[Gc] Large offset in negative GC_DS_PER_OBJECT descriptors can lead to arbitrary data being misinterpreted as type descriptors (#92)
(too old to reply)
Ivan Maidanski
2017-01-11 18:13:20 UTC
Hello Hans,

Could you please also comment on https://github.com/ivmai/bdwgc/pull/92 ?
I have merged this pull about a year ago but yesterday I found that it breaks gctest on Win32 (with some configuration options).
See my comment on Github for the details.

Wouldn't this problem be avoided if objects in the free lists had their mark bits set at the start of a GC? In this case free list objects object would not even be examined for the non-existant descriptor so there is no possibility of mistaking the next link as one.
If thread-local allocation is enabled and the world is stopped then thread local free lists are marked before collection: mark_rts.c:815 GC_push_roots()
There is a comment that this is unsafe if the world is not stopped. I'm not immediately sure why.
If GC_find_leak is enabled then all free lists are marked at the end of a collection: alloc.c:930 GC_finish_collection()
In my modified BDWGC for AlcheMo I marked all the free lists immediately after GC_clear_marks() in alloc.c:483 GC_try_to_collect_inner(). This worked great, but I wasn't using incremental collection. I'm not immediately sure if that's a problem. (I've never used or thought hard about incremental collection)

Continue reading on narkive: