Fix leak_test crash in print_callers if free() is redirected

(Cherry-pick commit 862f5a8 from 'release-7_4' branch.)

* dbg_mlc.c [REDIRECT_MALLOC && (GC_LINUX_THREADS || GC_SOLARIS_THREADS
|| MSWIN32 || NEED_CALLINFO && GC_HAVE_BUILTIN_BACKTRACE)]
(GC_debug_free): If the object is not in the GC heap then just return
(instead of ABORT).
* malloc.c [REDIRECT_MALLOC && NEED_CALLINFO
&& GC_HAVE_BUILTIN_BACKTRACE] (GC_free): If hhdr is null (i.e. the
object is not in the GC heap) then return without the object
deallocation; add comment.
* os_dep.c [NEED_CALLINFO && GC_HAVE_BUILTIN_BACKTRACE
&& !GC_BACKTRACE_SYMBOLS_BROKEN] (GC_print_callers): Adjust comment
for free().

diff --git a/dbg_mlc.c b/dbg_mlc.c
index b30e5a0baf35d89d9ceac228070e673fcd4039ad..997f53be81a64275198c04a56206ff1ffb326591 100644 (file)
--- a/dbg_mlc.c
+++ b/dbg_mlc.c
@@ -785,6 +785,17 @@ GC_API void GC_CALL GC_debug_free(void * p)
 
     base = GC_base(p);
     if (base == 0) {
+#     if defined(REDIRECT_MALLOC) \
+         && ((defined(NEED_CALLINFO) && defined(GC_HAVE_BUILTIN_BACKTRACE)) \
+             || defined(GC_LINUX_THREADS) || defined(GC_SOLARIS_THREADS) \
+             || defined(MSWIN32))
+        /* In some cases, we should ignore objects that do not belong   */
+        /* to the GC heap.  See the comment in GC_free.                 */
+        bottom_index *bi;
+
+        GET_BI(p, bi);
+        if (HDR_FROM_BI(bi, p) == 0) return;
+#     endif
       GC_err_printf("Attempt to free invalid pointer %p\n", p);
       ABORT("Invalid pointer passed to free()");
     }

diff --git a/malloc.c b/malloc.c
index 1366a19ac7b91ad4b5f8dcd852ebf2aaf43a68ca..5dcc77dd8073b813ddcb4f6dccb12dcd27a9c3fb 100644 (file)
--- a/malloc.c
+++ b/malloc.c
@@ -459,8 +459,11 @@ GC_API void GC_CALL GC_free(void * p)
     h = HBLKPTR(p);
     hhdr = HDR(h);
 #   if defined(REDIRECT_MALLOC) && \
-        (defined(GC_SOLARIS_THREADS) || defined(GC_LINUX_THREADS) \
+        ((defined(NEED_CALLINFO) && defined(GC_HAVE_BUILTIN_BACKTRACE)) \
+         || defined(GC_SOLARIS_THREADS) || defined(GC_LINUX_THREADS) \
          || defined(MSWIN32))
+        /* This might be called indirectly by GC_print_callers to free  */
+        /* the result of backtrace_symbols.                             */
         /* For Solaris, we have to redirect malloc calls during         */
         /* initialization.  For the others, this seems to happen        */
         /* implicitly.                                                  */

diff --git a/os_dep.c b/os_dep.c
index ed0563217cf6d90bb0d3d8787aaba8a65af5c00f..f8ce2c9c1c78876b03709af6c46bbdf881c9762e 100644 (file)
--- a/os_dep.c
+++ b/os_dep.c
@@ -4740,7 +4740,7 @@ GC_INNER void GC_print_callers(struct callinfo info[NFRAMES])
           GC_err_printf("\t\t%s\n", name);
 #         if defined(GC_HAVE_BUILTIN_BACKTRACE) \
              && !defined(GC_BACKTRACE_SYMBOLS_BROKEN)
-            free(sym_name);  /* May call GC_free; that's OK */
+            free(sym_name);  /* May call GC_[debug_]free; that's OK */
 #         endif
         }
     }