Created attachment 373271 [details] GDB backtrace I'm running gnucash 3.5 on OpenBSD. Closing any tab in gnucash will trigger the OpenBSD use-after-free detection and abort the process. gdb backtrace is attached.
Created attachment 373272 [details] Valgrind memcheck report I tried to reproduce the bug on Debian stretch with gnucash 3.5. Setting MALLOC_CHECK_ and MALLOC_PERTURB_ were not enough to trigger the use-after-free. Seems like OpenBSD malloc is more thorough here. Anyway, valgrind memcheck did find the invalid write. Just search for "Invalid write" in the attached valgrind log.
Looks like we free the two style hash tables twice. Can you try removing or commenting out lines 770 and 771 in gnucash/register/register_gnome/gnucash-sheet.c and recompiling?
Created attachment 373273 [details] fix use-after-free Removing lines 770 and 771 in gnucash/register/register_gnome/gnucash-sheet.c didn't help. Careful inspection of the valgrind output suggested swapping the function calls in line 712 and 714 in gnucash/register/register-gnome/gnucash-style.c. This fixed the use-after-free bug. But gnucash still crashes. Now it crashes due to a double-free at program exit - in atexit(). Also including the change suggested by John Ralls helped neither the use-after-free nor the double-free.
Created attachment 373274 [details] GDB backtrace of bogus pointer free
Comment on attachment 373274 [details] GDB backtrace of bogus pointer free Do you have sources installed or just symbols? If sources, what is being freed at /usr/src/lib/libc/stdlib/atexit.c:177? Otherwise, what exact version of libc do you have?
I tried again after installing gnucash as package with my fix in gnucash-style.c. Now I don't see any crashes anymore. I only reproduce the crash in atexit() if running the unstripped gnucash binary from the build directory. I have no idea why.
So does this still need investigation or is the fix in gnucash-style.c enough?
That's up to you since you're the only one who can work it. If it's "good enough" for you you're under no obligation to keep digging. Do you want to submit a PR for gnucash-style.c?
The fix in gnucash-style.c is for fixing exactly the problem I reported in this PR. The other crash seems to be unrelated. So will you merge my patch?
Sorry, PR means a Github pull request, not "Problem Report". I've applied, committed, and pushed your patch. "Merge" is something that's done with pull request branches, not patches.
