[Vala] Error in unary prefixed-increment casuses segfault....

[Marco Trevisan (Treviño) <mail 3v1n0 net>]

For some tests, I wrote this small code for implementing a priority
queue... However I found an issue in the unary pre-increment operator.

In fact, look at the PriorityQueue.insert() function, if I do:

        QueueItem qi = new QueueItem(v, priority);
        priority_queue[size++] = qi;
        print("Added value with Prioirity %d\n".printf(priority_queue[size].prio));

The code segfaults when doing the print, due to the fact that the size
value is not correctly incremented.
Otherwise, doing:
        
        QueueItem qi = new QueueItem(v, priority);
        size++;
        priority_queue[size] = qi;
        print("Added value with Prioirity %d\n".printf(priority_queue[size].prio));

Everything works as expected.

Now, looking at the differencies in the generated C code, you can see
that _tmp1_ is set to self->priv->_size, but when size is incremented,
_tmp1_ is not, that's why there's a segfault when reading from an
un-initialized array location.

--- /tmp/priority-queue-invalid.c       2011-01-21 02:44:21.724660008 +0100
+++ /tmp/priority-queue-valid.c 2011-01-21 02:43:08.094660003 +0100
@@ -239,12 +239,12 @@
        qi = _tmp0_;
        _tmp1_ = self->priv->_size;
        priority_queue_set_size (self, _tmp1_ + 1);
        _tmp2_ = _priority_queue_queue_item_ref0 (qi);
        _tmp3_ = _tmp2_;
-       _priority_queue_queue_item_unref0 (self->priv->priority_queue[_tmp1_]);
-       self->priv->priority_queue[_tmp1_] = _tmp3_;
+       _priority_queue_queue_item_unref0 (self->priv->priority_queue[self->priv->_size]);
+       self->priv->priority_queue[self->priv->_size] = _tmp3_;
        _priority_queue_queue_item_unref0 (qi);
 }

Attachment: priority-queue.vala
Description: Text Data