The PNS router tool segfaults when a drag event is received right after finishing a previous drag.

[Henrik Nyberg]

Application: kicad
Version: (2015-08-03 BZR 6041)-product debug build
wxWidgets: Version 3.0.2 (debug,wchar_t,compiler with C++ ABI 1002,GCC 4.9.3,wx containers,compatible with 2.8)
Platform: Linux 4.0.0-2-amd64 x86_64, 64 bit, Little endian, wxGTK
Boost version: 1.54.0
         USE_WX_GRAPHICS_CONTEXT=OFF
         USE_WX_OVERLAY=OFF
         KICAD_SCRIPTING=OFF
         KICAD_SCRIPTING_MODULES=OFF
         KICAD_SCRIPTING_WXPYTHON=OFF
         USE_FP_LIB_TABLE=HARD_CODED_ON
         BUILD_GITHUB_PLUGIN=ON

I am consistently getting a segfault when dragging vias with the PNS router tool (GAL mode) in Pcbnew. A backtrace is provided in an attachment.

Steps to reproduce:
1. Press 'x' to enter the interactive router.
2. Place the cursor over a via.
3. Press and HOLD 'd' to drag the via (easiest way to reproduce).
4. Move the mouse cursor so that the via is moved from its position.
5. Click the left mouse button to place the via at a different position (still holding 'd').
6. Segfault.

I know that holding the drag key is not necessary or even proper while performing a drag. However, the bug also strikes if you instead of holding the drag button, press it again right after placing the via, as long as no mouse movement has been made in between.

The backtrace hints that no joint is being found at the start of a drag. My quick analysis after looking into the code is that the routing tool attempts to start a drag from the starting position of the initial drag that was just finished. At this position, there is no longer a joint after the via has been moved. Thus the following code, which expects a joint, tries to access it through a null pointer.

If a mouse movement appears before the next drag action, the starting point of the following drag will have been updated to the new cursor position (subject to snapping), and there is no crash.

At least that's what I think happens.

A minimal patch fixing the issue will be attached in a following comment (because Launchpad). Since the drag action itself does not contain a cursor position, it doesn't seem trivial to properly update the snapping position at that moment. Instead, the patch just aborts the drag if no joint is found at the (stale) tool position.

[Nick Østergaard (nickoe)]

Segfaults should be marked as critical.

[Blair Bonnett (bcb)]

Can confirm with r6037.

-------------------------

Application: kicad
Version: (2015-08-02 BZR 6037)-product debug build
wxWidgets: Version 3.0.2 (debug,wchar_t,compiler with C++ ABI 1009,GCC 5.2.0,wx containers,compatible with 2.8)
Platform: Linux 4.1.3-1-ARCH x86_64, 64 bit, Little endian, wxGTK
Boost version: 1.58.0
         USE_WX_GRAPHICS_CONTEXT=OFF
         USE_WX_OVERLAY=OFF
         KICAD_SCRIPTING=ON
         KICAD_SCRIPTING_MODULES=ON
         KICAD_SCRIPTING_WXPYTHON=ON
         USE_FP_LIB_TABLE=HARD_CODED_ON
         BUILD_GITHUB_PLUGIN=ON

[Blair Bonnett (bcb)]

Sorry, that last comment was ambiguous. I meant I can confirm the bug on stock r6037, and that applying Henrik's patch got rid of the segfault.