Fix some memory leaks and invalid read/delete

git-svn-id: svn+ssh://scm.gforge.inria.fr/svn/simgrid/simgrid/trunk@6751 48e7efb5-ca39-0410-a469-dd3cf9ba447f

diff --git a/src/msg/msg_mailbox.c b/src/msg/msg_mailbox.c
index 8c1cb6d..f7f3445 100644 (file)
--- a/src/msg/msg_mailbox.c
+++ b/src/msg/msg_mailbox.c
@@ -109,6 +109,7 @@ MSG_mailbox_get_task_ext(msg_mailbox_t mailbox, m_task_t *task, m_host_t host,
                          double timeout)
 {
   xbt_ex_t e;
+  size_t task_size = sizeof(void*);
   MSG_error_t ret = MSG_OK;
   smx_comm_t comm;
   CHECK_HOST();
@@ -131,7 +132,8 @@ MSG_mailbox_get_task_ext(msg_mailbox_t mailbox, m_task_t *task, m_host_t host,
 
   /* Try to receive it by calling SIMIX network layer */
   TRY{
-    SIMIX_network_recv(mailbox->rdv, timeout, NULL, NULL, &comm);
+    SIMIX_network_recv(mailbox->rdv, timeout, task, &task_size, &comm);
+    (*task)->simdata->refcount--;
   }
   CATCH(e){
     switch(e.category){
@@ -149,12 +151,6 @@ MSG_mailbox_get_task_ext(msg_mailbox_t mailbox, m_task_t *task, m_host_t host,
     }
     xbt_ex_free(e);        
   }
-
-  *task = SIMIX_communication_get_data(comm);
-  
-  /* If the sender didn't decremented the refcount so far then do it */
-  if (*task && (*task)->simdata->refcount > 1)
-    (*task)->simdata->refcount--;
   
   MSG_RETURN(ret);        
 }
@@ -190,7 +186,7 @@ MSG_mailbox_put_with_timeout(msg_mailbox_t mailbox, m_task_t task,
       SIMIX_cond_signal(mailbox->cond);
 
     SIMIX_network_send(mailbox->rdv, t_simdata->message_size, t_simdata->rate,
-                       timeout, NULL, 0, &t_simdata->comm, task);
+                       timeout, &task, sizeof(void*), &t_simdata->comm, task);
   }
 
   CATCH(e){
@@ -203,18 +199,17 @@ MSG_mailbox_put_with_timeout(msg_mailbox_t mailbox, m_task_t task,
         break;
       case timeout_error:
         ret = MSG_TRANSFER_FAILURE;
-        break;      
+        break;
       default:
         xbt_die("Unhandled SIMIX network exception");
     }
     xbt_ex_free(e);
+
+    /* Decrement the refcount only on failure */
+    t_simdata->refcount--;
   }
 
   process->simdata->waiting_task = NULL;
-  
-  /* If the receiver end didn't decremented the refcount so far then do it */
-  if (t_simdata->refcount > 1)
-    t_simdata->refcount--;
-  
+   
   MSG_RETURN(ret);        
 }

diff --git a/src/simix/smx_network.c b/src/simix/smx_network.c
index f57266e..cdab3e1 100644 (file)
--- a/src/simix/smx_network.c
+++ b/src/simix/smx_network.c
@@ -82,6 +82,7 @@ smx_comm_t SIMIX_rdv_get_request(smx_rdv_t rdv, smx_comm_type_t type)
     DEBUG0("Communication request found!");
     xbt_fifo_shift(rdv->comm_fifo);
     SIMIX_communication_use(comm);
+    comm->rdv = NULL;    
     return comm;
   }
 
@@ -150,13 +151,20 @@ smx_comm_t SIMIX_communication_new(smx_comm_type_t type)
 void SIMIX_communication_destroy(smx_comm_t comm)
 {
   comm->refcount--;
-  if(comm->refcount == 0){
-    if(comm->act != NULL)
-      SIMIX_action_destroy(comm->act);
+  if(comm->refcount > 0)
+    return;
 
-    xbt_free(comm->cond);
-    xbt_free(comm);
+  if(comm->cond){
+    SIMIX_cond_destroy(comm->cond);
+    comm->cond = NULL;
+  }
+  
+  if(comm->act){
+    SIMIX_action_destroy(comm->act);
+    comm->act = NULL;
   }
+  
+  xbt_free(comm);
 }
 
 /**
@@ -174,7 +182,7 @@ static inline void SIMIX_communication_use(smx_comm_t comm)
 
 /**
  *  \brief Start the simulation of a communication request
- *  \param comm The communication request
+ *  \param comm The   comm->rdv = NULL;communication request
  */
 static inline void SIMIX_communication_start(smx_comm_t comm)
 {
@@ -229,7 +237,7 @@ static inline void SIMIX_communication_wait_for_completion(smx_comm_t comm, doub
           SIMIX_communication_cancel(comm);
         else
           SIMIX_rdv_remove(comm->rdv, comm);
-          
+
         SIMIX_cond_signal(comm->cond);
         SIMIX_communication_destroy(comm);
       }
@@ -243,14 +251,13 @@ static inline void SIMIX_communication_wait_for_completion(smx_comm_t comm, doub
   
   /* Check for errors other than timeouts (they are catched above) */
   if(!SIMIX_host_get_state(SIMIX_host_self())){
+    SIMIX_rdv_remove(comm->rdv, comm);
     SIMIX_communication_destroy(comm);
     THROW0(host_error, 0, "Host failed");
   } else if (SIMIX_action_get_state(comm->act) == SURF_ACTION_FAILED){
     SIMIX_communication_destroy(comm);
     THROW0(network_error, 0, "Link failure");
   }
-
-  SIMIX_unregister_action_to_condition(comm->act, comm->cond);
 }
 
 /**