From 0f49d62fb09878349ff1bc4440f2cdfcf71a9e42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Staffan=20Gim=C3=A5ker?= <staffan@spotify.com>
Date: Thu, 16 Feb 2012 10:02:35 +0900
Subject: The cause behind the segfault was next.node being deleted but count
 still being non-zero.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Staffan Gimåker <staffan@spotify.com>
---
 src/mtrie.cpp | 23 +++++++++++++++--------
 src/trie.cpp  | 11 ++++++++---
 2 files changed, 23 insertions(+), 11 deletions(-)

(limited to 'src')

diff --git a/src/mtrie.cpp b/src/mtrie.cpp
index ad4978c..27adb08 100644
--- a/src/mtrie.cpp
+++ b/src/mtrie.cpp
@@ -42,8 +42,11 @@ xs::mtrie_t::mtrie_t () :
 
 xs::mtrie_t::~mtrie_t ()
 {
-    if (count == 1)
+    if (count == 1) {
+        xs_assert (next.node);
         delete next.node;
+        next.node = 0;
+    }
     else if (count > 1) {
         for (unsigned short i = 0; i != count; ++i)
             if (next.table [i])
@@ -174,6 +177,7 @@ void xs::mtrie_t::rm_helper (pipe_t *pipe_, unsigned char **buff_,
         if (next.node->is_redundant ()) {
             delete next.node;
             next.node = 0;
+            count = 0;
             --live_nodes;
         }
         return;
@@ -182,13 +186,14 @@ void xs::mtrie_t::rm_helper (pipe_t *pipe_, unsigned char **buff_,
     //  If there are multiple subnodes.
     for (unsigned short c = 0; c != count; c++) {
         (*buff_) [buffsize_] = min + c;
-        if (next.table [c])
+        if (next.table [c]) {
             next.table [c]->rm_helper (pipe_, buff_, buffsize_ + 1,
                 maxbuffsize_, func_, arg_);
-        if (next.table [c]->is_redundant ()) {
-            delete next.table [c];
-            next.table [c] = 0;
-            --live_nodes;
+            if (next.table [c]->is_redundant ()) {
+                delete next.table [c];
+                next.table [c] = 0;
+                --live_nodes;
+            }
         }
     }
 }
@@ -221,8 +226,10 @@ bool xs::mtrie_t::rm_helper (unsigned char *prefix_, size_t size_,
 
     if (next_node->is_redundant ()) {
         delete next_node;
-        if (count == 1)
+        if (count == 1) {
             next.node = 0;
+            count = 0;
+        }
         else
             next.table [c - min] = 0;
         --live_nodes;
@@ -272,7 +279,7 @@ void xs::mtrie_t::match (unsigned char *data_, size_t size_,
     }
 }
 
-bool xs::mtrie_t::is_redundant() const
+bool xs::mtrie_t::is_redundant () const
 {
     return pipes.empty () && live_nodes == 0;
 }
diff --git a/src/trie.cpp b/src/trie.cpp
index 2a21a5f..baa5c8d 100644
--- a/src/trie.cpp
+++ b/src/trie.cpp
@@ -43,8 +43,11 @@ xs::trie_t::trie_t () :
 
 xs::trie_t::~trie_t ()
 {
-    if (count == 1)
+    if (count == 1) {
+        xs_assert (next.node);
         delete next.node;
+        next.node = 0;
+    }
     else if (count > 1) {
         for (unsigned short i = 0; i != count; ++i)
             if (next.table [i])
@@ -154,8 +157,10 @@ bool xs::trie_t::rm (unsigned char *prefix_, size_t size_)
 
      if (next_node->is_redundant ()) {
          delete next_node;
-         if (count == 1)
+         if (count == 1) {
              next.node = 0;
+             count = 0;
+         }
          else
              next.table [c - min] = 0;
          --live_nodes;
@@ -242,7 +247,7 @@ void xs::trie_t::apply_helper (
     }
 }
 
-bool xs::trie_t::is_redundant() const
+bool xs::trie_t::is_redundant () const
 {
     return refcnt == 0 && live_nodes == 0;
 }
-- 
cgit v1.2.3