Fix possible access to fromspace when autoboxing return values #1624
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If the target frame (e.g. tc->cur_frame) is a heap frame that lives in the nursery, the return value is a native value (e.g. return_i or a native call), the caller expects an object and boxing happens to trigger a GC run, the target frame could be moved before we dereference the target pointer to get the return_value register. This would lead to a segfault with GC_DEBUG 3. Fix by dereferencing target first instead of having the autobox(_int) macros doing it after boxing. Fixes GH #1621
niner
force-pushed
the
fix_autoboxing_gc_issue
branch
from
cb27ba7
to
f0e4b08
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If the target frame (e.g. tc->cur_frame) is a heap frame that lives in the
nursery, the return value is a native value (e.g. return_i or a native call),
the caller expects an object and boxing happens to trigger a GC run, the
target frame could be moved before we dereference the target pointer to get
the return_value register. This would lead to a segfault with GC_DEBUG 3.
Fix by dereferencing target first instead of having the autobox(_int) macros
doing it after boxing.
Fixes GH #1621