Null loaded dict entries after a failed truncate

PersistedSymbolDict.openExisting frees the loaded-entries buffer in the
truncate-failure branch, then calls ff.close(fd). If that close threw, the
enclosing catch re-freed the same buffer -- a double-free -- because,
unlike the bad-magic branch, this branch did not null the pointer first.

Null entriesAddr/entriesLen right after freeing them, matching the buf
discipline above, so the catch's guard skips the second free. Correct the
catch comment, which wrongly claimed nothing between the malloc and the
return could throw -- the truncate branch's free-then-close is exactly
such a point.

This is defensive hardening: FilesFacade.close returns a status code and
never throws (the native close never raises), so the path is unreachable
today, but the nulling keeps it safe against a future facade or edit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/PersistedSymbolDict.java

@@ -608,6 +608,10 @@ private static PersistedSymbolDict openExisting(FilesFacade ff, String filePath,
                 LOG.warn("symbol dict {} could not drop its torn/stale tail (truncate failed); recreating", filePath);
                 if (entriesAddr != 0L) {
                     Unsafe.free(entriesAddr, entriesLen, MemoryTag.NATIVE_DEFAULT);
+                    // Null after freeing (like buf above) so the catch below cannot
+                    // double-free entriesAddr if the following ff.close throws.
+                    entriesAddr = 0L;
+                    entriesLen = 0;
                 }
                 ff.close(fd);
                 return null;
@@ -617,10 +621,11 @@ private static PersistedSymbolDict openExisting(FilesFacade ff, String filePath,
             if (buf != 0L) {
                 Unsafe.free(buf, (int) fileLen, MemoryTag.NATIVE_DEFAULT);
             }
-            // entriesAddr is transferred to the returned dict on the success path,
-            // and the catch only runs before that return, so freeing it here cannot
-            // double-free. Unreachable today (nothing between its malloc and the
-            // return throws), but keeps the error path leak-free against a future edit.
+            // Free entriesAddr if it was allocated and not yet handed off. The success
+            // path transfers it to the returned dict, and every path that frees it
+            // earlier (the truncate-failure branch above) also nulls it, so this cannot
+            // double-free. Keeps the error path leak-free on any throw between its
+            // malloc and the return.
             if (entriesAddr != 0L) {
                 Unsafe.free(entriesAddr, entriesLen, MemoryTag.NATIVE_DEFAULT);
             }