wxTipWindow can crash due to constructor race condition (Issue #26070)

[Bill Su]

wsu-cb created an issue (wxWidgets/wxWidgets#26070)

Description

Bug description:

I have seen wxTipWindow actually be closed during its constructor. This causes a sequencing problem where the wxTipWindow* is nulled by wxTipWindow::Close() before it is assigned by the wxTipWindow* p = new wxTipWindow(..., &p). This can then cause a crash later because wxTipWindow* p is not null despite having been destructed.

Expected vs observed behaviour:

The wxTipWindow* p should only be non-null when p has not been destructed.

Patch or snippet allowing to reproduce the problem:

tipwin-ctor-race.patch

To Reproduce:

Steps to reproduce the behaviour, please make them as detailed as possible.
For example:

1. Apply attached patch to dialogs sample
2. Compile and run dialogs sample
3. The sample will probably crash after a few seconds.
4. Look at the wxLogDebug() output. You will probably find that sometimes wxTipWindow::Close() occurs during `wxTipWindow::wxTipWindow()

Platform and version information

• wxWidgets version you use: master 1b582af
• wxWidgets port you use: wxMSW
• OS and its version: Windows 11 25H2

—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.Message ID: <wxWidgets/wxWidgets/issues/26070@github.com>

[VZ]

Closed #26070 as completed via 96eca64.

—
Reply to this email directly, view it on GitHub, or unsubscribe.

You are receiving this because you are subscribed to this thread.Message ID: <wxWidgets/wxWidgets/issue/26070/issue_event/21933885812@github.com>