 clanker
|
b2b135a6fd
fix(containers): complete element ownership in Series/Fifo/Lifo/PriorityQueue — insertion already dups via t_dup_func and clear() destroys, but pop_start, remove_first_where/remove_all_where, Fifo/Lifo/PriorityQueue pop and iteration, and the queue destructors never released the stored value (one leaked ref per removal, whole contents leaked at finalize); remove_items additionally advanced through the deleted node (node->next after delete — use-after-free on every remove_all_where past a match, previously surviving by allocator luck; a regression test made it a deterministic segfault). All removal paths now null the item's value before delete so valac emits the t_destroy_func release, and remove_items walks a saved next pointer. No signature, vapi, or ABI change: add(T) keeps copy-on-insert semantics, pop/remove transfer their dup out as before, so the only observable difference is the container's own reference is dropped. Regression tests pin the contract: statement temporaries survive add+clear cycles, pop/remove/clear/destructor restore refcounts, and 603-test suite passes with zero valgrind errors on a probe that adds statement-temporary strings and objects and reads them after (the daemon-side saddle pin.c workaround is unnecessary against this build)
|
1 bulan lalu |
Billy Barrow