If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

using delete on a new (GC*) object where object doesn't inherit from GCObject results in hard to debug crashes

VERIFIED FIXED in flash10.1

Status

Tamarin
Garbage Collection (mmGC)
P5
minor
VERIFIED FIXED
8 years ago
8 years ago

People

(Reporter: Tommy Reilly, Assigned: Lars T Hansen)

Tracking

unspecified
flash10.1
Bug Flags:
flashplayer-qrb +
flashplayer-triage +

Details

(Whiteboard: Has patch)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

8 years ago
Should be easy to assert that the address passed to FixedMalloc free didn't come from FixedMalloc::Alloc.

Updated

8 years ago
Flags: flashplayer-triage+
Flags: flashplayer-qrb?
(Assignee)

Comment 1

8 years ago
(poaching)
Assignee: treilly → lhansen
(Assignee)

Updated

8 years ago
Priority: -- → P5
Target Milestone: --- → flash10.1

Updated

8 years ago
Flags: flashplayer-qrb? → flashplayer-qrb+
(Assignee)

Comment 2

8 years ago
Created attachment 414274 [details] [diff] [review]
Patch

Here's a basic solution.

Two refinements are easily imagined:

 - a more sophisticated data structure to track large blocks to make it less
   likely that the linear scan will make debug builds really slow

 - we could assert that the small-object pointer points to and object (not just
   into one) and that that object is not free, not simply that it points into
   a block's memory area.
Attachment #414274 - Flags: review?(treilly)
(Assignee)

Updated

8 years ago
Whiteboard: Has patch
(Reporter)

Updated

8 years ago
Attachment #414274 - Flags: review?(treilly) → review+
(Reporter)

Comment 3

8 years ago
Comment on attachment 414274 [details] [diff] [review]
Patch

My plan for large blocks was to just assert that the GCHeap had a HeapBlock inUse at that address that was the right size, much simpler, almost as effective.  This technique is a little better as it guards against coincidental positives from other GCHeap clients.
(Assignee)

Comment 4

8 years ago
redux changeset 3229:6e00ccd98704
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
(Assignee)

Comment 5

8 years ago
Reopening because it probably needs a tweak so as not to upset the sampler.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(Assignee)

Updated

8 years ago
Attachment #414274 - Attachment is obsolete: true
(Assignee)

Comment 6

8 years ago
Created attachment 416912 [details] [diff] [review]
Fall back on non-allocation if AVMPLUS_SAMPLER is defined
Attachment #416912 - Flags: review?(treilly)
(Assignee)

Updated

8 years ago
Blocks: 528338
(Reporter)

Updated

8 years ago
Attachment #416912 - Flags: review?(treilly) → review+
(Assignee)

Comment 7

8 years ago
redux changeset:   3329:d7162814f1f5
Status: REOPENED → RESOLVED
Last Resolved: 8 years ago8 years ago
Resolution: --- → FIXED

Comment 8

8 years ago
Engineering work item.  Marking as verified.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.