On Mon, Feb 13, 2006 at 06:31:53AM -0800, Ben Pfaff wrote:
John Darrington <[EMAIL PROTECTED]> writes:
> tests/command/match-files.sh is crashing sometimes with a "double free
> or delete" error, but this behaviour is intermittent, and I can't get
> it to do this on demand.
I noticed the same thing. It is surprising and embarrassing. I
will investigate when I get a chance.
I think the bug is in this function:
static bool
mtf_free (struct mtf_proc *mtf)
{
struct mtf_file *iter, *next;
bool ok = true;
for (iter = mtf->head; iter; iter = next)
{
next = iter->next;
if (!mtf_close_file (iter))
ok = false;
}
if (mtf->dict)
dict_destroy (mtf->dict);
case_destroy (&mtf->mtf_case);
free (mtf->seq_nums);
return ok;
}
The problem is, that one of the linked list elements may have a dict
member that is equal to mtf->dict. In which case it gets destroyed
twice -- once in the for loop and once in the explicit call to
dict_destroy that comes after the loop.
For that matter, is there anything preventing two or more members of
the linked list from sharing the same dict member ?
J'
--
PGP Public key ID: 1024D/2DE827B3
fingerprint = 8797 A26D 0854 2EAB 0285 A290 8A67 719C 2DE8 27B3
See http://pgp.mit.edu or any PGP keyserver for public key.
pgppC0c3DlEKt.pgp
Description: PGP signature
_______________________________________________ pspp-dev mailing list [email protected] http://lists.gnu.org/mailman/listinfo/pspp-dev
