Hi (Angus), I found problem with map and libqb. Attached is simplest reproducer which I was able to create.
Result is following: Iter test.key1 = 0x5a2a290 (1) Freeing value Notify (nil) 0x5a2a290==15090== Invalid read of size 4 ==15090== at 0x400988: notify_fn (in /root/a.out) ==15090== by 0x4E47190: trie_notify (trie.c:297) ==15090== by 0x4E46C37: trie_node_destroy (trie.c:125) ==15090== by 0x4E46C90: trie_node_deref (trie.c:138) ==15090== by 0x4E4762E: trie_iter_next (trie.c:437) ==15090== by 0x4E44D30: qb_map_iter_next (map.c:82) ==15090== by 0x400B33: main (in /root/a.out) ==15090== Address 0x5a2a290 is 0 bytes inside a block of size 8 free'd ==15090== at 0x4C2695D: free (vg_replace_malloc.c:366) ==15090== by 0x400B20: main (in /root/a.out) ==15090== old value = 1 Iter test.key2 = 0x5a2a2e0 (2) Freeing value Notify (nil) 0x5a2a2e0old value = 2 ==15090== ==15090== HEAP SUMMARY: ==15090== in use at exit: 4,304 bytes in 25 blocks ==15090== total heap usage: 29 allocs, 4 frees, 4,800 bytes allocated ==15090== ==15090== LEAK SUMMARY: ==15090== definitely lost: 32 bytes in 1 blocks ==15090== indirectly lost: 4,272 bytes in 24 blocks ==15090== possibly lost: 0 bytes in 0 blocks ==15090== still reachable: 0 bytes in 0 blocks ==15090== suppressed: 0 bytes in 0 blocks ==15090== Rerun with --leak-check=full to see details of leaked memory ==15090== ==15090== For counts of detected and suppressed errors, rerun with: -v ==15090== ERROR SUMMARY: 2 errors from 1 contexts (suppressed: 6 from 6)
There should be NO invalid read of size ... Main problem seems to be with fact, that delete callback is called after free in iter, but in that time, pointer is already freed. Possible workaround may be to free value only in callback, but it can be very hard (impossible) to realize.
Regards, Honza