use-after-free related to GraphKit::clone_map

XMLWordPrintable

    • b11

        See the conversion in https://mail.openjdk.org/pipermail/hotspot-compiler-dev/2023-February/062495.html and its related links.

        GraphKit::clone_map duplicates SafePointNode and additionally calls record_for_igvn. In some cases the cloned map is not used and Node::destruct is called. This results in the now destructed SafePointNode, whose memory was free'd and may have been re-used, being present in Unique_Node_List from for_igvn().

        To resolve this, we need a corresponding function in GraphKit which undoes the work of clone_map(), including removing the node from Unique_Node_List.

              Assignee:
              Justin King
              Reporter:
              Justin King
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: