Reading individual TTree sub-branch into a std::map lead to write into delete memory.

[pcanal]

3533:roottest-root-treeformula-stl-writemap
3534:roottest-root-treeformula-stl-mapvector

are routinely failing on MacOS.

As reported by Jonas, an AddressSanitizer build on Linux shows problems for this test:

3523: Processing /home/jhahnfel/ROOT/src/roottest/root/treeformula/stl/mapvector.C+...
3523: =================================================================
3523: ==2724404==ERROR: AddressSanitizer: heap-use-after-free on address 0x5020000d30d0 at pc 0x7fc2ec2a6e15 bp 0x7ffdd9b6f120 sp 0x7ffdd9b6f118
3523: WRITE of size 4 at 0x5020000d30d0 thread T0
3523:     #0 0x7fc2ec2a6e14 in frombuf(char*&, unsigned int*) /home/jhahnfel/ROOT/src/core/base/inc/Bytes.h:310:7
3523:     #1 0x7fc2ec2a6e14 in frombuf(char*&, int*) /home/jhahnfel/ROOT/src/core/base/inc/Bytes.h:442:48
3523:     #2 0x7fc2ec2a6e14 in TBufferFile::ReadFastArray(int*, int) /home/jhahnfel/ROOT/src/io/io/src/TBufferFile.cxx:1360:7
3523:     #3 0x7fc2ec42045f in void TGenCollectionStreamer::ReadBufferVectorPrimitives<int>(TBuffer&, void*, TClass const*) /home/jhahnfel/ROOT/src/io/io/src/TGenCollectionStreamer.cxx:1183:9
3523:     #4 0x7fc2ec2a9800 in TClass::Streamer(void*, TBuffer&, TClass const*) const /home/jhahnfel/ROOT/src/core/meta/inc/TClass.h:630:7
3523:     #5 0x7fc2ec2a9800 in TBufferFile::ReadFastArray(void*, TClass const*, int, TMemberStreamer*, TClass const*) /home/jhahnfel/ROOT/src/io/io/src/TBufferFile.cxx:1649:51
3523:     #6 0x7fc2eca257fa in int TStreamerInfo::ReadBuffer<char**>(TBuffer&, char** const&, TStreamerInfo::TCompInfo* const*, int, int, int, int, int) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInf$
ReadBuffer.cxx:1353:24
3523:     #7 0x7fc2ec7345f9 in TStreamerInfoActions::VectorLooper::GenericRead(TBuffer&, void*, void const*, TStreamerInfoActions::TLoopConfiguration const*, TStreamerInfoActions::TConfiguration const
*) /home/jhahnfel/ROOT/src/io/io/src/TStreamerInfoActions.cxx:2209:43
3523:     #8 0x7fc2ec2b89bb in TStreamerInfoActions::TConfiguredAction::operator()(TBuffer&, void*, void const*, TStreamerInfoActions::TLoopConfiguration const*) const /home/jhahnfel/ROOT/src/io/io/in
c/TStreamerInfoActions.h:131:17
3523:     #9 0x7fc2ec2b89bb in TBufferFile::ApplySequence(TStreamerInfoActions::TActionSequence const&, void*, void*) /home/jhahnfel/ROOT/src/io/io/src/TBufferFile.cxx:3813:10
3523:     #10 0x7fc2c4288040 in TBranchElement::ReadLeavesCollectionMember(TBuffer&) /home/jhahnfel/ROOT/src/tree/tree/src/TBranchElement.cxx:4482:6
3523:     #11 0x7fc2c424b9a7 in TBranch::GetEntry(long long, int) /home/jhahnfel/ROOT/src/tree/tree/src/TBranch.cxx:1753:4
3523:     #12 0x7fc2c4278ac2 in TBranchElement::GetEntry(long long, int) /home/jhahnfel/ROOT/src/tree/tree/src/TBranchElement.cxx:2785:27
3523:     #13 0x7fc2d6403cb4 in R__LoadBranch(TBranch*, long long, bool) /home/jhahnfel/ROOT/src/tree/treeplayer/src/TTreeFormula.cxx:106:22
3523:     #14 0x7fc2d6403cb4 in TTreeFormula::LoadCurrentDim() /home/jhahnfel/ROOT/src/tree/treeplayer/src/TTreeFormula.cxx:5646:27
3523:     #15 0x7fc2d64262c4 in TTreeFormulaManager::GetNdata(bool) /home/jhahnfel/ROOT/src/tree/treeplayer/src/TTreeFormulaManager.cxx:157:21
3523:     #16 0x7fc2d6451c36 in TTreePlayer::Scan(char const*, char const*, char const*, long long, long long) /home/jhahnfel/ROOT/src/tree/treeplayer/src/TTreePlayer.cxx:2733:37
3523:     #17 0x7fc2c4887290 in readfile(char const*) /home/jhahnfel/ROOT/src/roottest/root/treeformula/stl/mapvector.C:40:10

[pcanal]

The issue is that TTreeFormula use a pattern which reads the top level branch (contains the size of the collection) first and then reads the sub-branches. However when the collection is a map we need to first stage the data, read all the branches and then load the data in the map. This parts happened correctly during the loading the top level branch (as intended). The part that was failing is the subsequent read of the sub-branch was inadvertently still loading the data into the already deleted scratch area.