Issue removing a node from a linked list - c

Question

Since the code was cryptic I decided to reformulate it.
This code is trying to remove the second element from a linked list (the node with number 2 on "int data"). The first parameter of remove_node is the address of the first pointer of the list, so if I have to remove the first pointer of the list I am able to start the list from the next pointer.
The problem is inside the second while loop, inside the if clause, more specifically with the free(previous->next) function, it is changing the address pointed by address_of_ptr (aka *address_of_ptr) and I can't understand why this is happening. Could someone enlighten me?
#include <stdlib.h>
typedef struct node
{
struct node *next;
int data;
} node;
void remove_node(node **address_of_ptr, int int_to_remove)
{
node *previous;
while (*address_of_ptr != NULL && (*address_of_ptr)->data == int_to_remove)
{
previous = *address_of_ptr;
*address_of_ptr = (*address_of_ptr)->next;
free(previous);
}
previous = *address_of_ptr;
address_of_ptr = &((*address_of_ptr)->next);
while (*address_of_ptr != NULL)
{
if ((*address_of_ptr)->data == int_to_remove)
{
address_of_ptr = &((*address_of_ptr)->next);
free(previous->next);
previous->next = *address_of_ptr;
/*or
previous->next = (*address_of_pointer)->next;
free(*address_of_pointer);
address_of_pointer = &previous->next;
*/
}
else
{
previous = *address_of_ptr;
address_of_ptr = &((*address_of_ptr)->next);
}
}
}
int main(void)
{
node *head = malloc(sizeof(node));
node *a = malloc(sizeof(node));
node *b = malloc(sizeof(node));
head->next = a;
a->next = b;
b->next = NULL;
head->data = 1;
a->data = 2;
b->data = 1;
remove_node(&head, 2);
return 0;
}
I figured it out using pythontutor.com.
Here is an image of the execution about to replace address_of_ptr with the address of the next pointer in the list:
about to replace address_of_ptr
In my mind what would happen is that address_of_ptr would move from head to a:
like this
But what actually happens is this:
address_of_ptr move from head to the first node's next variable
Which is also the address of the next node (such as a).
Inside the if clause:
address_of_ptr is set to the second node's next variable
What I was expecting was it being set to b:
Like this
Since it becomes equivalent to previous->next, it causes program to free address_of_ptr.

Answer 1

I would like to thank everyone who helped me sorting this issue, I truly appreciate your effort in making the explanation clear as possible. After a lot of thinking a solution that I believe is much simpler than my first code come up. #David C. Rankin mentioned "Linus on Understanding Pointers", and I think "I might have grasped" what Linus was referring to:
void remove_node(node **address_of_ptr, int int_to_remove)
{
node *to_remove;
while (*address_of_ptr != NULL)
{
if ((*address_of_ptr)->data == int_to_remove)
{
to_remove = *address_of_ptr;
*address_of_ptr = (*address_of_ptr)->next;
free(to_remove);
}
else
{
address_of_ptr = &(*address_of_ptr)->next;
}
}
}

Answer 2

First of all, if the first while loop stops due to *address_of_ptr == NULL, then the line
address_of_ptr = &((*address_of_ptr)->next);
will cause undefined behavior, due to deferencing a NULL pointer. However, this will not happen with the sample input provided by the function main, so it is not the cause of your problem.
Your problem is the following:
When first executing inside the if block of the second while loop (which will be in the first iteration of the second while loop with your sample input), address_of_ptr will point to the next member of the first node in the linked list, so the pointer will have the value of &head->next. This is because you have the line
address_of_ptr = &((*address_of_ptr)->next);
in several places in your program, and it will execute one of these lines exactly once by the time you enter the if block.
The first line of that if block is also the line
address_of_ptr = &((*address_of_ptr)->next);
so that after executing that line, address_of_ptr will point to the next member of the second node in the linked list, so the pointer will have the value of &a->next.
At that time, the value of previous will be head, because at the time
previous = *address_of_ptr;
was executed, address_of_ptr had the value of &head.
Therefore, when the next line
free(previous->next);
is executed, previous->next will have the value of a, which ends the lifetime of that node. As already stated, at this time address_of_ptr will have the value &a->next, which means that address_of_ptr is now a dangling pointer, because it is now pointing to a freed memory location. Therefore, it is not surprising that *address_of_ptr changes after the free statement, because freed memory can change at any time.
Note that the function remove_node can be implemented in a much simpler way:
void remove_node( node **pp_head, int int_to_remove )
{
node **pp = pp_head, *p;
//process one node per loop iteration
while ( (p = *pp) != NULL )
{
//check if node should be removed
if ( p->data == int_to_remove )
{
//unlink the node from the linked list
*pp = p->next;
//free the unlinked node
free( p );
}
else
{
//go to next node in the list
pp = &p->next;
}
}
}

Answer 3

This line:
begin_list = &previous->next;
You might be mis-thinking how pointers to pointers work. Since begin_list is a t_list **, you generally want to assign to *begin_list. Also, since previous->next is already an address, you don't want to assign the address to *begin_list, just the value, so this should work instead:
*begin_list = previous->next;
Same for the similar line below it.

