Tried to cd() already freed item

Question

This is a relatively minor issue that appeared in MacOS after the fix to #571. When you run

./k_test

and then you exit, it happens in the cleanup process. It does not occur in Fedora or in Windows. It is not known whether it occurs in FreeBSD.

$ ./k_test
t:0
t:50
t:100
t:150
t:200
t:250
t:300
t:350
t:400
t:450
t:500
t:550
t:600
t:650
t:700
t:750
t:800
t:850
t:900
t:950
t:1000
t:1050
t:1100
Test pass rate: 1.0000, Total: 1125, Passed: 1092, Skipped: 33, Failed: 0, Time: 0.493934s
OK
kona      \ for help. \\ to exit.

  \\
src/km.c:68: Tried to cd() already freed item
src/km.c:68: (I)tests=1125
src/km.c:68: (I)(L)x=4481466112
src/km.c:68: (I)rc(x)=0
src/km.c:68: (I)x->t=0
src/km.c:68: (I)x->n=0
()
$

The problem does NOT occur if the test for issue 571 is commented out. The problem does NOT occur if ONLY the test for issue 571 is run.

该提问来源于开源项目：kevinlawler/kona

Answer 1

If we add/change the following 4 lines:

$ git diff
diff --git a/src/k.c b/src/k.c
index ffacbd9..a275e85 100644
--- a/src/k.c
+++ b/src/k.c
@@ -24,6 +24,7 @@
 extern I listener;
 #endif

+extern K sd(K x);     extern K sd_(K x,I f);      I ABC=0;
 K stopDict=0;
 I fStop=0;

@@ -559,7 +560,7 @@ void finally()
 {
   nfinish();
 #ifdef DEBUG
-  tf(SYMBOLS); cd(KTREE); cd(KFIXED);
+  tf(SYMBOLS); cd(KTREE); O("sd(KFIXED):");sd(KFIXED); ABC=1; cd(KFIXED); ABC=0; O("\n");
   //valgrind --leak-check=full --show-reachable=yes /tmp/a.out
 #endif
 }
diff --git a/src/km.c b/src/km.c
index 8496150..c6cb34a 100644
--- a/src/km.c
+++ b/src/km.c
@@ -9,6 +9,7 @@
 #include "k.h"
 #include "km.h"

+extern I ABC;

 //Notes on memory manager: seems like atoms (and small lists?) are not released
 //by K4 (see Skelton's remark: only contiguous arrays greater than 32MB are
@@ -64,6 +65,7 @@ K mrc(K x,I c){I k=sz(xt,xn);I r=lsz(k);x->_c=(c<<8)|r;R x;}
 //This source would be improved by getting ridding of remaing malloc/calloc/realloc
 K cd(K x)
 {
+  if(ABC && x){O("%lld BEG cd   ",ABC); ABC++; show(x); if(0==x->t && 0==x->n)O("**************************************************\n");}
   #ifdef DEBUG
   if(x && rc(x) <=0 ) { er(Tried to cd() already freed item) dd(tests) dd((L)x) dd(rc(x)) dd(x->t) dd(x->n) show(x); }
   #endif
$

we verify that the problem occurs in the "cleanup" of

KFIXED

.

cd(K x)

is called 459 times. The problem begins in the 148th call, and occurs in the 155th call:

148 BEG cd   .,(();;)
149 BEG cd   (();;)
150 BEG cd   151 BEG cd   
152 BEG cd   0x35 ` 0x0  
153 BEG cd   .()
154 BEG cd   .()
155 BEG cd   ()
**************************************************
src/km.c:70: Tried to cd() already freed item
src/km.c:70: (I)tests=1125
src/km.c:70: (I)(L)x=4558761728
src/km.c:70: (I)rc(x)=0
src/km.c:70: (I)x->t=0
src/km.c:70: (I)x->n=0
()
156 BEG cd   .()

If we comment out the test for issue 571 and run it again, then

cd(K x)

is again called 459 times. You can see the difference in call 148 and call 155

148 BEG cd   .,(`"";;)
149 BEG cd   (`"";;)
150 BEG cd   151 BEG cd   
152 BEG cd   0x35 ` 0x0  
153 BEG cd   .()
154 BEG cd   .()
155 BEG cd   `""
156 BEG cd   .()