can not segmentation fault in this case

[johndoe444]

int main()
{
	hash_tree htree;
	htree.root.is_leaf = 1;
	htree.root.candidate_set.len = 0;
	item_set s;
	s.len = 1;
	s.items[0] = 0;
	add_item_set_to_hash_tree(&htree, s);
	s.items[0] = 1;
	add_item_set_to_hash_tree(&htree, s);
	s.items[0] = 2;
	add_item_set_to_hash_tree(&htree, s);
	s.items[0] = 3;
	add_item_set_to_hash_tree(&htree, s);
	s.items[0] = 4;
	add_item_set_to_hash_tree(&htree, s);
	s.items[0] = 5;
	add_item_set_to_hash_tree(&htree, s);
	printf("seg fault 1\n");

	return 0;
}

output:

seg fault within add
escaped seg fault
seg fault within add
escaped seg fault
seg fault within add
escaped seg fault
seg fault within add
escaped seg fault
seg fault within add
escaped seg fault
seg fault within add
escaped seg fault
seg fault 1
Segmentation fault

The problem is as can be seen from the main above, there is no statement after the last print message and before the return statement. Then where is the place that is generating the segmentation fault? For convenience the function add_... is also mentioned here:

void add_item_set_to_hash_tree(hash_tree* htree, item_set s)
{
	node* t = &(htree->root);

	int count = 0;

	while (!t->is_leaf)
	{
		int hash = hash_function(s.items[count++]);
		t = &(t->child[hash]);
	}
	add_item_set_to_node(t, s);
	printf("seg fault within add\n");
	if ((t->candidate_set.len >= 4) && (count < htree->height))
	{
		convert_node_to_leaf(t, count);
	}
	printf("escaped seg fault\n");
}

void convert_node_to_leaf(node* n, int index)
{
	n->is_leaf = 0;

	n->child = (node*) malloc(NUM_BUCKETS*sizeof(node));
	for (int i = 0;i < NUM_BUCKETS;i++)
	{
		n->child->id = id++;
		n->child->candidate_set.len = 0;
	}
	
	int len = n->candidate_set.len;

	for (int i = 0;i < len;i++)
	{
		item_set s = list_get_element_at(n->candidate_set, i);
		int hash = hash_function(s.items[index]);
		add_item_set_to_node(&(n->child[hash]), s);
	}

	list_clear(&n->candidate_set);
}

Here also we see that the last statement within the function add... is printed. So this is difficult to trace because even using binary search we can not find the location of the seg fault as the last message in the functions are printed. This is strange because if seg fault happens it is supposed to exit immediately before it could reach the print statements. In that case we would be able to narrow down the location of seg fault.

So how to find the location of seg fault then?

[kaoni317]

It's looks like that the seg fault happened when the procedure will exit. maybe some memory has been free more than once. I have encouter likeness in C++, but I can't remember now.sorry