Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign updo not destroy a page with an active TT_ENV #3339
Conversation
matz
merged commit 965690c
into
mruby:master
Dec 10, 2016
added a commit
that referenced
this pull request
Dec 10, 2016
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
kazuho commentedDec 10, 2016
•
edited
When a dead TT_FIBER object refers to a dead-and-shared TT_ENV object, both of the two gets collected, since neither of them are marked.
In such case, if the TT_ENV object is freed before the TT_FIBER object, a pointer within the TT_FIBER object referring to the TT_ENV object becomes invalid, which leads to freed memory access or segmentation fault if the page that contained the TT_ENV object was released prior to the destruction of the TT_FIBER object.