Skip to content

Minor review feedback#1

Merged
hhsiao merged 5 commits intohhsiao:Text-Wrappingfrom
vadi2:review-feedback
Aug 27, 2022
Merged

Minor review feedback#1
hhsiao merged 5 commits intohhsiao:Text-Wrappingfrom
vadi2:review-feedback

Conversation

@vadi2
Copy link
Copy Markdown

@vadi2 vadi2 commented Aug 19, 2022

No description provided.

@github-actions
Copy link
Copy Markdown

Fails
🚫

PR title must start with fix, improve, add or infra for release notes purposes.

Generated by 🚫 dangerJS against 8cf1477

Copy link
Copy Markdown

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clang-tidy made some suggestions

}

if ((bSearchEnd - bSearchIteratorCurrent) <= 1) {
// this line doesn't even need wrapping
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warning: repeated branch in conditional chain [bugprone-branch-clone]

nt) <= 1) {
          ^

src/TBuffer.cpp:2371: end of the original

     break;
                     ^

src/TBuffer.cpp:2380: clone 1 starts here

   } else {
          ^

@hhsiao hhsiao merged commit eda2fd0 into hhsiao:Text-Wrapping Aug 27, 2022
@vadi2 vadi2 deleted the review-feedback branch August 27, 2022 04:41
hhsiao pushed a commit that referenced this pull request Feb 25, 2026
<!-- Keep the title short & concise so anyone non-technical can
understand it,
     the title appears in PTB changelogs -->
#### Brief overview of PR changes/additions
Fixes Mudlet crash with IRC open when closing a profile
#### Motivation for adding to Mudlet
Mudlet should never crash
#### Other info (issues closed, discussion etc)
Closes Mudlet#7293. I'll fix other
cases of `Host* mpHost;` after this PR so we have consistency in the
codebase.

Running the provided test case through
[AddressSanitizer](https://wiki.mudlet.org/w/Compiling_Mudlet#Checking_memory_leaks_.26_other_issues_.28sanitizers.29_3)
revealed that mpHost was being used after it was deleted:

```
=================================================================
==17843==ERROR: AddressSanitizer: heap-use-after-free on address 0x623000025e58 at pc 0x5555560abe75 bp 0x7fffffff7460 sp 0x7fffffff7450
READ of size 8 at 0x623000025e58 thread T0
    #0 0x5555560abe74 in QWeakPointer<QObject>::internalData() const /usr/include/x86_64-linux-gnu/qt6/QtCore/qsharedpointer_impl.h:711
    #1 0x5555562c15ad in QPointer<dlgIRC>::data() const /usr/include/x86_64-linux-gnu/qt6/QtCore/qpointer.h:77
    Mudlet#2 0x5555562bd715 in QPointer<dlgIRC>::operator dlgIRC*() const /usr/include/x86_64-linux-gnu/qt6/QtCore/qpointer.h:85
    Mudlet#3 0x555556296c13 in dlgIRC::~dlgIRC() /home/vadi/Programs/Mudlet/src/dlgIRC.cpp:109
    Mudlet#4 0x555556296e1f in dlgIRC::~dlgIRC() /home/vadi/Programs/Mudlet/src/dlgIRC.cpp:112
    Mudlet#5 0x7ffff6ba04a0 in QObject::event(QEvent*) (/lib/x86_64-linux-gnu/libQt6Core.so.6+0x1a04a0)
...
```
This helped pinpoint the cause of the crash.

