gdb/

	Fix memory double-free.
	* completer.c (line_completion_function): Clear LIST after called xfree.
gdb/testsuite/
	* gdb.base/completion.exp (Completing non-existing component): New test.

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 6b067ead98ef38df1268d722f59ce5b69cd7a637..2a0a8c400e9977d2430b237c8d797c213fc5e582 100644 (file)
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,4 +1,9 @@
-2008-12-22  Joel  Brobecker  <brobecker@adacore.com>
+2008-12-22  Jan Kratochvil  <jan.kratochvil@redhat.com>
+
+       Fix memory double-free.
+       * completer.c (line_completion_function): Clear LIST after called xfree.
+
+2008-12-22  Joel Brobecker  <brobecker@adacore.com>
 
        * breakpoint.c (update_watchpoint): Adjust and extend the description
        of this function.  Fix one error message accordingly.

diff --git a/gdb/completer.c b/gdb/completer.c
index d109140ee3e0bc6e620ca43667d98697f9339106..4747a4298013b9e8495e8bca83c414e9938a381e 100644 (file)
--- a/gdb/completer.c
+++ b/gdb/completer.c
@@ -752,8 +752,10 @@ line_completion_function (const char *text, int matches,
       if (list)
        {
          /* Free the storage used by LIST, but not by the strings inside.
-            This is because rl_complete_internal () frees the strings.  */
+            This is because rl_complete_internal () frees the strings.
+            As complete_line may abort by calling `error' clear LIST now.  */
          xfree (list);
+         list = NULL;
        }
       index = 0;
       list = complete_line (text, line_buffer, point);

diff --git a/gdb/testsuite/ChangeLog b/gdb/testsuite/ChangeLog
index efa6234ca05bf733e3ce46b672d41a12da220be2..d5ae44852e45d82e474843bac6f3c4cbc2a5e596 100644 (file)
--- a/gdb/testsuite/ChangeLog
+++ b/gdb/testsuite/ChangeLog
@@ -1,3 +1,7 @@
+2008-12-22  Jan Kratochvil  <jan.kratochvil@redhat.com>
+
+       * gdb.base/completion.exp (Completing non-existing component): New test.
+
 2008-12-21  Jan Kratochvil  <jan.kratochvil@redhat.com>
 
        Fix for PR gdb/8648.

diff --git a/gdb/testsuite/gdb.base/completion.exp b/gdb/testsuite/gdb.base/completion.exp
index d0d0dd6ba3bda82b16728bb8ecb01a1317a04754..2d94fcab47900918b4091908986741c80acfc941 100644 (file)
--- a/gdb/testsuite/gdb.base/completion.exp
+++ b/gdb/testsuite/gdb.base/completion.exp
@@ -805,6 +805,24 @@ gdb_expect  {
         timeout         { fail "(timeout) complete 'set follow-fork-mode'" }
         }
 
+send_gdb "p values\[0\].nonex.\t"
+gdb_expect  {
+        -re "Type struct some_struct has no component named nonex.\r\n$gdb_prompt $"\
+            { pass "Completing non-existing component" }
+        -re ".*$gdb_prompt $"       { fail "Completing non-existing component" }
+        timeout         { fail "(timeout) Completing non-existing component" }
+        eof             { fail "(eof) Completing non-existing component #2" }
+        }
+# Double memory freeing gets found only on the second run:
+send_gdb "p values\[0\].nonex.\t"
+gdb_expect  {
+        -re "Type struct some_struct has no component named nonex.\r\n$gdb_prompt $"\
+            { pass "Completing non-existing component #2" }
+        -re ".*$gdb_prompt $"       { fail "Completing non-existing component #2" }
+        timeout         { fail "(timeout) Completing non-existing component #2" }
+        eof             { fail "(eof) Completing non-existing component #2" }
+        }
+
 # Restore globals modified in this test...
 if [info exists old_inputrc] {
     set env(INPUTRC) $old_inputrc