6.40: TBox added to TH1::GetListOfFunctions() appears to be freed before Write

[maszyman]

Check duplicate issues.

• Checked for duplicates

Description

In one of the ATLAS tests (involving histgrinder), in dev4 we observed the crash likely related to #13593 and #21451. I believe I managed to extract the standalone, minimal reproducer.

ROOT.SetHeuristicMemoryPolicy(True) at startup avoids the crash, but I was wondering about the proper fix, either in ROOT or histgrinder.

Reproducer

import ROOT
ROOT.TH1.AddDirectory(False)

def deco(h):
    box = ROOT.TBox(0.1, 0.1, 0.9, 0.9)
    h.GetListOfFunctions().Add(box)

h = ROOT.TH1F("h", "h", 10, 0, 1)
h.Fill(0.5)
deco(h)
ROOT.TFile.Open("/tmp/t.root", "RECREATE").WriteTObject(h, "h")

It's clean on 6.38.04 while on 6.40.00 there appears to be SIGSEGV.

ROOT version

6.40

Installation method

dev4

Operating system

Linux

Additional context

No response