---------

Co-authored-by: Stephen Lyons <slysven@virginmedia.com>
Co-authored-by: Vadim Peretokin <vadi2@users.noreply.github.com>
hhsiao pushed a commit that referenced this pull request Feb 25, 2026
<!-- Keep the title short & concise so anyone non-technical can
understand it,
     the title appears in PTB changelogs -->
#### Brief overview of PR changes/additions
Fix

```
Direct leak of 4000 byte(s) in 50 object(s) allocated from:
    #0 0x7f21286b61e7 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x5652d10ed62c in TriggerHighlighter::setTheme(QString const&) (/home/runner/work/Mudlet/Mudlet/src/mudlet+0x202562c)
    Mudlet#2 0x5652d10ecba7 in TriggerHighlighter::TriggerHighlighter(QTextDocument*) (/home/runner/work/Mudlet/Mudlet/src/mudlet+0x2024ba7)
    Mudlet#3 0x5652d0998ef2 in SingleLineTextEdit::SingleLineTextEdit(QWidget*) (/home/runner/work/Mudlet/Mudlet/src/mudlet+0x18d0ef2)
    Mudlet#4 0x5652d05f581a in Ui_trigger_pattern_edit::setupUi(QWidget*) (/home/runner/work/Mudlet/Mudlet/src/mudlet+0x152d81a)
    Mudlet#5 0x5652d05f2792 in dlgTriggerPatternEdit::dlgTriggerPatternEdit(QWidget*) (/home/runner/work/Mudlet/Mudlet/src/mudlet+0x152a792)
    Mudlet#6 0x5652d044b2a2 in dlgTriggerEditor::dlgTriggerEditor(Host*) (/home/runner/work/Mudlet/Mudlet/src/mudlet+0x13832a2)
    Mudlet#7 0x5652d08479a9 in mudlet::addConsoleForNewHost(Host*) (/home/runner/work/Mudlet/Mudlet/src/mudlet+0x177f9a9)
    Mudlet#8 0x5652d086efcb in mudlet::slot_connectionDialogueFinished(QString const&, bool) (/home/runner/work/Mudlet/Mudlet/src/mudlet+0x17a6fcb)
```
#### Motivation for adding to Mudlet
Better app quality
#### Other info (issues closed, discussion etc)
Discovered when running Mudlet with cmake.
hhsiao pushed a commit that referenced this pull request Feb 25, 2026
…rocessing (Mudlet#8571)

