[REVIEW] mapping.c: Double free

Not quite, that is a bit higher up in the file. 1658 is merge_mapping_attar_ordered(). It's still ok though since it goes like this:

INT32 *zipper = NULL; ... { zipper=get_set_order(ai); ... free((char *)zipper); }

switch (op) /* no elements from »b» may be selected */ { case PIKE_ARRAY_OP_AND: zipper=merge(b,ai,op); ... break; case PIKE_ARRAY_OP_SUB: zipper=merge(ai,b,op); ... break; default: Pike_fatal("merge_mapping_array on other than AND or SUB\n"); } ... free((char *)zipper);

I forgot to include Pike_fatal as a termination, so the flow that got into the default: was not terminated and ended up in the free.