Attachment 2250 Details for Bug 2116 – Fix accidental double-free in KJS garbage collector

By default, Bugzilla does not search the list of RESOLVED bugs.
You can force it to do so by putting the upper-case word ALL in front of your search query, e.g.: ALL tdelibs
We recommend searching for bugs this way, as you may discover that your bug has already been resolved and fixed in a later release.

[patch] Fix accidental double-free in KJS garbage collector

fix_kjs_double_free.diff (text/plain), 1.26 KB, created by Timothy Pearson on 2014-09-20 01:04:36 CDT

(hide)

Description:

Filename:

MIME Type:

Creator: Timothy Pearson

Created: 2014-09-20 01:04:36 CDT

Size: 1.26 KB

patch

obsolete

>diff --git tdelibs/kjs/collector.cpp tdelibs/kjs/collector.cpp
>index 2ddd635..2f7e0fa 100644
>--- tdelibs/kjs/collector.cpp
>+++ tdelibs/kjs/collector.cpp
>@@ -24,6 +24,7 @@
> #include "value.h"
> #include "internal.h"
> #include <limits.h>
>+#include <typeinfo>
> 
> #ifndef MAX
> #define MAX(a,b) ((a) > (b) ? (a) : (b))
>@@ -121,7 +122,7 @@ void* Collector::allocate(size_t s)
> 
>     if (heap.usedBlocks == heap.numBlocks) {
>       static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
>-      if (heap.numBlocks > maxNumBlocks)
>+      if ((size_t)heap.numBlocks > maxNumBlocks)
>           return 0L;
>       heap.numBlocks = MAX(MIN_ARRAY_SIZE, heap.numBlocks * GROWTH_FACTOR);
>       heap.blocks = (CollectorBlock **)realloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock *));
>@@ -222,6 +223,10 @@ bool Collector::collect()
>       if (!(imp->_flags & ValueImp::VI_DESTRUCTED)) {
> 	if (!imp->refcount && imp->_flags == (ValueImp::VI_GCALLOWED | ValueImp::VI_CREATED)) {
> 	  //fprintf( stderr, "[kjs-collector] Collector::deleting ValueImp %p (%s)\n", (void*)imp, typeid(*imp).name());
>+
>+	  // prevent double free
>+	  imp->_flags |= ValueImp::VI_DESTRUCTED;
>+
> 	  // emulate destructing part of 'operator delete()'
> 	  imp->~ValueImp();
> 	  curBlock->usedCells--;

Actions: View | Diff

Attachments on bug 2116: 2245 | 2250