<!-- Keep the title short & concise so anyone non-technical can
understand it,
     the title appears in PTB changelogs -->
#### Brief overview of PR changes/additions
Fix: heap-use-after-free when cleanup runs during alias/trigger/key
processing
#### Motivation for adding to Mudlet
Fixes crash when running
Mudlet#8559 (comment)
benchmark on Linux.
#### Other info (issues closed, discussion etc)
==617553==ERROR: AddressSanitizer: heap-use-after-free on address
0x51200086e6d0 at pc 0x589b650367f6 bp 0x7ffc44dbc700 sp 0x7ffc44dbc6f8
READ of size 8 at 0x51200086e6d0 thread T0
#0 0x589b650367f5 in Tree<TAlias>::isActive() const
(/home/vadi/Programs/Mudlet/build/src/mudlet+0xe8a7f5) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
#1 0x589b65d81408 in TAlias::match(QString const&)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bd5408) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#2 0x589b6560c156 in AliasUnit::processDataStream(QString const&)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1460156) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#3 0x589b65c872b4 in Host::send(QString, bool, bool)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1adb2b4) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#4 0x589b65d96517 in TCommandLine::enterCommand(QKeyEvent*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bea517) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#5 0x589b65d93095 in TCommandLine::event(QEvent*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1be7095) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#6 0x7ac668391c8a in QApplicationPrivate::notify_helper(QObject*,
QEvent*)
/home/qt/work/qt/qtbase/src/widgets/kernel/qapplication.cpp:3307:31
Mudlet#7 0x7ac66839b2f0 in QApplication::notify(QObject*, QEvent*)
/home/qt/work/qt/qtbase/src/widgets/kernel/qapplication.cpp:2725:39
Mudlet#8 0x7ac668b83f7f in QCoreApplication::notifyInternal2(QObject*,
QEvent*)
/home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1109:24
Mudlet#9 0x7ac66840cc0b in QWidgetWindow::event(QEvent*)
/home/qt/work/qt/qtbase/src/widgets/kernel/qwidgetwindow.cpp:285:23
Mudlet#10 0x7ac668391c8a in QApplicationPrivate::notify_helper(QObject*,
QEvent*)
/home/qt/work/qt/qtbase/src/widgets/kernel/qapplication.cpp:3307:31
Mudlet#11 0x7ac668b83f7f in QCoreApplication::notifyInternal2(QObject*,
QEvent*)
/home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1109:24
Mudlet#12 0x7ac6677ee8e2 in
QGuiApplicationPrivate::processKeyEvent(QWindowSystemInterfacePrivate::KeyEvent*)
/home/qt/work/qt/qtbase/src/gui/kernel/qguiapplication.cpp:2609:46
Mudlet#13 0x7ac655cf9a04 in
QIBusPlatformInputContext::filterEventFinished(QDBusPendingCallWatcher*)
/home/qt/work/qt/qtbase/src/plugins/platforminputcontexts/ibus/qibusplatforminputcontext.cpp:523:57
Mudlet#14 0x7ac668be8b74 in QtPrivate::QSlotObjectBase::call(QObject*, void**)
/home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461:57
Mudlet#15 0x7ac668be8b74 in void doActivate<false>(QObject*, int, void**)
/home/qt/work/qt/qtbase/src/corelib/kernel/qobject.cpp:4255:30
Mudlet#16 0x7ac6671e5142 in void QMetaObject::activate<void,
QDBusPendingCallWatcher*>(QObject*, QMetaObject const*, int, void*,
QDBusPendingCallWatcher* const&)
/home/qt/work/qt/qtbase/src/corelib/kernel/qobjectdefs.h:319:17
Mudlet#17 0x7ac6671e5142 in
QDBusPendingCallWatcher::finished(QDBusPendingCallWatcher*)
/home/qt/work/qt/qtbase_build/src/dbus/DBus_autogen/include/moc_qdbuspendingcall.cpp:137:32
Mudlet#18 0x7ac668bdd56b in QObject::event(QEvent*)
/home/qt/work/qt/qtbase/src/corelib/kernel/qobject.cpp:1411:31
Mudlet#19 0x7ac668391c8a in QApplicationPrivate::notify_helper(QObject*,
QEvent*)
/home/qt/work/qt/qtbase/src/widgets/kernel/qapplication.cpp:3307:31
Mudlet#20 0x7ac668b83f7f in QCoreApplication::notifyInternal2(QObject*,
QEvent*)
/home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1109:24
Mudlet#21 0x7ac668b879e4 in
QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*)
/home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1904:36
Mudlet#22 0x7ac668e7d416 in postEventSourceDispatch
/home/qt/work/qt/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:246:39
Mudlet#23 0x7ac6667145c4 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d5c4)
(BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
Mudlet#24 0x7ac666773736 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc736)
(BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
Mudlet#25 0x7ac666713a62 in g_main_context_iteration
(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca62) (BuildId:
1eb6131419edb83b2178b682829a6913cf682d75)
Mudlet#26 0x7ac668e7caad in
QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
/home/qt/work/qt/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:399:43
Mudlet#27 0x7ac668b9002a in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)
/home/qt/work/qt/qtbase/src/corelib/kernel/qeventloop.cpp:186:22
Mudlet#28 0x7ac668b8ba59 in QCoreApplication::exec()
/home/qt/work/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1452:36
Mudlet#29 0x589b64ab0675 in main
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x904675) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#30 0x7ac66602a1c9 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
Mudlet#31 0x7ac66602a28a in __libc_start_main csu/../csu/libc-start.c:360:3
Mudlet#32 0x589b649c1d04 in _start
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x815d04) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)

