pike.git / src / mapping.c

version» Context lines:

pike.git/src/mapping.c:964:    mi_do_nothing:    free_mapping_data(md);    return;       mi_set_value:   #ifdef PIKE_DEBUG    if(m->data != md)    Pike_fatal("Wrong dataset in mapping_insert!\n");    if(d_flag>1) check_mapping(m);   #endif -  free_mapping_data(md); +  /* NB: We know that md has a reference from the mapping +  * in addition to our reference. +  * +  * The use of sub_ref() silences warnings from Coverity, as well as +  * on the off chance of a reference counting error avoids accessing +  * freed memory. +  */ +  refs = sub_ref(md); /* free_mapping_data(md); */ +  assert(refs); +     if(!overwrite) return;    PREPARE_FOR_DATA_CHANGE2();    PROPAGATE(); /* propagate after preparing */    md->val_types |= 1 << TYPEOF(*val);    if (overwrite == 2 && TYPEOF(*key) == T_OBJECT)    /* Should replace the index too. It's only for objects that it's    * possible to tell the difference. */    assign_svalue (&k->ind, key);    assign_svalue(& k->val, val);   #ifdef PIKE_DEBUG
pike.git/src/mapping.c:1095:    free_mapping_data(md);    return 0;       mg_set_value:   #ifdef PIKE_DEBUG    if(m->data != md)    Pike_fatal("Wrong dataset in mapping_get_item_ptr!\n");    if(d_flag)    check_mapping(m);   #endif -  free_mapping_data(md); +  /* NB: We know that md has a reference from the mapping +  * in addition to our reference. +  * +  * The use of sub_ref() silences warnings from Coverity, as well as +  * on the off chance of a reference counting error avoids accessing +  * freed memory. +  */ +  refs = sub_ref(md); /* free_mapping_data(md); */ +  assert(refs); +     if(TYPEOF(k->val) == t)    {    PREPARE_FOR_DATA_CHANGE2();    PROPAGATE(); /* prepare then propagate */       return & ( k->val.u );    }       return 0;