Re: dangling pointer in so_list

[Aleksandar Ristovski <aristovski@qnx.com>]

[-- Attachment #1: Type: text/plain, Size: 710 bytes --]

It turns out that there is another function with almost identical loop. 
This time, in 'update_solib_list' gdb would do the same: in one 
iteration it frees an objfile, in another tries to free it again.

The attached patch supersedes the first one and extracts the logic for 
determining duplicates into a function, then uses the function.

Still no regressions.


Comments appreciated.



Thanks,

Aleksandar Ristovski
QNX Software Systems




ChangeLog has changed slightly:

<date>  Aleksandar Ristovski  <aristovski@qnx.com>

         * solib.c (used): New function.
         (update_solib_list, reload_shared_libraries_1): Check if 
objfile is used
         by another so_list object before freeing it.


[-- Attachment #2: dangling_objfile_in_so_list-201109011545.patch --]
[-- Type: text/x-patch, Size: 1760 bytes --]

Index: gdb/solib.c
===================================================================
RCS file: /cvs/src/src/gdb/solib.c,v
retrieving revision 1.153
diff -u -p -r1.153 solib.c
--- gdb/solib.c	30 Aug 2011 02:48:05 -0000	1.153
+++ gdb/solib.c	1 Sep 2011 19:56:37 -0000
@@ -633,6 +633,23 @@ solib_read_symbols (struct so_list *so, 
   return 0;
 }
 
+/* Return 1 if KNOWN->objfile is used by any other so_list object in the
+   HEAD list.  Return 0 otherwise.  */
+
+static int
+used (const struct so_list *const known, const struct so_list *const head)
+{
+  const struct so_list *pivot;
+  int found = 0;
+
+  for (pivot = head; pivot != NULL && !found; pivot = pivot->next)
+    {
+      if (pivot != known && pivot->objfile == known->objfile)
+	found = 1;
+    }
+  return found;
+}
+
 /* Synchronize GDB's shared object list with inferior's.
 
    Extract the list of currently loaded shared objects from the
@@ -749,7 +766,8 @@ update_solib_list (int from_tty, struct 
 	  *gdb_link = gdb->next;
 
 	  /* Unless the user loaded it explicitly, free SO's objfile.  */
-	  if (gdb->objfile && ! (gdb->objfile->flags & OBJF_USERLOADED))
+	  if (gdb->objfile && ! (gdb->objfile->flags & OBJF_USERLOADED)
+	      && !used (gdb, so_list_head))
 	    free_objfile (gdb->objfile);
 
 	  /* Some targets' section tables might be referring to
@@ -1225,7 +1243,8 @@ reload_shared_libraries_1 (int from_tty)
 	  || (found_pathname != NULL
 	      && filename_cmp (found_pathname, so->so_name) != 0))
 	{
-	  if (so->objfile && ! (so->objfile->flags & OBJF_USERLOADED))
+	  if (so->objfile && ! (so->objfile->flags & OBJF_USERLOADED)
+	      && !used (so, so_list_head))
 	    free_objfile (so->objfile);
 	  remove_target_sections (so->abfd);
 	  free_so_symbols (so);