eeschema undo: corrupted schematic when undoing hierarchical pin operations

[Dino Ghilardi]

When undoing some operations on hierarchical pin of a sheet, some lines from buses from another page appear on the sheet then, exiting eeschema it segfaults.

To reproduce:
-Open the attached project.
-"Import a hierarchical sheet pin" from the sheet in the main page, import all five of them.
-Undo once. See the whole sheet when undoing: some bus lines appear (in the same position as they hare in the child sheet).

May be is related to bug Bug #1844620, where the problem was also on the undo system, but this is just an hypothesis.

Tested on master branch, commit d17cef95fde0318dd6b8694dfff2c1bb6449e125.

Stable version seems to not have the issue (tested on 5.1.2 and 5.1.4)

I've seen this issue also some months ago, but I was not able to reproduce it in a deterministic way, but on this project seems to be deterministic (on my machine).

Application: Eeschema
Version: (5.99.0-186-gd17cef95f-dirty), release build
Libraries:
    wxWidgets 3.0.2
    libcurl/7.52.1 GnuTLS/3.5.8 zlib/1.2.8 libidn2/0.16 libpsl/0.17.0 (+libidn2/0.16) libssh2/1.7.0 nghttp2/1.18.1 librtmp/2.3
Platform: Linux 4.9.0-8-amd64 x86_64, 64 bit, Little endian, wxGTK
Build Info:
    Build date: Oct 1 2019 19:07:40
    wxWidgets: 3.0.2 (wchar_t,wx containers,compatible with 2.8) GTK+ 2.24
    Boost: 1.69.0
    OpenCASCADE Community Edition: 6.8.0
    Curl: 7.52.1
    Compiler: GCC 6.3.0 with C++ ABI 1010

Build settings:
    KICAD_SCRIPTING=ON
    KICAD_SCRIPTING_MODULES=ON
    KICAD_SCRIPTING_PYTHON3=OFF
    KICAD_SCRIPTING_WXPYTHON=ON
    KICAD_SCRIPTING_WXPYTHON_PHOENIX=OFF
    KICAD_SCRIPTING_ACTION_MENU=ON
    BUILD_GITHUB_PLUGIN=ON
    KICAD_USE_OCE=ON
    KICAD_USE_OCC=OFF
    KICAD_SPICE=ON

Note: The build is "dirty" since I'm using a patch that shows a better netname in pcbnew, so the code of eeschema is "clean" (patch from wishlist bug #1842906).

[Dino Ghilardi (dino-ghilardi)]

After the first undo (and having those two bus lines on the sheet), if you exit eeschema you get a segfault (don't save exiting):

gdb output:

Thread 1 "kicad" received signal SIGSEGV, Segmentation fault.
0x0000000000000151 in ?? ()
(gdb) backtrace
#0 0x0000000000000151 in ?? ()
#1 0x00007fffe13453c9 in PICKED_ITEMS_LIST::ClearListAndDeleteItems() () from /home/dinoghi/SANDBOXKICAD5/usr/bin/_eeschema.kiface
#2 0x00007fffe10e8358 in SCH_SCREEN::ClearUndoORRedoList(UNDO_REDO_CONTAINER&, int) () from /home/dinoghi/SANDBOXKICAD5/usr/bin/_eeschema.kiface
#3 0x00007fffe10ead7f in SCH_SCREEN::~SCH_SCREEN() () from /home/dinoghi/SANDBOXKICAD5/usr/bin/_eeschema.kiface
#4 0x00007fffe10efaee in SCH_SHEET::~SCH_SHEET() () from /home/dinoghi/SANDBOXKICAD5/usr/bin/_eeschema.kiface
#5 0x00007fffe11167b2 in SCH_EDIT_FRAME::~SCH_EDIT_FRAME() () from /home/dinoghi/SANDBOXKICAD5/usr/bin/_eeschema.kiface
#6 0x00007fffe1116ab9 in SCH_EDIT_FRAME::~SCH_EDIT_FRAME() () from /home/dinoghi/SANDBOXKICAD5/usr/bin/_eeschema.kiface
#7 0x00007ffff6344732 in wxAppConsoleBase::DeletePendingObjects() () from /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#8 0x00007ffff63447b1 in wxAppConsoleBase::ProcessIdle() () from /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#9 0x00007ffff6d15191 in wxAppBase::ProcessIdle() () from /usr/lib/x86_64-linux-gnu/libwx_gtk2u_core-3.0.so.0
#10 0x00007ffff6c21e16 in wxApp::DoIdle() () from /usr/lib/x86_64-linux-gnu/libwx_gtk2u_core-3.0.so.0
#11 0x00007ffff6c21ef3 in ?? () from /usr/lib/x86_64-linux-gnu/libwx_gtk2u_core-3.0.so.0
#12 0x00007ffff21ad6aa in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#13 0x00007ffff21ada60 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#14 0x00007ffff21add82 in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#15 0x00007ffff325e3b7 in gtk_main () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#16 0x00007ffff6c41e65 in wxGUIEventLoop::DoRun() () from /usr/lib/x86_64-linux-gnu/libwx_gtk2u_core-3.0.so.0
#17 0x00007ffff638627b in wxEventLoopBase::Run() () from /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#18 0x00007ffff634b776 in wxAppConsoleBase::MainLoop() () from /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#19 0x00005555555d3536 in ?? ()
#20 0x00007ffff63d7cd0 in wxEntry(int&, wchar_t**) () from /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#21 0x00005555555af568 in ?? ()
#22 0x00007ffff37982e1 in __libc_start_main (main=0x5555555af540, argc=1, argv=0x7fffffffe178, init=<optimized out>, fini=<optimized out>,
    rtld_fini=<optimized out>, stack_end=0x7fffffffe168) at ../csu/libc-start.c:291
#23 0x00005555555bac8a in _start ()

[Wayne Stambaugh (stambaughw)]

I have verified this bug on master. On debug builds I see the following assertion after undo.

