Re: Crash free()ing unallocated memory.

[Tom Tromey <tromey at redhat dot com>]

Tom> I think we should add a new flag to pyty_type_object, and set the flag
Tom> in clean_up_objfile_types.

Paul> I've just confirmed that clean_up_objfile_types() is never called
Paul> on the path to crash ...

Yeah, that is ok.

The idea is that the Type would have a separate flag to know whether
or not it owned the struct type.  For builtin types, this would be
zero even though the struct type has a NULL objfile.  This would
prevent type_dealloc from freeing the type.

Could you try the appended?  This implements the above idea and also
fixes another oddity -- I think the prev and next fields were not
always initialized.

If this works for you, I will check it in.

Paul> In addition, I rebuilt gdb-py with python2.6, and now it doesn't
Paul> hit the original problem (and Valgrind is happy), but instead hits
Paul> a new one :-(

Paul>   File "<string>", line 90, in printstdmap
Paul>   File "/home/ppluzhnikov/python2.6/lib/python2.6/encodings/__init__.py",
Paul> line 100, in search_function
Paul>     level=0)
Paul>   TypeError: SetupPathsAndImport() got an unexpected keyword argument 'level'

I have no clue about this one.
Python bug?

Tom

2008-11-06  Tom Tromey  <tromey@redhat.com>

	* python/python-type.c (pyty_type_object) <owned>: New field.
	(clean_up_objfile_types): Set it.
	(set_type): Initialize new field.  Always set prev and next
	fields.
	(typy_dealloc): Check new field.

diff --git a/gdb/python/python-type.c b/gdb/python/python-type.c
index 62b7de6..f69331d 100644
--- a/gdb/python/python-type.c
+++ b/gdb/python/python-type.c
@@ -37,6 +37,10 @@ typedef struct pyty_type_object
      underlying struct type when the objfile is deleted.  */
   struct pyty_type_object *prev;
   struct pyty_type_object *next;
+
+  /* This is nonzero if the type is owned by this object and should be
+     freed when the object is deleted.  */
+  int owned;
 } type_object;
 
 static PyTypeObject type_object_type;
@@ -276,6 +280,7 @@ clean_up_objfile_types (struct objfile *objfile, void *datum)
 
       obj->next = NULL;
       obj->prev = NULL;
+      obj->owned = 1;
 
       obj = next;
     }
@@ -287,24 +292,19 @@ static void
 set_type (type_object *obj, struct type *type)
 {
   obj->type = type;
-  if (type)
+  obj->owned = 0;
+  obj->prev = NULL;
+  if (type && TYPE_OBJFILE (type))
     {
       struct objfile *objfile = TYPE_OBJFILE (type);
 
-      if (objfile)
-	{
-	  obj->next = objfile_data (objfile, typy_objfile_data_key);
-	  if (obj->next)
-	    obj->next->prev = obj;
-	  obj->prev = NULL;
-	  set_objfile_data (objfile, typy_objfile_data_key, obj);
-	}
-      else
-	{
-	  obj->prev = NULL;
-	  obj->next = NULL;
-	}
+      obj->next = objfile_data (objfile, typy_objfile_data_key);
+      if (obj->next)
+	obj->next->prev = obj;
+      set_objfile_data (objfile, typy_objfile_data_key, obj);
     }
+  else
+    obj->next = NULL;
 }
 
 static PyObject *
@@ -359,7 +359,7 @@ typy_dealloc (PyObject *obj)
 
   if (type->type)
     {
-      if (!TYPE_OBJFILE (type->type))
+      if (type->owned)
 	{
 	  /* We own the type, so delete it.  */
 	  htab_t deleted_types;