Skip to content

Commit

Permalink
Properly mark a deleted typemap entry
Browse files Browse the repository at this point in the history
This issue possibly fixes #24951 (or at least the test case by iamed2).
We believe the original code here meant to say either:

    ((jl_typemap_entry_t*)v)->min_world = ((jl_typemap_entry_t*)v)->max_world + 1;

or

    ((jl_typemap_entry_t*)v)->max_world = ((jl_typemap_entry_t*)v)->min_world - 1;

i.e. set the range of applicable worlds to be empty. What happened instead
was that the given typemap entry that was supposed to be deleted became valid
for one particular world and that world only. Thus any code running in that
particular world may try to access the deleted typemap entry (or add a backedge
to it), causing either incorrect behavior or the assertion failure noted
in the issue. One additional complication is that these world ages are being
deserialized, i.e. they may be larger than the currently possible max world age.
This makes this slightly more likely to happen, since the current process
may work its way up to that world age and exectue some code.

In any case, there's not much value to keeping around the deserialized max or min
world, so just mark them as 1:0, as we do for other deleted entries.

Co-authored-by: Jameson Nash <jameson@juliacomputing.com>
  • Loading branch information
Keno and Jameson Nash committed Jun 14, 2018
1 parent c8f034c commit 85480dd
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion src/dump.c
Original file line number Diff line number Diff line change
Expand Up @@ -1795,7 +1795,8 @@ static void jl_deserialize_struct(jl_serializer_state *s, jl_value_t *v, size_t
}
else {
// garbage entry - delete it :(
((jl_typemap_entry_t*)v)->min_world = ((jl_typemap_entry_t*)v)->max_world - 1;
((jl_typemap_entry_t*)v)->min_world = 1;
((jl_typemap_entry_t*)v)->max_world = 0;
}
}
}
Expand Down

0 comments on commit 85480dd

Please sign in to comment.