Skip to content

Commit

Permalink
- prevent appearance of dangling pointers in corpse queue
Browse files Browse the repository at this point in the history
A dangling pointer in corpse queue may appear if actor is added to the queue when GC is in propagation state.
Enqueued corpse actor remains white, and if it’s destroyed and garbage collected before dequeue, a dangling pointer will be accessed during its removal from the queue.
In console, do `summon CorpseSpawner` and `gc now` with the following script loaded. Without a write barrier, it will crash in two seconds.

```
class TestCorpse : Actor
{
	States
	{
	Spawn:
		POSS U 1 A_Die;
	Death:
		POSS U 1 A_QueueCorpse;
		Stop;
	}
}

class CorpseSpawner : Actor
{
	override void Tick()
	{
		A_SpawnItem("TestCorpse");
	}
}
```

https://forum.zdoom.org/viewtopic.php?t=69842
  • Loading branch information
alexey-lysiuk committed Jun 30, 2021
1 parent 9b3782e commit a9ad3d1
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions src/playsim/a_action.cpp
Expand Up @@ -105,6 +105,7 @@ DEFINE_ACTION_FUNCTION(AActor, A_QueueCorpse)
corpsequeue.Delete(0);
}
corpsequeue.Push(self);
GC::WriteBarrier(self);
}
return 0;
}
Expand Down

0 comments on commit a9ad3d1

Please sign in to comment.