504777 - Large-object management can make large blocks uncollectable

Status: VERIFIED FIXED

(Tamarin Graveyard :: Garbage Collection (mmGC), defect)

Description

[Lars T Hansen]

There is a problem with the handling of finalization of large objects that can cause large blocks to be dropped from the large object list.  This can manifest itself as a storage leak and as finalizers of manifestly unreachable objects not being run, ever.

The problem occurs if the first large block on the large block list has a finalizer that allocates another large block.  The allocation will insert the large block at the beginning of the large block list, but when the finalizer returns the finalization logic will overwrite the pointer to the new block with the pointer to the successor of the block that was just finalized.

Comment 1

[Lars T Hansen]

There's also an amusing problem with finalizers for large blocks explicitly freeing other large blocks (or indeed the block being finalized), but a test in GC::Free stops this from being much of an an immediate problem.

Comment 2

[Lars T Hansen]

Attachment: Fix

Comment 3

[Tommy Reilly]

Comment on attachment 389756 [details] [diff] [review]
Fix

The code in Free seems little strong given that GC::Free guards against it, I would have just rolled an assert to keep GC::Free honest.

Comment 4

[Lars T Hansen]

redux changeset:   2185:358852a96169

Comment 5

[Lars T Hansen]

(In reply to comment #3)
> (From update of attachment 389756 [details] [diff] [review])
> The code in Free seems little strong given that GC::Free guards against it, I
> would have just rolled an assert to keep GC::Free honest.

BTW, fixed that.