Problem with TH2Poly (Invalid read)

Dear experts,

I have a problem with TH2Poly with this simple macro:

#include <memory>

#include <TFile.h>
#include <TH2Poly.h>
#include <TH1F.h>

#define XSTR(s) STR(s)
#define STR(x) #x

int main()
{
  std::unique_ptr<TFile> f(TFile::Open("a.root"));
  CLASS* h = (CLASS*)f->Get(XSTR(CLASS));
}

compiling with

g++ -std=c++11 -D CLASS=TH2Poly test_hpoly.cxx -O0 -g `root-config --cflags` `root-config --libs`

or with

g++ -std=c++11 -D CLASS=TH1F test_hpoly.cxx -O0 -g `root-config --cflags` `root-config --libs`

when running with valgrind:

valgrind --tool=memcheck --suppressions=`root-config --etcdir`/valgrind-root.supp ./a.out

in the TH1F case I don’t get any message, while in the TH2Poly case I get:

==11053== Invalid read of size 4
==11053==    at 0x503C29C: TList::Clear(char const*) (in /home/turra/Scaricati/root/lib/libCore.so)
==11053==    by 0x503C8DA: TList::~TList() (in /home/turra/Scaricati/root/lib/libCore.so)
==11053==    by 0x6E4215C: TH2Poly::~TH2Poly() (in /home/turra/Scaricati/root/lib/libHist.so)
==11053==    by 0x6E421F8: TH2Poly::~TH2Poly() (in /home/turra/Scaricati/root/lib/libHist.so)
==11053==    by 0x503CB24: TList::Delete(char const*) (in /home/turra/Scaricati/root/lib/libCore.so)
==11053==    by 0x64BFD91: TDirectoryFile::Close(char const*) (in /home/turra/Scaricati/root/lib/libRIO.so)
==11053==    by 0x64D0070: TFile::Close(char const*) (in /home/turra/Scaricati/root/lib/libRIO.so)
==11053==    by 0x64D0406: TFile::~TFile() (in /home/turra/Scaricati/root/lib/libRIO.so)
==11053==    by 0x64D06E8: TFile::~TFile() (in /home/turra/Scaricati/root/lib/libRIO.so)
==11053==    by 0x40232B: std::default_delete<TFile>::operator()(TFile*) const (unique_ptr.h:67)
==11053==    by 0x40225A: std::unique_ptr<TFile, std::default_delete<TFile> >::~unique_ptr() (unique_ptr.h:184)
==11053==    by 0x401FDC: main (test_hpoly.cxx:20)
==11053==  Address 0xdc7405c is 12 bytes inside a block of size 80 free'd
==11053==    at 0x4C28991: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11053==    by 0x4FFADE7: TStorage::ObjectDealloc(void*) (in /home/turra/Scaricati/root/lib/libCore.so)
==11053==    by 0x503CB24: TList::Delete(char const*) (in /home/turra/Scaricati/root/lib/libCore.so)
==11053==    by 0x503C8DA: TList::~TList() (in /home/turra/Scaricati/root/lib/libCore.so)
==11053==    by 0x503CC68: TList::~TList() (in /home/turra/Scaricati/root/lib/libCore.so)
==11053==    by 0x6E42128: TH2Poly::~TH2Poly() (in /home/turra/Scaricati/root/lib/libHist.so)
==11053==    by 0x6E421F8: TH2Poly::~TH2Poly() (in /home/turra/Scaricati/root/lib/libHist.so)
==11053==    by 0x503CB24: TList::Delete(char const*) (in /home/turra/Scaricati/root/lib/libCore.so)
==11053==    by 0x64BFD91: TDirectoryFile::Close(char const*) (in /home/turra/Scaricati/root/lib/libRIO.so)
==11053==    by 0x64D0070: TFile::Close(char const*) (in /home/turra/Scaricati/root/lib/libRIO.so)
==11053==    by 0x64D0406: TFile::~TFile() (in /home/turra/Scaricati/root/lib/libRIO.so)
==11053==    by 0x64D06E8: TFile::~TFile() (in /home/turra/Scaricati/root/lib/libRIO.so)
==11053== 

you can find attached the a.root file. I have tried with ROOT 5.34/18 and 5.34/20. Is it ok? Why the difference?
a.root (9.57 KB)

This problem, in the TH2Poly destructor has been fixed by this commit in the current HEAD of 5.34 patches:

root.cern.ch/gitweb?p=root.git; … 965ce94027

It will be in 5.34.25 which is not yet released.
Tank you for submitting this problem

Lorenzo