ASSERT INFO:
/home/wayne/src/kicad-trunk/common/dlist.cpp(175): assert "aElement && aElement->GetList() == this" failed in remove().

BACKTRACE:
[1] finish libcontext.cpp

Here is the back trace:

Thread 1 "kicad" received signal SIGSEGV, Segmentation fault.
0x0000000000000401 in ?? ()
(gdb) bt
#0 0x0000000000000401 in ()
#1 0x00007fffd35b7d4d in PICKED_ITEMS_LIST::ClearListAndDeleteItems()
    (this=0xa1bd590)
    at /home/wayne/src/kicad-trunk/common/undo_redo_container.cpp:121
#2 0x00007fffd33598e7 in SCH_SCREEN::ClearUndoORRedoList(UNDO_REDO_CONTAINER&, int) (this=0x50cd800, aList=..., aItemCount=-1)
    at /home/wayne/src/kicad-trunk/eeschema/sch_screen.cpp:603
#3 0x00007fffd349dc28 in BASE_SCREEN::ClearUndoRedoList() (this=0x50cd800)
    at /home/wayne/src/kicad-trunk/common/base_screen.cpp:282
#4 0x00007fffd3356daa in SCH_SCREEN::~SCH_SCREEN() (this=0x50cd800)
    at /home/wayne/src/kicad-trunk/eeschema/sch_screen.cpp:133
#5 0x00007fffd3356f39 in SCH_SCREEN::~SCH_SCREEN() (this=0x50cd800)
    at /home/wayne/src/kicad-trunk/eeschema/sch_screen.cpp:132
#6 0x00007fffd336469f in SCH_SHEET::~SCH_SHEET() (this=0x50c5400)
    at /home/wayne/src/kicad-trunk/eeschema/sch_sheet.cpp:93
#7 0x00007fffd3364769 in SCH_SHEET::~SCH_SHEET() (this=0x50c5400)
    at /home/wayne/src/kicad-trunk/eeschema/sch_sheet.cpp:85
#8 0x00007fffd33826e9 in SCH_EDIT_FRAME::~SCH_EDIT_FRAME() (this=0x2eabd80)
    at /home/wayne/src/kicad-trunk/eeschema/sch_edit_frame.cpp:316
#9 0x00007fffd3382879 in SCH_EDIT_FRAME::~SCH_EDIT_FRAME() (this=0x2eabd80)
    at /home/wayne/src/kicad-trunk/eeschema/sch_edit_frame.cpp:308
#10 0x00007ffff730ae63 in wxAppConsoleBase::DeletePendingObjects() ()
    at /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#11 0x00007ffff730aee5 in wxAppConsoleBase::ProcessIdle() ()
    at /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#12 0x00007ffff78e57f4 in wxAppBase::ProcessIdle() ()
    at /usr/lib/x86_64-linux-gnu/libwx_gtk3u_core-3.0.so.0
#13 0x00007ffff7816385 in wxApp::DoIdle() ()
    at /usr/lib/x86_64-linux-gnu/libwx_gtk3u_core-3.0.so.0
#14 0x00007ffff7816473 in ()
    at /usr/lib/x86_64-linux-gnu/libwx_gtk3u_core-3.0.so.0
#15 0x00007ffff58a5d7e in g_main_context_dispatch ()
    at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#16 0x00007ffff58a6130 in () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#17 0x00007ffff58a6403 in g_main_loop_run ()
    at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007ffff5ec96e5 in gtk_main ()
    at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#19 0x00007ffff7833265 in wxGUIEventLoop::DoRun() ()
--Type <RET> for more, q to quit, c to continue without paging--c
    at /usr/lib/x86_64-linux-gnu/libwx_gtk3u_core-3.0.so.0
#20 0x00007ffff734799d in wxEventLoopBase::Run() () at /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#21 0x00007ffff73109b6 in wxAppConsoleBase::MainLoop() () at /usr/lib/x86_64-linux-gnu/libwx_baseu-3.0.so.0
#22 0x000000000049ad78 in APP_KICAD::OnRun() (this=0x7e31a0) at /home/wayne/src/kicad-trunk/kicad/kicad.cpp:261
#23 0x00007ffff7398a39 in wxEntry(int&, wchar_t**) () at /usr/lib/x86_64-li...

[KiCad Janitor (kicad-janitor)]

Fixed in revision 9d288968e7311fd7e28d888f717fd32d161f7c1c
https://git.launchpad.net/kicad/patch/?id=9d288968e7311fd7e28d888f717fd32d161f7c1c