[Devel] Cache manager FREE problem [was: Anyone there?]

[Tom Kacvinsky]

Hi!

I am confused here...

In ftlru.c, we have this:

  FT_EXPORT_DEF( void )  FT_Lru_Done( FT_Lru  lru )
  {
    FT_Memory  memory;


    if ( !lru )
      return;

    memory = lru->memory;

    FT_Lru_Reset( lru );

    FREE( lru->nodes );
    FREE( lru );
  }

So the lru->nodes are freed before lru is freed.

In ftcmanag.c, we have this:

  FT_EXPORT_DEF( void )  FTC_Manager_Done( FTC_Manager  manager )
  {
    FT_Memory  memory;
    FT_UInt    index;


    if ( !manager || !manager->library )
      return;

    memory = manager->library->memory;

    /* now discard all caches */
    for (index = 0; index < FTC_MAX_CACHES; index++ )
    {
      FTC_Cache  cache = manager->caches[index];


      if ( cache )
      {
        cache->clazz->done_cache( cache );
        FREE( cache );
        manager->caches[index] = 0;
      }
    }

    /* discard faces and sizes */
    FT_Lru_Done( manager->faces_lru );
    manager->faces_lru = 0;

    FT_Lru_Done( manager->sizes_lru );
    manager->sizes_lru = 0;

    FREE( manager );
  }

So I don't see how lru->nodes is freed twice, or how lru->nodes is not freed
before lru is freed.  So I would need to know which FREE is causing the memory
access violation.

I am CC'ing my response to the list, where this discussion is best kept.  I
mean, the more eyes on this, the better. :)

Tom

On Fri, 6 Apr 2001, Mike Owens wrote:

> Thanks for your response. I just wasn't sure if my message was getting out
> there.
>
> If this helps, I've traced into ftlru.c where FT_Lru_Done() gets called from
> FTC_Manager_Done() (ftcmanage.c). FT_Lru_Done calls FT_Lru_Reset which seems
> to be rearranging the nodes. However immediately following FT_Lru_Done is
> FREE(lru) which frees the lru memory but not the lru->nodes.
>
> Thanks again for your response.
>
> > We are getting the messages.  As I have said in the past, David Turner (the
> > coder responsible for the cache manager) is a busy man, but he will 
> > eventually
> > will get around to answering your email. :)
> >
> > But in meantime, it sounds like you have stumbled across a dangling pointer
> > problem.  The structure is getting freed before all of its consituent 
> > members
> > are freed.
> >
> > I will try to cook up a patch, but it will most likely take me some time
> > because I am not familiar with the cache manage code.  I spend most of my 
> > time
> > in the CFF, CID and Type 1 drivers.
>