Closed
Bug 1550009
Opened 5 years ago
Closed 5 years ago
Hash table passes inconsistent aNumElems argument to free_<T>
Categories
(Core :: MFBT, defect)
Core
MFBT
Tracking
()
RESOLVED
FIXED
mozilla68
| Tracking | Status | |
|---|---|---|
| firefox68 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
References
Details
Attachments
(1 file)
Memory for the contents of a hash table is allocated using pod_malloc<FakeSlot> passing the table capacity as aNumElems:
https://searchfox.org/mozilla-central/source/mfbt/HashTable.h#1621-1624
When this is freed, the capacity is again passed as aNumElems but the pointer has been cast to char*:
https://searchfox.org/mozilla-central/source/mfbt/HashTable.h#1642
Since these have different sizes the information passed to the allocator is inconsistent.
This isn't used for anything right now, but for bug 1395509 it's important to be able to get the correct size here.
|
Assignee | |
Comment 1•5 years ago
|
||
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/685e0cd74c2e Make HashTable call templated alloc/free methods with the same type r=froydnj?
|
||
Comment 3•5 years ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
You need to log in
before you can comment on or make changes to this bug.
Description
•