Skip to content

Commit dcca46b

Browse files
authored
gc: fix conservative GC support (#50533)
Ensure `internal_obj_base_ptr` checks whether objects past freelist pointer are in freelist. Fixes #50434
1 parent 1a7fb51 commit dcca46b

File tree

1 file changed

+17
-3
lines changed

1 file changed

+17
-3
lines changed

src/gc.c

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1242,7 +1242,10 @@ static NOINLINE jl_taggedvalue_t *gc_add_page(jl_gc_pool_t *p) JL_NOTSAFEPOINT
12421242
// in pool_alloc significantly
12431243
jl_ptls_t ptls = jl_current_task->ptls;
12441244
jl_gc_pagemeta_t *pg = pop_page_metadata_back(&ptls->page_metadata_lazily_freed);
1245-
if (pg == NULL) {
1245+
if (pg != NULL) {
1246+
gc_alloc_map_set(pg->data, GC_PAGE_ALLOCATED);
1247+
}
1248+
else {
12461249
pg = jl_gc_alloc_page();
12471250
}
12481251
pg->osize = p->osize;
@@ -1449,6 +1452,7 @@ static jl_taggedvalue_t **gc_sweep_page(jl_gc_pool_t *p, jl_gc_pagemeta_t **allo
14491452
push_page_metadata_back(allocd, pg);
14501453
}
14511454
else if (freed_lazily) {
1455+
gc_alloc_map_set(pg->data, GC_PAGE_LAZILY_FREED);
14521456
push_page_metadata_back(lazily_freed, pg);
14531457
}
14541458
else {
@@ -4027,7 +4031,7 @@ JL_DLLEXPORT jl_value_t *jl_gc_internal_obj_base_ptr(void *p)
40274031
jl_gc_pool_t *pool =
40284032
gc_all_tls_states[meta->thread_n]->heap.norm_pools +
40294033
meta->pool_n;
4030-
if (meta->fl_begin_offset == (uint16_t) -1) {
4034+
if (meta->fl_begin_offset == UINT16_MAX) {
40314035
// case 2: this is a page on the newpages list
40324036
jl_taggedvalue_t *newpages = pool->newpages;
40334037
// Check if the page is being allocated from via newpages
@@ -4069,8 +4073,18 @@ JL_DLLEXPORT jl_value_t *jl_gc_internal_obj_base_ptr(void *p)
40694073
// before the freelist pointer was either live during the last
40704074
// sweep or has been allocated since.
40714075
if (gc_page_data(cell) == gc_page_data(pool->freelist)
4072-
&& (char *)cell < (char *)pool->freelist)
4076+
&& (char *)cell < (char *)pool->freelist) {
40734077
goto valid_object;
4078+
}
4079+
else {
4080+
jl_taggedvalue_t *v = pool->freelist;
4081+
while (v != NULL) {
4082+
if (v == cell) {
4083+
return NULL;
4084+
}
4085+
v = v->next;
4086+
}
4087+
}
40744088
// Not a freelist entry, therefore a valid object.
40754089
valid_object:
40764090
// We have to treat objects with type `jl_buff_tag` differently,

0 commit comments

Comments
 (0)