Hi Abe,

if upstream doesn't respond fast enough, here's my contribution to the
bug hunt for this release cycle, I just had an hour to look through the
BTS.

This bug is a common problem when using STL containers (deleting the
element at the iterator).

The attached patch fixes the two critical cases (hunks #2 and #3, with
the crash backtrace belonging to the first of those) and one other
location (hunk #1) where upstream already noticed that there were
problems and creatively fixed it.

I have tested that the program starts up now, but I have no time to
test #1 as well.

Best regards!

Jan
Index: evolvotron-0.7.1/libevolvotron/mutatable_image_computer_farm.cpp
===================================================================
--- evolvotron-0.7.1.orig/libevolvotron/mutatable_image_computer_farm.cpp
+++ evolvotron-0.7.1/libevolvotron/mutatable_image_computer_farm.cpp
@@ -72,19 +72,20 @@ void MutatableImageComputerFarm::fasttra
 {
   QMutexLocker lock(&_mutex);
   
-  // \todo: Inefficient starting search again each time.  Some problem with erase otherwise though, but might have been task abort mem leak.
-  TodoQueue::iterator it;
-  while (
-	 (
-	  it=std::find_if(_todo.begin(),_todo.end(),predicate_aborted)
-	  )
-	 !=
-	 _todo.end()
-	 )
-    {
-      _done[(*it)->display()].insert(*it);
-      _todo.erase(it);
-    }  
+  TodoQueue::iterator it = _todo.begin();
+
+  while (it != _todo.end())
+    {
+      if ((*it)->aborted())
+	{
+	  _done[(*it)->display()].insert(*it);
+	  it = _todo.erase(it);
+	}
+      else
+	{
+	  it++;
+	}
+    }
 }
 
 void MutatableImageComputerFarm::push_todo(const boost::shared_ptr<MutatableImageComputerTask>& task)
@@ -214,7 +215,9 @@ void MutatableImageComputerFarm::abort_f
       if ((*it)->display()==disp)
 	{
 	  (*it)->abort();
-	  _todo.erase(it);
+	  it = _todo.erase(it);
+	  if (it == _todo.end())
+	    break;
 	}
     }
   
@@ -234,7 +237,9 @@ void MutatableImageComputerFarm::abort_f
 	  if ((*it1)->display()==disp)
 	    {
 	      (*it1)->abort();
-	      q.erase(it1);
+	      it1 = q.erase(it1);
+	      if (it1 == q.end())
+		break;
 	    }
 	}
     }

Reply via email to