392008 - trace-malloc handling of realloc and free is not threadsafe

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

trace-malloc's handling of realloc is not threadsafe, on either Linux or Windows (although it's different on both).

We need to remove the address from the allocations table before calling the system realloc because it could potentially be reallocated on another thread before we get a chance to remove it from the allocations table afterwards.

Comment 1

[Brendan Eich [:brendan]]

Stealing. I would prefer to un-duplicate, then fix once.

/be

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Note that on Mac OS X, we'd need to change the way we hook the allocation functions to fix this.   Instead of using the hooks, we should override the vtable pointers in the result of malloc_default_zone(), as the #if 0-ed code in nsCycleCollector does, assuming that doing that works.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This has actually always been a problem for free on Windows as well, and is now a problem for free on Linux too.

Comment 4

[Brendan Eich [:brendan]]

Giving back this one too -- no time for trace-malloc, sigh.

/be

Comment 5

[Andrew McCreight [:mccr8]]

trace-malloc was removed in bug 1014341.