507255 - Fragment::onDestroy can cause double-deletes

Status: VERIFIED FIXED

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Steven Johnson]

Attachment: Patch

Fragment::onDestroy is called exclusively from ~Fragment.

Since Fragment is a GCFinalizedObject, this means that
it is called only if:
	(a) the heap is being swept, or
	(b) we have been explicitly deleted. 

HOWEVER: LirBuffer is also a GCFinalizedObject.

Thus, for case (a), lirbuf might have been finalized before
us, so we MUST NOT explicitly delete it here, because that
could cause a double-delete, which can lead to many amusing problems.

Instead, we will do nothing here, and in the (rare) case (b), 
lirbuf will simply be collected in due course.

Comment 1

[Rick Reitmaier]

Comment on attachment 391456 [details] [diff] [review]
Patch

Fine for now since mem mgt is being reworked in bug #506390

You might want to set lirbuf = 0 in the onDestroy to help the gc out a bit.

Comment 2

[Steven Johnson]

pushed (with suggested change) as changeset:   2271:c62fa72c6344

Comment 3

[Edwin Smith]

Comment on attachment 391456 [details] [diff] [review]
Patch

onDestroy() is slated for gutting anyway with upcoming changes that turn Fragment and LirBuffer into arena-allocated objects.

Comment 4

[Chris Peyer]

Resolved fixed engineering / work item that has been pushed.  Setting status to verified.