Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8302595

use-after-free related to GraphKit::clone_map

    XMLWordPrintable

Details

    • b11

    Backports

      Description

        See the conversion in https://mail.openjdk.org/pipermail/hotspot-compiler-dev/2023-February/062495.html and its related links.

        GraphKit::clone_map duplicates SafePointNode and additionally calls record_for_igvn. In some cases the cloned map is not used and Node::destruct is called. This results in the now destructed SafePointNode, whose memory was free'd and may have been re-used, being present in Unique_Node_List from for_igvn().

        To resolve this, we need a corresponding function in GraphKit which undoes the work of clone_map(), including removing the node from Unique_Node_List.

        Attachments

          Issue Links

            Activity

              People

                jcking Justin King
                jcking Justin King
                Votes:
                0 Vote for this issue
                Watchers:
                7 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved: