Crash closing the Sound Preview for sounds longer than 30 s (split upload): double free in LLUIString #1106

New issue

Closed

opened 2026-10-26 06:45:54 +00:00 by sky_line · 1 comment

sky_line commented

2026-10-26 06:45:54 +00:00

Owner

Root cause (stack recovered from the core dump): LLAppViewer::idle -> LLMortician::updateClass -> ~LLFloaterSoundPreview -> LLView::deleteAllChildren -> ~LLButton -> ~LLUIString -> double free. LLUIString owns its argument map through a raw pointer but used the default shallow copy. The preview's OK button gets a label argument (setLabelArg("[AMOUNT]")); for a clip over 30 s, updateAudioInfo relabels it with setLabel(), which copies one label string into the other, so both share one argument map and the button deletes it twice when the floater is destroyed. No upload reaches the server before the crash (the abort lands before part 1's POST).

Fix: LLUIString deep-copies its argument map (copy constructor + assignment), which removes the whole bug class for every widget.

Also in this change (owner request): the length of the last clip is shown in the preview text, the confirmation, the done notification, and the copied LSL list (float clip_seconds, float last_clip_seconds), so it can be used in playback scripts.

Closing the Sound Preview for a sound longer than 30 s crashes the viewer (heap double free), whether you upload (split upload, #807) or cancel. Affects 1.4.2, 1.4.3, 1.5.0 Beta 2 and Beta 3. Sounds under 30 s are not affected. **Root cause** (stack recovered from the core dump): `LLAppViewer::idle -> LLMortician::updateClass -> ~LLFloaterSoundPreview -> LLView::deleteAllChildren -> ~LLButton -> ~LLUIString -> double free`. `LLUIString` owns its argument map through a raw pointer but used the default shallow copy. The preview's OK button gets a label argument (`setLabelArg("[AMOUNT]")`); for a clip over 30 s, `updateAudioInfo` relabels it with `setLabel()`, which copies one label string into the other, so both share one argument map and the button deletes it twice when the floater is destroyed. No upload reaches the server before the crash (the abort lands before part 1's POST). **Fix:** `LLUIString` deep-copies its argument map (copy constructor + assignment), which removes the whole bug class for every widget. Also in this change (owner request): the length of the last clip is shown in the preview text, the confirmation, the done notification, and the copied LSL list (`float clip_seconds`, `float last_clip_seconds`), so it can be used in playback scripts.

sky_line added the

labels

2026-10-26 06:45:54 +00:00

sky_line self-assigned this

2026-10-26 06:45:54 +00:00

sky_line added this to the Slipstream project

2026-10-26 06:45:54 +00:00