RFR: 8302218: CHeapBitMap::free frees with incorrect size

[Daohan Qu]

On Mon, 22 May 2023 16:07:25 GMT, Ioi Lam <iklam at openjdk.org> wrote:

>> Thanks for your review @xmas92.
>> 
>>> Wonder if there is any value in adding a test which lowers ArrayAllocatorMallocLimit to verify that this is working, and that the bug is not reintroduced.
>> 
>> IMHO, exploiting this bug to crack VM is a little bit hard. This bug may cause crash because:
>> 
>> 1. `size_in_bits` is larger than `size_in_words`, which causes `munmap` to unmap more memory regions that what is wanted
>> 2. and following execution may accidentally touch the unmapped regions (this could be hard to trigger)
>> 
>> I think this is a bug that may cause crashes unexpectedly someday and need to be fixed.
>
> @quadhier Do you actually use `ArrayAllocatorMallocLimit` in production? According to comments when this flag was added, it was intended for Solaris only, and the flag has remained an experimental option for the past 10 years.
> 
> I have filed https://bugs.openjdk.org/browse/JDK-8308575 for removing this flag.

Hi, @iklam could you please sponsor this change? Thanks in advance!

-------------

PR Comment: https://git.openjdk.org/jdk/pull/14079#issuecomment-1557540474