pike.git / src / mapping.c

version» Context lines:

pike.git/src/mapping.c:923:      PMOD_EXPORT void low_mapping_insert(struct mapping *m,    const struct svalue *key,    const struct svalue *val,    int overwrite)   {    size_t h,h2;    struct keypair *k, **prev;    struct mapping_data *md, *omd;    int grow_md; +  int refs;      #ifdef PIKE_DEBUG    if(m->data->refs <=0)    Pike_fatal("Zero refs in mapping->data\n");   #endif       h2=hash_svalue(key);      #ifdef PIKE_DEBUG    if(d_flag>1) check_mapping(m);
pike.git/src/mapping.c:984:    if(d_flag>1) check_mapping(m);   #endif    return;       mi_insert:   #ifdef PIKE_DEBUG    if(m->data != md)    Pike_fatal("Wrong dataset in mapping_insert!\n");    if(d_flag>1) check_mapping(m);   #endif -  free_mapping_data(md); +  /* NB: We know that md has a reference from the mapping +  * in addition to our reference. +  * +  * The use of sub_ref() silences warnings from Coverity, as well as +  * on the off chance of a reference counting error avoids accessing +  * freed memory. +  */ +  refs = sub_ref(md); /* free_mapping_data(md); */ +  assert(refs);       grow_md = MD_FULLP(md);       /* We do a re-hash here instead of copying the mapping. */    if(grow_md || md->refs>1)    {    debug_malloc_touch(m);    rehash(m, md->hashsize ? md->hashsize << grow_md : AVG_LINK_LENGTH);    md=m->data;    }
pike.git/src/mapping.c:1041:   #define mapping_insert(M, KEY, VAL) low_mapping_insert ((M), (KEY), (VAL), 1)      PMOD_EXPORT union anything *mapping_get_item_ptr(struct mapping *m,    const struct svalue *key,    TYPE_T t)   {    size_t h, h2;    struct keypair *k, **prev;    struct mapping_data *md,*omd;    int grow_md; +  int refs;      #ifdef PIKE_DEBUG    if(m->data->refs <=0)    Pike_fatal("Zero refs in mapping->data\n");       if(d_flag>1) check_mapping(m);       debug_malloc_touch(m);    debug_malloc_touch(m->data);   #endif
pike.git/src/mapping.c:1103:       return 0;       mg_insert:   #ifdef PIKE_DEBUG    if(m->data != md)    Pike_fatal("Wrong dataset in mapping_get_item_ptr!\n");    if(d_flag)    check_mapping(m);   #endif -  free_mapping_data(md); +  /* NB: We know that md has a reference from the mapping +  * in addition to our reference. +  * +  * The use of sub_ref() silences warnings from Coverity, as well as +  * on the off chance of a reference counting error avoids accessing +  * freed memory. +  */ +  refs = sub_ref(md); /* free_mapping_data(md); */ +  assert(refs);       if(t != T_INT) return 0;       grow_md = MD_FULLP(md);       /* no need to call PREPARE_* because we re-hash instead */    if(grow_md || md->refs>1)    {    debug_malloc_touch(m);    rehash(m, md->hashsize ? md->hashsize << grow_md : AVG_LINK_LENGTH);