diff options
| author | github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | 2022-01-04 04:13:19 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-01-04 04:13:19 +0300 |
| commit | a5d1934898bfdf06662cee5799782b09ce8afe5a (patch) | |
| tree | 9bfd966c2f4f2d473e615eeb712e48617577e49a | |
| parent | b8d7525156acaecf311ba468147caa74d8c190f6 (diff) | |
transform sgen_get_descriptor to parallel safe version in job_major_mod_union_preclean (#21391)mono-6.12.0.164
fixes #21369
Related to https://github.com/xamarin/xamarin-android/issues/6546
job_major_mod_union_preclean can race with the tarjan bridge
implementation that changes the vtable pointer by settings the three
lower bits. this results in invalid loading of the vtable
(shifted by 7 bytes) which in turn give a wrong desc to the scan
functions
This change is released under the MIT license.
Co-authored-by: Thomas Mijieux <thomas.mijieux@hotmail.fr>
| -rw-r--r-- | mono/sgen/sgen-cardtable.c | 4 | ||||
| -rw-r--r-- | mono/sgen/sgen-marksweep.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/mono/sgen/sgen-cardtable.c b/mono/sgen/sgen-cardtable.c index 2c6d1ecbd8e..e2f1581b291 100644 --- a/mono/sgen/sgen-cardtable.c +++ b/mono/sgen/sgen-cardtable.c @@ -587,9 +587,9 @@ sgen_cardtable_scan_object (GCObject *obj, mword block_obj_size, guint8 *cards, HEAVY_STAT (++bloby_objects); if (cards) { if (sgen_card_table_is_range_marked (cards, (mword)obj, block_obj_size)) - ctx.ops->scan_object (obj, sgen_obj_get_descriptor (obj), ctx.queue); + ctx.ops->scan_object (obj, sgen_obj_get_descriptor_safe (obj), ctx.queue); } else if (sgen_card_table_region_begin_scanning ((mword)obj, block_obj_size)) { - ctx.ops->scan_object (obj, sgen_obj_get_descriptor (obj), ctx.queue); + ctx.ops->scan_object (obj, sgen_obj_get_descriptor_safe (obj), ctx.queue); } sgen_binary_protocol_card_scan (obj, sgen_safe_object_get_size (obj)); diff --git a/mono/sgen/sgen-marksweep.c b/mono/sgen/sgen-marksweep.c index 5fbd780144f..4a372ce8ffe 100644 --- a/mono/sgen/sgen-marksweep.c +++ b/mono/sgen/sgen-marksweep.c @@ -2616,7 +2616,7 @@ scan_card_table_for_block (MSBlockInfo *block, CardTableScanType scan_type, Scan if (small_objects) { HEAVY_STAT (++scanned_objects); - scan_func (object, sgen_obj_get_descriptor (object), queue); + scan_func (object, sgen_obj_get_descriptor_safe (object), queue); } else { size_t offset = sgen_card_table_get_card_offset (obj, block_start); sgen_cardtable_scan_object (object, block_obj_size, card_base + offset, ctx); |