Teardown issue: TPad keeps a pointer to a (possibly) deleted TCanvas

The following C++ code leads to a segfault:

TCanvas *c = new TCanvas("nut", "FirstSession", 100, 10, 700, 900 );

TPad p("pad", "pad", .2, .05, .8, .35 );

delete c;

When creating TCanvas c, c becomes gPad. Later, when constructing TPad p, the data member fMother of p is assigned to gPad, and therefore to c. If c is deleted before p, there is a segfault when trying to access fMother in TPad::Close().

This affects PyROOT, because one cannot count on a particular order in which objects will be destroyed. So this code segfaults as well:

import ROOT

nut = ROOT.TCanvas( 'nut', 'FirstSession', 100, 10, 700, 900 )

pad = ROOT.TPad( 'pad', 'pad', .2, .05, .8, .35 ) 

This affects both the current PyROOT and the experimental PyROOT.

tutorial-pyroot-first-py is working by pure chance, since the situation above takes place but the TPad happens to be removed before the TCanvas.