Answer 4

I prepared an answer last night several minutes after you asked the question at first, and put a lot of thought into it, but didn't come back until just now. I'd let my version go, but it's a more detailed look into the problem anyway, so I thought I'd include it for posterity.
The problem lay on line 36:
begin_list = &(*begin_list)->next;
In the first while loop in the function ft_list_remove_if, I can see that you wanted to change the beginning of the list to point to some list item potentially later in the list; so for example, if you wanted to remove all items in the list which contained the string "a", this function should indeed change the value of list1 in the main function; this way the new start of the list would actually be list2.
However, by the time the second while loop is entered, there's no need to change the pointer to the start of the list anymore; that was taken care of in the first while loop. As such, begin_list should really not be used anymore; it is a pointer to a pointer to a list item, so it references the variable which points to a list item. This is not desirable. Let's step through the program line-by-line and I'll show you what I mean.
Upon entering the function ft_list_remove_if, we run past the first while loop since the first element of the list does not contain the data "b":
while (*begin_list != 0 && (*cmp)((*begin_list)->data, data_ref) == 0)
{
[...]
}
We're still on the first list item when we enter the second while loop, and the first item does not match. We therefore go to the else branch of the if statement on line 25:
if ((*cmp)((*begin_list)->data, data_ref) == 0)
{
[...]
}
else
{
previous = *begin_list;
begin_list = &(*begin_list)->next;
}
In the else branch, previous is set to the first item in the linked list. Fair enough. Then begin_list is set to the address of the next member of the first list item. This means that when the first list item's next member changes, so does the value of *begin_list. Let that point sink in.
Now we go on to the next iteration of the while loop. This time *begin_list points to the second list item, which does indeed match the search criteria, so we enter the main if branch instead of the else:
if ((*cmp)((*begin_list)->data, data_ref) == 0)
{
previous->next = (*begin_list)->next;
free(*begin_list);
begin_list = &previous->next;
}
OK. So let's remember here: previous is set to the first item in the linked list. *begin_list is set to the second item in the linked list. But what is begin_list set to? In short, the address of previous->next. Remember the following from the last cycle of the loop?
previous = *begin_list;
begin_list = &(*begin_list)->next;
So now when previous->next is changed on line 28 to the third item in the list, *begin_list is also changed to the third item in the list! That means that line 29 frees the memory allocated to the third item in the list, while the second item no longer referenced by any pointers! By sheer luck, the program might continue to look like it functions properly for the next few steps, but it doesn't; the third element has been freed, and the contents of the third element get scrambled up a little bit and the third element's next and data members are filled with invalid data, resulting in the segfault.
However, the procedure worked when you copied *begin_list to to_remove first, and then freed the data pointed to by to_remove:
to_remove = *begin_list;
previous->next = (*begin_list)->next;
free(to_remove);
begin_list = &previous->next;
This is because to_remove continues to point to the second element, even after *begin_list has been changed by the previous->next = (*begin_list)->next; statement; thus the second element is freed as it should be, and on line 31 begin_list is set to the address of the third element, just like it should be.
That doesn't mean that the latter is a good solution. Really, I think begin_list shouldn't be used at all beyond the first while loop, since it doesn't have to be. My suggestion is to use another pointer named current with which you can step through the list:
#include <stdlib.h>
#include <stdio.h>
typedef struct s_list
{
struct s_list *next;
void *data;
} t_list;
void ft_list_remove_if(t_list **begin_list, void *data_ref, int (*cmp)())
{
t_list *previous;
t_list *current;
if (begin_list == 0)
return;
while (*begin_list != 0 && (*cmp)((*begin_list)->data, data_ref) == 0)
{
previous = *begin_list;
*begin_list = (*begin_list)->next;
free(previous);
}
current = *begin_list;
while (current != 0)
{
if ((*cmp)(current->data, data_ref) == 0)
{
previous->next = current->next;
free(current);
current = previous->next;
}
else
{
previous = current;
current = current->next;
}
}
}
int ft_strcmp(char *s1, char *s2)
{
int i;
i = 0;
while (s1[i] == s2[i] && s1[i] != '\0')
++i;
return (s1[i] - s2[i]);
}
int main(void)
{
t_list *list1 = malloc(sizeof(*list1));
t_list *list2 = malloc(sizeof(*list2));
t_list *list3 = malloc(sizeof(*list3));
list1->data = "a";
list2->data = "b";
list3->data = "a";
list1->next = list2;
list2->next = list3;
list3->next = 0;
ft_list_remove_if(&list1, "b", &ft_strcmp);
return (0);
}