Fix Crash Bug About vtkCellPicker::~vtkCellPicker And vtkCollection::DeleteElement

Here is dump log which shows the stack information. The class CBase has OpenModule and CloseModule interfaces, they can be called multible times.

exe caused an Access Violation at location 00007FFA62174327 in module vtkCommonCore-8.2.dll Reading from location 0000000000000DA4.

AddrPC           Params
00007FFA62174327 0000000000000001 00007FFA9011F05B 0000013DF642A190  vtkCommonCore-8.2.dll!vtkCollection::DeleteElement
00007FFA62174155 0000000000000001 00007FFA622D3BFF 0000013DF6429290  vtkCommonCore-8.2.dll!vtkCollection::~vtkCollection
00007FFA64AE5470 0000013DDB1DDE10 0000000000000001 0000013E19CD7FE0  vtkRenderingCore-8.2.dll!vtkProp3DCollection::~vtkProp3DCollection
00007FFA64B90D29 0000000000000000 00007FFA622D3BFF 0000013DDB1DDE10  vtkRenderingCore-8.2.dll!vtkPicker::~vtkPicker
00007FFA64B99ED1 0000013DDF940560 0000013DA5B88020 0000013DF656F630  vtkRenderingCore-8.2.dll!vtkCellPicker::~vtkCellPicker
00007FFA623066AD 0000000000000018 0000000000000018 0000013DA5B88020  vtkCommonCore-8.2.dll!vtkSmartPointerBase::operator=
00007FF671AC036E 0000013DF656F5F0 0000013DDFB194D0 0000013DDFB188F0  Test.exe!CBase::OpenModule  [Src\Module\Base.cpp @ 278]
   276: m_Model = new CUModel;
   277: m_ActorCollection = vSP<vtkActorCollection>::New();
>  278: m_ToothPicker = vSP<vtkCellPicker>::New();

Here is what happened in the destructor of vtkCellPicker.

vtkCellPicker::~vtkCellPicker()
{
  this->Gradients->Delete();
  this->Cell->Delete();
  this->PointIds->Delete();
  this->Locators->Delete();
}

When Locators was deleting, the items in PickList will be cleared.

// Destructor for the vtkCollection class. This removes all
// objects from the collection.
vtkCollection::~vtkCollection()
{
  this->RemoveAllItems();
}

// protected function to delete an element. Internal use only.
void vtkCollection::DeleteElement(vtkCollectionElement *e)
{
  if (e->Item != nullptr)
  {
    e->Item->UnRegister(this);
  }
  delete e;
}

//----------------------------------------------------------------------------
void vtkObjectBase::UnRegisterInternal(vtkObjectBase*, vtkTypeBool check)
{
  // If the garbage collector accepts a reference, do not decrement
  // the count.
  if(check && this->ReferenceCount > 1 &&
     vtkObjectBaseToGarbageCollectorFriendship::GiveReference(this))
  {
    return;
  }

  // Decrement the reference count, delete object if count goes to zero.
  if(--this->ReferenceCount <= 0)
  {
    // Clear all weak pointers to the object before deleting it.
    if (this->WeakPointers)
    {
      vtkWeakPointerBase **p = this->WeakPointers;
      while (*p)
      {
        vtkObjectBaseToWeakPointerBaseFriendship::ClearPointer(*p++);
      }
      delete [] this->WeakPointers;
    }
#ifdef VTK_DEBUG_LEAKS
    vtkDebugLeaks::DestructClass(this->GetClassName());
#endif
    delete this;
  }
  else if(check)
  {
    // The garbage collector did not accept the reference, but the
    // object still exists and is participating in garbage collection.
    // This means either that delayed garbage collection is disabled
    // or the collector has decided it is time to do a check.
    vtkGarbageCollector::Collect(this);
  }
}

I add debug code in the project like the following part.

    if( m_ToothPicker )
    {
        m_ToothPicker->GetActors()->InitTraversal();
        auto obj = m_ToothPicker->GetActors()->GetNextItemAsObject();
        LOG( INFO, "items: ", m_ToothPicker->GetActors()->GetNumberOfItems() );
        LOG( INFO, "obj: ", obj );
        LOG( INFO, "GetReferenceCount: ", obj->GetReferenceCount() );
    }

    m_ToothPicker = vSP<vtkCellPicker>::New();

Then I get the output.

[INFO][CBase::OpenModule-273]: items: 3
[INFO][CBase::OpenModule-274]: obj: 000001FD66ABC9B0
[INFO][CBase::OpenModule-275]: GetReferenceCount: 0

When the reference count become 0, vtkCellPicker’s destructor call vtkCollection’s RemoveAllItems. The interface vtkObjectBase::UnRegisterInternal works. The object will be deleted multible times. So it will crash.

Let’s add the fixing code in CloseModule.

@@ -350,10 +369,11 @@ void CBase::CloseModule()
{
//...
m_ToothPicker->GetActors()->RemoveAllItems();
m_ToothPicker->GetProp3Ds()->RemoveAllItems();
m_ToothPicker->InitializePickList();
m_ToothPicker->RemoveAllLocators();

Works! The new output:

[INFO][CBase::OpenModule-273]: items: 0
[INFO][CBase::OpenModule-274]: obj: 0000000000000000