32285: restart the fheap search in freeheap if the current fheap arena is about to be discarded; fixes crash

2 files changed, 16 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 23c5aa68f..96a95ea77 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2014-01-18  Barton E. Schaefer  <schaefer@zsh.org>
 
+	* 32285: Src/mem.c (freeheap): when the last-arena-with-free-space
+	pointer (fheap) points to an arena that is going to be discarded
+	because it has become empty, loop back through the entire linked
+	list of arenas to find another partly-filled arena; fixes crash
+	wherein pushheap followed by freeheap could orphan the whole list
+	of arenas in some circumstances
+
 	* 32283: Src/Zle/complist.c: avoid using a negative number for
 	available vertical space when the terminal has only a small number
 	of lines; fixes crash in menu selection
diff --git a/Src/mem.c b/Src/mem.c
index 5275c6c98..d15721c28 100644
--- a/Src/mem.c
+++ b/Src/mem.c
@@ -367,6 +367,15 @@ freeheap(void)
 	    }
 #endif
 	} else {
+	    if (h == fheap && h != heaps) {
+		/*
+		 * When deallocating the last arena with free space,
+		 * loop back through the list to find another one.
+		 */
+		fheap = NULL;
+		hn = heaps;
+		continue;
+	    }
 #ifdef USE_MMAP
 	    munmap((void *) h, h->size);
 #else