Deleting hidden subobjs in groups may lead to crash

Let’s assume an example where an obj has two children, both in a group, and one of them hidden. As hidden objs can’t be focused in group, the non-hidden one is the focused one.

When deleting this obj thus its two children, let’s assume the focused one is deleted first. From lv_obj_del(), lv_group_remove_obj() is called, where, in attempt to remove focus, lv_group_refocus() is called; but, as it can’t move focus to the only remaining object in group (the hidden one), focus won’t change. Subsequently, g->obj_focus = NULL; is executed, and the object in question is removed from the group’s LL.

In next step, the remaining hidden object is to be deleted, again lv_group_remove_obj() is called. There, third line is
if(g->obj_focus == NULL) return; /*Just to be sure (Not possible if there is at least one object in the group)*/
so it will return, without removing the obj from the group’s LL. However, the object is deleted by lv_obj_del() and the pointer to it becomes invalid.

In subsequent use of given group, this “dangling” pointer may cause crash.

I “fixed” the problem simply by removing the above line. I don’t know if that has or not any adverse consequences.

I am using v6.0. A quick glance into v7.0 shows that this piece of code is still there unchanged, so it may be affected, too.

JW

Hi,

Thanks for the detailed description, I see the problem.

Your fix seems appropriate. There is no real drawback to check all the objects.

The mentioned line can be replaced with:

    if(_lv_ll_get_head(&g->obj_ll) == NULL) return; //Return if the list is empty

but I think it’s cleaner to always check it.

I’ve fixed in master: https://github.com/lvgl/lvgl/commit/6d92d084f78600885cf478a84b91fcc142944526
and v6: https://github.com/lvgl/lvgl/commit/4b7fc8f2b3162094c7435c0a7e7a3a2e60736ef3

Thanks, Gabor.

Jan