Strange crash with SQLite when finalizing a statement

Question

I'm writing a C++ test app with SQLite, for which I made a small wrapper.

I'm repeatedly reading some data with it, and the fourth time I do, when finalizing the statement, it crashes. I'm sure I'm matching each prepared statement with a finalize. The 4th time, before the crash, the data has ben read successfully.

One curious thing: I'm now displaying the statement pointer returned (via printf("%p")), and on the first reads it is invariably 0048D228. The crashing one is 66676767.

I rerun the program and the addresses are the same again.

Here's the essential part of my classes:

class SQLiteResultSet
{
private:
    sqlite3_stmt *stmt;
public:
    inline SQLiteResultSet(sqlite3_stmt *pStmt) : stmt(pStmt) {}
    inline bool next() { return sqlite3_step(stmt) == SQLITE_ROW; }
    inline const unsigned char *textColumn(int colNum) { 
        return sqlite3_column_text(stmt, colNum); 
    }
    inline const int intColumn(int colNum) {
        return sqlite3_column_int(stmt, colNum); 
    }
    inline void close() { 
        if(isOpen()) { 
            printf("----closing %p\n",stmt);
            sqlite3_finalize(stmt); 
            printf("----closed\n");
            stmt = NULL; 
        } 
    }
    inline bool isOpen() { return stmt != NULL; }
    inline ~SQLiteResultSet() { close(); }
};

class SQLiteGateway
{
private:
    sqlite3 *db;
    SQLiteResultSet *rs;

    void resetResultSet();

public:
    SQLiteGateway(char *dbName);
    SQLiteResultSet *select(char *query);
    bool tableExists(char *tableName);
    void execute(char *query);
public:
    ~SQLiteGateway(void);
};

SQLiteGateway::SQLiteGateway(char *dbName)
{
    db = NULL;
    rs = NULL;
    int error = sqlite3_open(dbName, &db);
    if (error)
    {
        throw sqlite3_errmsg(db);
    }
}

void SQLiteGateway::resetResultSet()
{
    if(rs != NULL)
    {
        delete rs;
        rs = NULL;
    }
}

SQLiteResultSet *SQLiteGateway::select(char *query)
{
    sqlite3_stmt    *res;
    const char      *tail;

    resetResultSet();

    int error = sqlite3_prepare_v2(db,query,-1,&res,&tail);
    if (error != SQLITE_OK || res == NULL)
    {
        throw sqlite3_errmsg(db);
    }

    rs = new SQLiteResultSet(res);
    return rs;
}

SQLiteGateway::~SQLiteGateway(void)
{
    resetResultSet();

    if(db != NULL)
    {
        sqlite3_close (db); 
    }
}

Edit: test program!

The query should return at least 1 row (I discard the rest), and an integer as the first column. In my machine the 3rd iteration crashes.

Note: remove tableExists() and execute() from the declaration of SQLiteGateway, I didn't copy their bodies here and they're not used in this test.

int main()
{
    SQLiteGateway *sqlg = NULL;
    try
    {
        sqlg = new SQLiteGateway("./apptest.db");

        for(int i=0; i<5; i++)
        {
            SQLiteResultSet *rs = sqlg->select("select x from mytable");
            if(rs->next()) printf("%d\n", rs->intColumn(0));
            delete rs;
        }
    }
    catch(char *str)
    {
        printf("Abnormal termination: %s\n", str);
    }
    if(sqlg != NULL) 
    {
        delete sqlg;
    }
}

Here's the output I'm getting with the test (0 is the value read, and it is not displayed on the 3rd iteration - the closing/closed lines are before/after finalize).

0
----closing 0048D1E0
----closed
0
----closing 0048D1E0
----closed
----closing 0048DFF8

I'm still clueless but I have found that, in this test, if I replace the use of SQLiteGateway by what it does inline, there's no crash!! And the address is always the same.

Answer 1

I found the bug: it's how I manage the liftime of the SQLiteResultSet object!

SQLiteGateway is holding a ref of the last resultset produced, and if it's not null, deletes it before the next query. However I might have deleted it already somewhere else, which is actually what I'm doing! The resultset object no longer exists but the SQLiteGateway object isn't aware, it still has a non-null pointer.

I got to redesign the solution.

I haven't worked with pointers for years and it shows! Thanks for your interest!

Edit: easily solved. I simply gave up holding that reference. Whoever calls SQLiteGateway::select() owns the resulting SQLiteResultSet object and is responsible of deleting it.