Rongsong Shen
ddee884c1b
makeGroup()'s existing-group update path (hit whenever a config-push re-applies a group name that already has members, e.g. a retried config push during controller failover) released xce_g_member_t.u.name via FREEUP() (plain free()). u.name is allocated by makeString(), an rtti-managed, refcounted pointer that is not a malloc()-base address -- freeing it directly corrupts the heap. group_killer() in the same file already releases the identical field correctly via dereference(). Switch both FREEUP(m->u.name) call sites to dereference(m->u.name) to match. Add a regression test that re-applies config for the same group name twice, reproducing the exact ASAN bad-free at group.c:234 pre-fix. This is the root cause of the reproducible xce_scheduler "free(): invalid pointer" SIGABRT crashes seen during 3-attempt controller-failover config-push retries (8 confirmed core dumps). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| hooks | ||
| _scan-state.json | ||
| anatomy-index.json | ||
| anatomy.md | ||
| buglog.json | ||
| cerebrum.md | ||
| config.json | ||
| cron-manifest.json | ||
| cron-state.json | ||
| daemon.log | ||
| dashboard-token | ||
| designqc-report.json | ||
| identity.md | ||
| memory.md | ||
| OPENWOLF.md | ||
| reframe-frameworks.md | ||
| suggestions.json | ||
| token-ledger.json | ||