From 469c98066160e682eda0fd2ba7a189e388ab9257 Mon Sep 17 00:00:00 2001 From: Kaz Kylheku Date: Fri, 18 Nov 2011 13:27:18 -0800 Subject: * gc.c (mark_mem_region): Use the Valgrind API only to mark the type field as accessible, not the whole object that we are checking. Marking the whole object accessible hides uninitialized field bugs! * lib.c: And found a bug already: lazy_str was not completely initializing all of the object fields (ls.prefix, ls.list) before invoking memory allocating operations, making it possible for the garbage collector to encounter uninitialized object areas. --- ChangeLog | 13 +++++++++++++ gc.c | 2 +- lib.c | 4 +++- 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 2c819949..5cb9f923 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,16 @@ +2011-11-18 Kaz Kylheku + + * gc.c (mark_mem_region): Use the Valgrind API only to mark + the type field as accessible, not the whole object that + we are checking. Marking the whole object accessible hides + uninitialized field bugs! + + * lib.c: And found a bug already: lazy_str was not completely + initializing all of the object fields (ls.prefix, ls.list) + before invoking memory allocating operations, making it + possible for the garbage collector to encounter uninitialized + object areas. + 2011-11-18 Kaz Kylheku Added a JSON parsing test case. This flushed out a bug which crashed diff --git a/gc.c b/gc.c index 8f1ee6dc..1f31cf54 100644 --- a/gc.c +++ b/gc.c @@ -331,7 +331,7 @@ static void mark_mem_region(val *low, val *high) if (in_heap(maybe_obj)) { #ifdef HAVE_VALGRIND if (opt_vg_debug) - VALGRIND_MAKE_MEM_DEFINED(maybe_obj, sizeof *maybe_obj); + VALGRIND_MAKE_MEM_DEFINED(&maybe_obj->t.type, sizeof maybe_obj->t.type); #endif type_t t = maybe_obj->t.type; if ((t & FREE) == 0) { diff --git a/lib.c b/lib.c index 41bf5e8f..f1079030 100644 --- a/lib.c +++ b/lib.c @@ -1853,7 +1853,9 @@ val lazy_str(val lst, val term, val limit) { val obj = make_obj(); obj->ls.type = LSTR; - obj->ls.opts = nil; /* Must init before calling something that can gc! */ + + /* Must init before calling something that can gc! */ + obj->ls.opts = obj->ls.list = obj->ls.prefix = nil; term = or2(term, string(L"\n")); -- cgit v1.2.3