Integrated: 8302218: CHeapBitMap::free frees with incorrect size

[Daohan Qu]

On Mon, 22 May 2023 12:04:58 GMT, Daohan Qu <duke at openjdk.org> wrote:

> This patch should fix [JDK-8302218](https://bugs.openjdk.org/browse/JDK-8302218).
> 
> In destructor of `CHeapBitMap`, it invokes `free()` to free allocated memory:
> https://github.com/openjdk/jdk/blob/b3cb82b859d22b18343d125349a5aebc0afb8576/src/hotspot/share/utilities/bitMap.cpp#L133-L135
> 
> `free()`'s argument should be size in words, according to:
> https://github.com/openjdk/jdk/blob/b3cb82b859d22b18343d125349a5aebc0afb8576/src/hotspot/share/utilities/bitMap.cpp#L141-L143
> 
> But the destructor pass the argument of `size()` (which returns `_size`). It is "size in bits" according to
> https://github.com/openjdk/jdk/blob/b3cb82b859d22b18343d125349a5aebc0afb8576/src/hotspot/share/utilities/bitMap.hpp#L63-L65
> 
> Instead, it should use the return value of `size_in_words()` to invoke `free()`.
> 
> Once `ArrayAllocatorMallocLimit` option is set, `munmap()` may be used by `free()`, which does use the size argument and this may cause crash.
> 
> I have tested this patch for tier 1-3 on x86-64 linux.

This pull request has now been integrated.

Changeset: f99ad11d
Author:    quadhier <quadhier at 163.com>
Committer: Ioi Lam <iklam at openjdk.org>
URL:       https://git.openjdk.org/jdk/commit/f99ad11dd11a4d83e5227b246866822e69b38ae7
Stats:     1 line in 1 file changed: 0 ins; 0 del; 1 mod

8302218: CHeapBitMap::free frees with incorrect size

Reviewed-by: aboldtch, iklam, tschatzl

-------------

PR: https://git.openjdk.org/jdk/pull/14079