Rongsong Shen
ddee884c1b
makeGroup()'s existing-group update path (hit whenever a config-push re-applies a group name that already has members, e.g. a retried config push during controller failover) released xce_g_member_t.u.name via FREEUP() (plain free()). u.name is allocated by makeString(), an rtti-managed, refcounted pointer that is not a malloc()-base address -- freeing it directly corrupts the heap. group_killer() in the same file already releases the identical field correctly via dereference(). Switch both FREEUP(m->u.name) call sites to dereference(m->u.name) to match. Add a regression test that re-applies config for the same group name twice, reproducing the exact ASAN bad-free at group.c:234 pre-fix. This is the root cause of the reproducible xce_scheduler "free(): invalid pointer" SIGABRT crashes seen during 3-attempt controller-failover config-push retries (8 confirmed core dumps). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| autoscaler | ||
| configs | ||
| controller | ||
| docs | ||
| frontend | ||
| include | ||
| lib | ||
| nixSupport | ||
| scheduler | ||
| schema | ||
| tools | ||
| worker | ||
| xceadmin | ||
| flake.lock | ||
| flake.nix | ||
| meson.build | ||
| meson.options | ||