0x51200086e6d0 is located 16 bytes inside of 296-byte region
[0x51200086e6c0,0x51200086e7e8)
freed by thread T0 here:
#0 0x589b64a9b9f1 in operator delete(void*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x8ef9f1) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
#1 0x589b65d80711 in TAlias::~TAlias()
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bd4711) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#2 0x589b6560eefc in AliasUnit::doCleanup()
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1462efc) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#3 0x589b65c8e88d in Host::incomingStreamProcessor(QString const&, int)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1ae288d) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#4 0x589b651b73b5 in TMainConsole::runTriggers(int)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x100b3b5) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#5 0x589b64e39c4b in TBuffer::commitLine(char, unsigned long&)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0xc8dc4b) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#6 0x589b64e28d4e in
TBuffer::translateToPlainText(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char>>&, bool)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0xc7cd4e) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#7 0x589b651b638d in
TMainConsole::printOnDisplay(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char>>&, bool)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x100a38d) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#8 0x589b64f9ed5b in TLuaInterpreter::feedTriggers(lua_State*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0xdf2d5b) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#9 0x7ac66942ffa0 in luaD_precall
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/ldo.c:320:10
Mudlet#10 0x7ac66943ad7a in luaV_execute
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/lvm.c:591:17
Mudlet#11 0x7ac66942e96c in luaD_call
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/ldo.c:378:5
Mudlet#12 0x7ac66942af70 in luaD_rawrunprotected
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/ldo.c:116:3
Mudlet#13 0x7ac66942bb94 in luaD_pcall
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/ldo.c:464:12
Mudlet#14 0x7ac66942bce0 in lua_pcall
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/lapi.c:821:12
Mudlet#15 0x589b64fd65f1 in TLuaInterpreter::call(QString const&, QString
const&, bool) (/home/vadi/Programs/Mudlet/build/src/mudlet+0xe2a5f1)
(BuildId: c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#16 0x589b65d84d31 in TAlias::execute()
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bd8d31) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#17 0x589b65d84577 in TAlias::match(QString const&)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bd8577) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#18 0x589b6560c156 in AliasUnit::processDataStream(QString const&)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1460156) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#19 0x589b65c872b4 in Host::send(QString, bool, bool)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1adb2b4) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#20 0x589b65d96517 in TCommandLine::enterCommand(QKeyEvent*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bea517) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#21 0x589b65d93095 in TCommandLine::event(QEvent*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1be7095) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#22 0x7ac668391c8a in QApplicationPrivate::notify_helper(QObject*,
QEvent*)
/home/qt/work/qt/qtbase/src/widgets/kernel/qapplication.cpp:3307:31

previously allocated by thread T0 here:
#0 0x589b64a9b171 in operator new(unsigned long)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x8ef171) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
#1 0x589b6500f595 in TLuaInterpreter::startTempAlias(QString const&,
QString const&) (/home/vadi/Programs/Mudlet/build/src/mudlet+0xe63595)
(BuildId: c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#2 0x589b6512c41d in TLuaInterpreter::tempAlias(lua_State*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0xf8041d) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#3 0x7ac66942ffa0 in luaD_precall
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/ldo.c:320:10
Mudlet#4 0x7ac66943ad7a in luaV_execute
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/lvm.c:591:17
Mudlet#5 0x7ac66942e96c in luaD_call
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/ldo.c:378:5
Mudlet#6 0x7ac66942af70 in luaD_rawrunprotected
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/ldo.c:116:3
Mudlet#7 0x7ac66942bb94 in luaD_pcall
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/ldo.c:464:12
Mudlet#8 0x7ac66942bce0 in lua_pcall
/build/lua5.1-rMDsVj/lua5.1-5.1.5/src/lapi.c:821:12
Mudlet#9 0x589b64fd65f1 in TLuaInterpreter::call(QString const&, QString
const&, bool) (/home/vadi/Programs/Mudlet/build/src/mudlet+0xe2a5f1)
(BuildId: c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#10 0x589b65d84d31 in TAlias::execute()
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bd8d31) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#11 0x589b65d84577 in TAlias::match(QString const&)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bd8577) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#12 0x589b6560c156 in AliasUnit::processDataStream(QString const&)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1460156) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#13 0x589b65c872b4 in Host::send(QString, bool, bool)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1adb2b4) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#14 0x589b65d96517 in TCommandLine::enterCommand(QKeyEvent*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1bea517) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#15 0x589b65d93095 in TCommandLine::event(QEvent*)
(/home/vadi/Programs/Mudlet/build/src/mudlet+0x1be7095) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4)
Mudlet#16 0x7ac668391c8a in QApplicationPrivate::notify_helper(QObject*,
QEvent*)
/home/qt/work/qt/qtbase/src/widgets/kernel/qapplication.cpp:3307:31

