Balance the snapshot register's count, and free the runtime lists in order

Under AddressSanitizer with leaks counted, the module checks lost 672
KB in 10,185 allocations. Two causes, both from the snapshot rework
(d1e8f38):

- A snapshot's register counted its snapshots with ++ under its spin,
  but a snapshot's last release took one off atomically outside it. A
  release on a reader's thread racing the owner's next snapshot could
  lose either change: the register then outlived every snapshot (the
  leak seen), or went while one still used it. The count is atomic now.
- pure_app_stop handed what its lists let go to the newest snapshot (or
  freed it) and only then freed the outbox and the numbers heard, whose
  shared nodes and texts went to that hand-over's list again, for good.
  They are freed with the other lists now.

make check builds the module checks a second time under AddressSanitizer
and UndefinedBehaviorSanitizer (build/test-module-sanitized, 25 s) and
fails on a leak. Before d1e8f38 the same build stops at a
heap-use-after-free in retire; now it is clean.

1 files changed, 3 insertions, 3 deletions

diff --git a/core/module.c b/core/module.c
index 8a57595..97270ef 100644
--- a/core/module.c
+++ b/core/module.c
@@ -2702,6 +2702,8 @@ void pure_app_stop(PureApp *app) {
         pure_list_free(app->lists[i]);
         pure_draft_close(app->list_drafts[i]);
     }
+    pure_list_free(app->outbox); /* the runtime's lists too, before what they let go is handed on */
+    pure_list_free(app->heard);
     /* Items the newest snapshot may still read go with it. */
     if (app->snapshot) {
         lock_register(app->snapshot->all);
@@ -2711,8 +2713,6 @@ void pure_app_stop(PureApp *app) {
     } else
         pure_retired_free(&app->retired);
     pure_draft_close(app->stored_values);
-    pure_list_free(app->outbox);
-    pure_list_free(app->heard);
     free(app->carried);
     pure_draft_close(app->stored_links);
     pure_draft_close(app->stored_seq);
@@ -3337,7 +3337,7 @@ PureSnapshot *pure_save_snapshot(PureApp *app, uint32_t runtime) {
     made->all = all;
     lock_register(all);
     all->epoch = made->epoch;
-    ++all->refs;
+    __atomic_add_fetch(&all->refs, 1, __ATOMIC_ACQ_REL); /* a snapshot's last release takes it off outside the lock */
     made->older = last;
     if (last) { /* what the app let go while last was its newest goes with it */
         last->newer = made;