Hi

Valgrind memory checker finds a memory leak in Vim-7.2.15.
The steps to reproduce are a bit too messy to describe here
and I have not been able to find a simple way to reproduce it.
However I can reproduce it 100% of the time:

==1182== 150 bytes in 2 blocks are definitely lost in loss record 24 of 34
==1182==    at 0x4C21FEB: malloc (vg_replace_malloc.c:207)
==1182==    by 0x4D6927: lalloc (misc2.c:859)
==1182==    by 0x4D689A: alloc_check (misc2.c:792)
==1182==    by 0x457EC4: do_sub (ex_cmds.c:4822)
==1182==    by 0x465561: do_one_cmd (ex_docmd.c:2621)
==1182==    by 0x462D41: do_cmdline (ex_docmd.c:1095)
==1182==    by 0x45FE46: ex_listdo (ex_cmds2.c:2374)
==1182==    by 0x465561: do_one_cmd (ex_docmd.c:2621)
==1182==    by 0x462D41: do_cmdline (ex_docmd.c:1095)
==1182==    by 0x4EE779: nv_colon (normal.c:5214)
==1182==    by 0x4E775D: normal_cmd (normal.c:1181)
==1182==    by 0x4A79EF: main_loop (main.c:1179)
==1182==    by 0x4A7535: main (main.c:938)


I see at least 2 'break' statements that would cause such
a leak at lines 4994 and line 5007 in ex_cmds.c:

 4979                     if (new_start != NULL)
 4980                     {
 4981                         /*
 4982                          * Copy the rest of the line, that didn't match.
 4983                          * "matchcol" has to be adjusted, we use
the end of
 4984                          * the line as reference, because the
substitute m>
 4985                          * have changed the number of
characters.  Same for
 4986                          * "prev_matchcol".
 4987                          */
 4988                         STRCAT(new_start, sub_firstline + copycol);
 4989                         matchcol =
(colnr_T)STRLEN(sub_firstline) - matchc>
 4990                         prev_matchcol = (colnr_T)STRLEN(sub_firstline)
 4991                                                               -
prev_match>
 4992
 4993                         if (u_savesub(lnum) != OK)
!4994                             break;
 4995                         ml_replace(lnum, new_start, TRUE);
 4996
 4997                         if (nmatch_tl > 0)
 4998                         {
 4999                             /*
 5000                              * Matched lines have now been
substituted and>
 5001                              * useless, delete them.  The part
after the m>
 5002                              * has been appended to new_start,
we don't ne>
 5003                              * it in the buffer.
 5004                              */
 5005                             ++lnum;
 5006                             if (u_savedel(lnum, nmatch_tl) != OK)
!5007                                 break;

Attached patch fixes it.

-- Dominique

--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_dev" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---

Index: ex_cmds.c
===================================================================
RCS file: /cvsroot/vim/vim7/src/ex_cmds.c,v
retrieving revision 1.113
diff -c -r1.113 ex_cmds.c
*** ex_cmds.c	6 Aug 2008 13:03:07 -0000	1.113
--- ex_cmds.c	11 Sep 2008 18:22:00 -0000
***************
*** 5059,5064 ****
--- 5059,5065 ----
  
  	    if (did_sub)
  		++sub_nlines;
+ 	    vim_free(new_start);
  	    vim_free(sub_firstline);	/* free the copy of the original line */
  	    sub_firstline = NULL;
  	}

Raspunde prin e-mail lui