SUMMARY: AddressSanitizer: heap-use-after-free
(/home/vadi/Programs/Mudlet/build/src/mudlet+0xe8a7f5) (BuildId:
c98a5e4208b6daa52aa1b083c4ee6c4ab4552cc4) in Tree<TAlias>::isActive()
const
Shadow bytes around the buggy address:
  0x51200086e400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51200086e480: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x51200086e500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x51200086e580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51200086e600: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
=>0x51200086e680: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x51200086e700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51200086e780: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x51200086e800: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x51200086e880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51200086e900: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==617553==ABORTING

Co-authored-by: Vadim Peretokin <vadi2@users.noreply.github.com>
hhsiao pushed a commit that referenced this pull request Feb 25, 2026
…gers (Mudlet#8567)

#### Brief overview of PR changes/additions

Fixed a heap-use-after-free crash in TBuffer destructor by converting
the raw `mTagWatchdog` pointer to `std::unique_ptr<QTimer>` and
implementing proper copy constructor and copy assignment operator.

#### Motivation for adding to Mudlet

The crash occurred when closing a profile (e.g., using "Close Profile"
menu item on Medievia MUD) that had been actively receiving data and
running triggers. The issue was caused by TBuffer objects being copied
without properly handling the ownership of the `mTagWatchdog` QTimer.
When temporary TBuffer objects were created during copy operations (like
in `TConsole::copy()`), both the original and copied instances shared
the same QTimer pointer. When one instance was destroyed, it deleted the
timer, leaving the other with a dangling pointer that caused a crash on
subsequent destruction.

AddressSanitizer trace showed:
```
ERROR: AddressSanitizer: heap-use-after-free on address 0x602000915670
READ of size 8 at 0x602000915670 thread T0
#0 in TBuffer::TBuffer()+0x88
#1 in TBuffer::TBuffer()+0x18
Mudlet#2 in TMainConsole::~TMainConsole()+0x5a8

```

The fix ensures each TBuffer instance owns its own QTimer through a
unique_ptr, preventing double-deletion and use-after-free errors.

#### Other info (issues closed, discussion etc)

This resolves crashes that occurred during profile shutdown when the
copy() Lua function was used in triggers processing incoming game data.
hhsiao pushed a commit that referenced this pull request Feb 25, 2026
Mudlet#8694) (Mudlet#8751)

## Summary

Fixes Mudlet#8694 - `table.update` would error when the first table had a
non-table value (number, string, boolean) at a key where the second
table had a table value.

**Example that crashed:**
```lua
table.update({ x = 1 }, { x = { y = 2 } })
-- Error: bad argument #1 to 'pairs' (table expected, got number)
```

**Root cause:** The recursion logic `tbl[k] = table.update(tbl[k] or {},
v)` only checked for nil/false before recursing, not for other non-table
types.

**Fix:** Check `type(existing) == "table"` before passing to recursive
call.

## Test plan

- [x] Added 5 new test cases in `TableUtils_spec.lua`:
  - Replace number with table
  - Replace table with number  
  - Merge nested tables (both tables)
  - Replace string with table
  - Replace boolean with table

- [x] Verified fix works: `luajit -e "dofile('...TableUtils.lua');
print(table.update({x=1}, {x={y=2}}).x.y)"` outputs `2`

## Notes

Tests require running inside Mudlet with `runTests` command (uses Busted
framework loaded by Mudlet).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Vadim Peretokin <vperetokin@hey.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants