fix: free frames instead of pages on pagedir_destroy

src/userprog/pagedir.c

@@ -6,6 +6,7 @@
 #include "threads/pte.h"
 #include "threads/palloc.h"
 #ifdef VM
+#include "threads/thread.h"
 #include "vm/frame.h"
 #include "vm/page.h"
 #endif
@@ -46,7 +47,11 @@ pagedir_destroy (uint32_t *pd)
           {
 #ifdef VM
             if (*pte & PTE_P)
-              frame_free (pte_get_page (*pte));
+              {
+                void *page = pte_get_page (*pte);
+                frame_owner_remove (page, thread_current ());
+                frame_free (page);
+              }
             page_cleanup_swap (pte);
 #else
             if (*pte & PTE_P)

src/vm/frame.c

@@ -208,7 +208,7 @@ frame_owner_remove (void *frame, struct thread *owner)
       oe = list_next (oe);
       if (frame_owner->thread == owner)
         {
-          list_remove (oe);
+          list_remove (&frame_owner->elem);
           free (frame_owner);
           return;
         }

src/vm/stackgrowth.c

@@ -50,6 +50,7 @@ grow_stack (const void *addr)
 
   if (!pagedir_set_page (t->pagedir, last_page, new_page, true))
   {
+    frame_owner_remove (new_page, t);
     frame_free (new_page);
     return false;
   }