Commit 8c0bca50 authored by Maged Michael's avatar Maged Michael Committed by Facebook Github Bot

hazptr: Fix null domain_ dereference in ~hazptr_array

Summary: Fix a case of null pointer dereference when ~hazptr_array() calls ~hazptr_holder(). For speed hazptr_array doesn't fill the domain_ field of hazptr_holder. The common case is that elements of the array are taken from and returned to the thread cache. If ~hazptr_array() doesn't find enough space in the thread cache, then it calls ~hazptr_holder() with a null domain_. The fix is to set domain_ to &default_hazptr_domain() before calling ~hazptr_holder() in such a case.

Reviewed By: yfeldblum

Differential Revision: D6928705

fbshipit-source-id: 9c756dce2854a2d1869a0712c4e6ed30f5df6b30
parent 72512e53
......@@ -528,6 +528,7 @@ FOLLY_ALWAYS_INLINE hazptr_holder::hazptr_holder(std::nullptr_t) noexcept {
FOLLY_ALWAYS_INLINE hazptr_holder::~hazptr_holder() {
HAZPTR_DEBUG_PRINT(this);
if (LIKELY(hazptr_ != nullptr)) {
DCHECK(domain_ != nullptr);
hazptr_->clear();
if (LIKELY(
HAZPTR_TC &&
......@@ -713,6 +714,7 @@ FOLLY_ALWAYS_INLINE hazptr_array<M>::~hazptr_array() {
}
// slow path
for (size_t i = 0; i < M; ++i) {
h[i].domain_ = &default_hazptr_domain();
h[i].~hazptr_holder();
}
}
......
......@@ -385,6 +385,32 @@ TEST_F(HazptrTest, Array) {
}
}
TEST_F(HazptrTest, ArrayDtorWithoutSpaceInTCache) {
struct Foo : hazptr_obj_base<Foo> {
int a;
};
{
// Fill the thread cache
hazptr_array<HAZPTR_TC_SIZE> w;
}
{
// Emty array x
hazptr_array<HAZPTR_TC_SIZE> x(nullptr);
{
// y ctor gets elements from the thread cache filled by w dtor.
hazptr_array<HAZPTR_TC_SIZE> y;
// z ctor gets elements from the default domain.
hazptr_array<HAZPTR_TC_SIZE> z;
// Elements of y are moved to x.
x = std::move(y);
// z dtor fills the thread cache.
}
// x dtor finds the thread cache full. It has to call
// ~hazptr_holder() for each of its elements, which were
// previously taken from the thread cache by y ctor.
}
}
TEST_F(HazptrTest, Local) {
struct Foo : hazptr_obj_base<Foo> {
int a;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment