Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fixed bug of old finalized objects in the GC
When an object aged OLD1 is finalized, it is moved from the list
'finobj' to the *beginning* of the list 'allgc'. So, this part of the
list (and not only the survival list) must be visited by 'markold'.
  • Loading branch information
roberto-ieru committed Jul 10, 2020
1 parent 6f5bd50 commit 127e7a6
Showing 1 changed file with 4 additions and 6 deletions.
10 changes: 4 additions & 6 deletions lgc.c
Expand Up @@ -1131,16 +1131,14 @@ static void finishgencycle (lua_State *L, global_State *g) {


/*
** Does a young collection. First, mark 'OLD1' objects. (Only survival
** and "recent old" lists can contain 'OLD1' objects. New lists cannot
** contain 'OLD1' objects, at most 'OLD0' objects that were already
** visited when marked old.) Then does the atomic step. Then,
** sweep all lists and advance pointers. Finally, finish the collection.
** Does a young collection. First, mark 'OLD1' objects. Then does the
** atomic step. Then, sweep all lists and advance pointers. Finally,
** finish the collection.
*/
static void youngcollection (lua_State *L, global_State *g) {
GCObject **psurvival; /* to point to first non-dead survival object */
lua_assert(g->gcstate == GCSpropagate);
markold(g, g->survival, g->reallyold);
markold(g, g->allgc, g->reallyold);
markold(g, g->finobj, g->finobjrold);
atomic(L);

Expand Down

2 comments on commit 127e7a6

@BrunoVernay
Copy link

@BrunoVernay BrunoVernay commented on 127e7a6 Dec 11, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this really the FIX for https://nvd.nist.gov/vuln/detail/CVE-2020-15889 ??
Maybe the commit should reference the CVE??

Or does it creates the bug as hinted by https://bugzilla.redhat.com/show_bug.cgi?id=1860316

I am totally confused

@craigbarnes
Copy link
Member

@craigbarnes craigbarnes commented on 127e7a6 Dec 12, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@BrunoVernay The mailing list is at http://www.lua.org/lua-l.html

Ah never mind, I see you've already posted there.

Please sign in to comment.