This is the mail archive of the mailing list for the Archer project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Crash free()ing unallocated memory.


I just debugged a crash, where gdb-py tries to free builtin type :-(

AFAICT, the problem is here:

355     static void
356     typy_dealloc (PyObject *obj)
357     {
358       type_object *type = (type_object *) obj;
360       if (type->type)
361         {
362           if (!TYPE_OBJFILE (type->type))
363             {
364               /* We own the type, so delete it.  */

Builtin types ('long long' in this case) have TYPE_OBJFILE() == NULL,
but python-type.c doesn't own them.

365               htab_t deleted_types;
367               deleted_types = create_deleted_types_hash ();
368               delete_type_recursive (type->type, deleted_types);
369               htab_delete (deleted_types);
370             }

Possible fixes:

- add a "flag_builtin" flag to struct main_type to mark builtin types,
  avoid them above

- scan and avoid all members of struct builtin_type (error prone:
  what if a new member is added).

- ???

Paul Pluzhnikov

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]