[PATCH 3/3] perf annotate: Fix block_range symbol loss on split and leaks on exit

[Ian Rogers]

When block_range__create() splits an existing struct block_range entry
into a leading head range (entry->start < start) or a trailing tail
range (end < entry->end), it copies coverage and branch statistics from
the original entry into head/tail, but omits .sym = entry->sym. Because
the returned iterator only spans [start, end], process_basic_block()
never revisits the split-off head or tail range, leaving its .sym NULL
and causing block_range__coverage() to return -1 on instructions in that
split range.

Additionally, the global block_ranges rbtree is never freed on exit from
cmd_annotate(), and process_branch_stack() frees the resolved
branch_info array without calling addr_map_symbol__exit() on bi[i].to
and bi[i].from, leaking thread and map references acquired by
sample__resolve_bstack().

Preserve .sym = entry->sym when splitting head and tail in
block_range__create(), add block_ranges__exit() and call it from
cmd_annotate(), and release bi[i].to and bi[i].from in
process_branch_stack().

Fixes: 70fbe0574558 ("perf annotate: Add branch stack / basic block")
Fixes: bffb5b0c0976 ("perf map/maps/thread: Changes to reference counting")
Suggested-by: Alireza Haghdoost <haghdoost@xxxxxxxx>
Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
---
 tools/perf/builtin-annotate.c |  5 +++++
 tools/perf/util/block-range.c | 16 ++++++++++++++++
 tools/perf/util/block-range.h |  1 +
 3 files changed, 22 insertions(+)

diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 8863f3a570f6..331adbdbd635 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -174,6 +174,10 @@ static void process_branch_stack(struct branch_stack *bs, struct addr_location *
 		prev = &bi[i].to;
 	}
 
+	for (i = 0; i < (int)bs->nr; i++) {
+		addr_map_symbol__exit(&bi[i].to);
+		addr_map_symbol__exit(&bi[i].from);
+	}
 	free(bi);
 }
 
@@ -967,6 +971,7 @@ int cmd_annotate(int argc, const char **argv)
 #ifndef NDEBUG
 	perf_session__delete(annotate.session);
 #endif
+	block_ranges__exit();
 	annotation_options__exit();
 
 	return ret;
diff --git a/tools/perf/util/block-range.c b/tools/perf/util/block-range.c
index 7c559fcfd7e0..280d695c6c58 100644
--- a/tools/perf/util/block-range.c
+++ b/tools/perf/util/block-range.c
@@ -165,6 +165,7 @@ struct block_range_iter block_range__create(u64 start, u64 end)
 			return iter;
 
 		*head = (struct block_range){
+			.sym		= entry->sym,
 			.start		= entry->start,
 			.end		= start - 1,
 			.is_target	= entry->is_target,
@@ -203,6 +204,7 @@ struct block_range_iter block_range__create(u64 start, u64 end)
 				return iter;
 
 			*tail = (struct block_range){
+				.sym		= entry->sym,
 				.start		= end + 1,
 				.end		= entry->end,
 				.is_target	= 0,
@@ -330,3 +332,17 @@ double block_range__coverage(struct block_range *br)
 
 	return (double)br->coverage / branch->max_coverage;
 }
+
+void block_ranges__exit(void)
+{
+	struct rb_node *rb = rb_first(&block_ranges.root);
+
+	while (rb) {
+		struct block_range *entry = rb_entry(rb, struct block_range, node);
+
+		rb = rb_next(rb);
+		rb_erase(&entry->node, &block_ranges.root);
+		free(entry);
+	}
+	block_ranges.blocks = 0;
+}
diff --git a/tools/perf/util/block-range.h b/tools/perf/util/block-range.h
index ec0fb534bf56..0ea4751292c8 100644
--- a/tools/perf/util/block-range.h
+++ b/tools/perf/util/block-range.h
@@ -72,5 +72,6 @@ static inline bool block_range_iter__valid(struct block_range_iter *iter)
 extern struct block_range *block_range__find(u64 addr);
 extern struct block_range_iter block_range__create(u64 start, u64 end);
 extern double block_range__coverage(struct block_range *br);
+extern void block_ranges__exit(void);
 
 #endif /* __PERF_BLOCK_RANGE_H */
-- 
2.56.0.317.g454f8302e1-goog