
> Good spot! Can you please sign off the patch so that I can apply it?

Attached is the signed off patch.

> However, while the above is definitely a bug, I don't think it can actually
> cause the pure virtual method to be called. Or am I missing something.

This is related to the way instances of derived classes are
constructed/destroyed which is a multi-step process. First the base
class constructor is called and this refers to the virtual method
table (vtbl) of base class. Then - before the derived constructor is
called - this is reset to the vtbl of the derived class. When an
instance is deleted the process is reversed, so after the derived
destructor finishes, this refers to the base class vtbl and the base
class destructor is invoked.

Now what we have here is that in poller_base_t::execute_timers() we
use a (dangling) pointer to a base class i_poll_events after the
instance has been deleted. Technically this results in undefined
behaviour but if the memory is still available, then the object the
pointer points to will refer only to the base class vtbl because the
destructor chain finished like described above which thus causes the
pure virtual method error when we call
i_poll_events::timer_event(int). But - this being undefined behaviour
- it could as well result in a segmentation fault instead.

> I would rather say the problem is caused by deleting the pgm_sender_t object
> without calling unplug beforehand.

AFAICS pgm_sender_t is deleted like this:

void zmq::pgm_sender_t::terminate ()
{
    unplug ();
    delete this;
}

Cheers,
Toralf
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Cancel-tx_timer_id-in-pgm_sender_t-out_event.patch
Type: text/x-patch
Size: 878 bytes
Desc: not available
URL: <https://lists.zeromq.org/pipermail/zeromq-dev/attachments/20101016/1da8237b/attachment.bin>