Further fixes of substitution and use-after-free

1 files changed, 49 insertions, 31 deletions

diff --git a/src/term.c b/src/term.c
index bf712d6..caea6f1 100644
--- a/src/term.c
+++ b/src/term.c
@@ -10,34 +10,37 @@
 #include <term.h>
 #include <map.h>
 
+static void term_destroy_parent(void *item)
+{
+	struct term *term = *(struct term **)item;
+	term_destroy_head(term, 1);
+}
+
 // doesn't care about ref count
 // this is needed to destroy possibly multiple parents
-static void term_destroy_head(struct term *term)
+void term_destroy_head(struct term *term, char including_parents)
 {
+	debug("destroying head of %lx\n", term->hash);
+
 	map_delete(map_all_terms(), term);
 
 	// recursively destroy own parents
-	map_destroy(term->parents);
-
-	// remove term from child's parents
-	if (term->type == ABS) {
-		map_delete(term->u.abs.term->parents, term);
-	} else if (term->type == APP) {
-		map_delete(term->u.app.lhs->parents, term);
-		map_delete(term->u.app.rhs->parents, term);
+	if (including_parents) {
+		map_destroy(term->parents);
+
+		// remove head from child's parents
+		if (term->type == ABS) {
+			map_delete(term->u.abs.term->parents, term);
+		} else if (term->type == APP) {
+			map_delete(term->u.app.lhs->parents, term);
+			map_delete(term->u.app.rhs->parents, term);
+		}
 	}
 
 	schedule_remove(term);
 	free(term);
 }
 
-static void term_destroy_parent(void *item)
-{
-	struct term *term = *(struct term **)item;
-	fprintf(stderr, "%p parent\n", term);
-	term_destroy_head(term);
-}
-
 struct term *term_new(term_type_t type, hash_t hash, size_t depth)
 {
 	struct term *term = malloc(sizeof(*term));
@@ -82,6 +85,7 @@ void term_print(struct term *term)
 
 struct term *term_rehash_abs(struct term *head, struct term *term)
 {
+	debug("rehashing abs %lx\n", head->hash);
 	hash_t res =
 		hash((uint8_t *)&head->type, sizeof(head->type), term->hash);
 
@@ -91,14 +95,14 @@ struct term *term_rehash_abs(struct term *head, struct term *term)
 	struct term *match = map_get(map_all_terms(), res);
 	if (match) { // already exists
 		term_refer_head(match, head->depth);
-		/* term_deref_head(head); */
+		term_deref_head(head, 1);
 		return match;
 	} else { // create new
 		struct term *new = term_new(ABS, res, head->depth);
 		new->u.abs.term = term;
 		map_set(map_all_terms(), new);
 		map_set(term->parents, new);
-		/* term_deref_head(head); */
+		term_deref_head(head, 1);
 		return new;
 	}
 }
@@ -106,6 +110,7 @@ struct term *term_rehash_abs(struct term *head, struct term *term)
 struct term *term_rehash_app(struct term *head, struct term *lhs,
 			     struct term *rhs)
 {
+	debug("rehashing app %lx\n", head->hash);
 	hash_t res =
 		hash((uint8_t *)&head->type, sizeof(head->type), lhs->hash);
 	res = hash((uint8_t *)&res, sizeof(res), rhs->hash);
@@ -116,7 +121,7 @@ struct term *term_rehash_app(struct term *head, struct term *lhs,
 	struct term *match = map_get(map_all_terms(), res);
 	if (match) { // already exists
 		term_refer_head(match, head->depth);
-		term_deref(head);
+		term_deref(head, 1);
 		return match;
 	} else { // create new
 		struct term *new = term_new(APP, res, head->depth);
@@ -125,13 +130,14 @@ struct term *term_rehash_app(struct term *head, struct term *lhs,
 		map_set(map_all_terms(), new);
 		map_set(lhs->parents, new);
 		map_set(rhs->parents, new);
-		term_deref_head(head);
+		term_deref_head(head, 1);
 		return new;
 	}
 }
 
 struct term *term_rehash_var(struct term *head, size_t index)
 {
+	debug("rehashing var %lx\n", head->hash);
 	hash_t res = hash((uint8_t *)&head->type, sizeof(head->type), index);
 
 	if (res == head->hash)
@@ -140,13 +146,13 @@ struct term *term_rehash_var(struct term *head, size_t index)
 	struct term *match = map_get(map_all_terms(), res);
 	if (match) { // already exists
 		term_refer_head(match, head->depth);
-		term_deref(head);
+		term_deref(head, 1);
 		return match;
 	} else { // create new
 		struct term *new = term_new(APP, res, head->depth);
 		new->u.var.index = index;
 		map_set(map_all_terms(), new);
-		term_deref_head(head);
+		term_deref_head(head, 1);
 		return new;
 	}
 }
@@ -170,6 +176,7 @@ void term_rehash_parents(struct term *term)
 {
 	if (!term->parents)
 		return;
+	debug("rehashing parents of %lx\n", term->hash);
 
 	// we need to convert the parent hashmap to a list
 	// so we can replace the rehashed elements while looping
@@ -210,10 +217,13 @@ void term_rehash_parents(struct term *term)
 		free(iterator);
 		iterator = next;
 	}
+	if (iterator == parents)
+		free(parents);
 }
 
 void term_refer_head(struct term *term, size_t depth)
 {
+	debug("referring head of %lx\n", term->hash);
 	term->refs++;
 	if (depth < term->depth) // lower depths are more important
 		term->depth = depth;
@@ -231,23 +241,31 @@ void term_refer(struct term *term, size_t depth)
 	term_refer_head(term, depth);
 }
 
-void term_deref_head(struct term *term)
+char term_deref_head(struct term *term, char destroy_parents)
 {
-	fprintf(stderr, "%p deref\n", term);
+	debug("dereferring head of %lx\n", term->hash);
+
 	assert(term->refs);
 	term->refs--;
-	if (!term->refs)
-		term_destroy_head(term);
+	if (!term->refs) {
+		term_destroy_head(term, destroy_parents);
+		return 1;
+	}
+	return 0;
 }
 
-void term_deref(struct term *term)
+// returns 1 if destroyed
+char term_deref(struct term *term, char destroy_parents)
 {
+	char a = 0, b = 0;
 	if (term->type == ABS) {
-		term_deref(term->u.abs.term);
+		a = term_deref(term->u.abs.term, destroy_parents);
 	} else if (term->type == APP) {
-		term_deref(term->u.app.lhs);
-		term_deref(term->u.app.rhs);
+		a = term_deref(term->u.app.lhs, destroy_parents);
+		b = term_deref(term->u.app.rhs, destroy_parents);
 	}
 
-	term_deref_head(term);
+	if (a || b)
+		return 1;
+	return term_deref_head(term, destroy_parents);
 }