/* * Copyright 1988, 1989 Hans-J. Boehm, Alan J. Demers * Copyright (c) 1991-1995 by Xerox Corporation. All rights reserved. * Copyright (c) 1997 by Silicon Graphics. All rights reserved. * Copyright (c) 1999-2004 Hewlett-Packard Development Company, L.P. * Copyright (C) 2007 Free Software Foundation, Inc * * THIS MATERIAL IS PROVIDED AS IS, WITH ABSOLUTELY NO WARRANTY EXPRESSED * OR IMPLIED. ANY USE IS AT YOUR OWN RISK. * * Permission is hereby granted to use or copy this program * for any purpose, provided the above notices are retained on all copies. * Permission to modify the code and to distribute modified code is granted, * provided the above notices are retained, and a notice that the code was * modified is included with the above copyright notice.
*/
#include"private/dbg_mlc.h"
#ifndef MSWINCE # include <errno.h> #endif #include <string.h>
#ifndef SHORT_DBG_HDRS /* Check whether object with base pointer p has debugging info. */ /* p is assumed to point to a legitimate object in our part */ /* of the heap. */ /* This excludes the check as to whether the back pointer is */ /* odd, which is added by the GC_HAS_DEBUG_INFO macro. */ /* Note that if DBG_HDRS_ALL is set, uncollectible objects */ /* on free lists may not have debug information set. Thus it's */ /* not always safe to return TRUE (1), even if the client does */ /* its part. Return -1 if the object with debug info has been */ /* marked as deallocated. */
GC_INNER int GC_has_other_debug_info(ptr_t p)
{
ptr_t body = (ptr_t)((oh *)p + 1);
word sz = GC_size(p);
if (HBLKPTR(p) != HBLKPTR((ptr_t)body)
|| sz < DEBUG_BYTES + EXTRA_BYTES) { return 0;
} if (((oh *)p) -> oh_sf != (START_FLAG ^ (word)body)
&& ((word *)p)[BYTES_TO_WORDS(sz)-1] != (END_FLAG ^ (word)body)) { return 0;
} if (((oh *)p)->oh_sz == sz) { /* Object may have had debug info, but has been deallocated */ return -1;
} return 1;
} #endif/* !SHORT_DBG_HDRS */
#ifdef LINT2 long GC_random(void)
{ staticunsigned seed = 1; /* not thread-safe */
/* Linear congruential pseudo-random numbers generator. */
seed = (seed * 1103515245U + 12345) & GC_RAND_MAX; /* overflow is ok */ return (long)seed;
} #endif
/* Store back pointer to source in dest, if that appears to be possible. */ /* This is not completely safe, since we may mistakenly conclude that */ /* dest has a debugging wrapper. But the error probability is very */ /* small, and this shouldn't be used in production code. */ /* We assume that dest is the real base pointer. Source will usually */ /* be a pointer to the interior of an object. */
GC_INNER void GC_store_back_pointer(ptr_t source, ptr_t dest)
{ if (GC_HAS_DEBUG_INFO(dest)) { # ifdef PARALLEL_MARK
AO_store((volatile AO_t *)&((oh *)dest)->oh_back_ptr,
(AO_t)HIDE_BACK_PTR(source)); # else
((oh *)dest) -> oh_back_ptr = HIDE_BACK_PTR(source); # endif
}
}
/* Store information about the object referencing dest in *base_p */ /* and *offset_p. */ /* source is root ==> *base_p = address, *offset_p = 0 */ /* source is heap object ==> *base_p != 0, *offset_p = offset */ /* Returns 1 on success, 0 if source couldn't be determined. */ /* Dest can be any address within a heap object. */
GC_API GC_ref_kind GC_CALL GC_get_back_ptr_info(void *dest, void **base_p,
size_t *offset_p)
{
oh * hdr = (oh *)GC_base(dest);
ptr_t bp;
ptr_t bp_base;
# ifdef LINT2 /* Explicitly instruct the code analysis tool that */ /* GC_get_back_ptr_info is not expected to be called with an */ /* incorrect "dest" value. */ if (!hdr) ABORT("Invalid GC_get_back_ptr_info argument"); # endif if (!GC_HAS_DEBUG_INFO((ptr_t) hdr)) return GC_NO_SPACE;
bp = (ptr_t)GC_REVEAL_POINTER(hdr -> oh_back_ptr); if (MARKED_FOR_FINALIZATION == bp) return GC_FINALIZER_REFD; if (MARKED_FROM_REGISTER == bp) return GC_REFD_FROM_REG; if (NOT_MARKED == bp) return GC_UNREFERENCED; # if ALIGNMENT == 1 /* Heuristically try to fix off by 1 errors we introduced by */ /* insisting on even addresses. */
{
ptr_t alternate_ptr = bp + 1;
ptr_t target = *(ptr_t *)bp;
ptr_t alternate_target = *(ptr_t *)alternate_ptr;
/* Generate a random heap address. */ /* The resulting address is in the heap, but */ /* not necessarily inside a valid object. */
GC_API void * GC_CALL GC_generate_random_heap_address(void)
{
size_t i;
word heap_offset = RANDOM();
if (GC_heapsize > GC_RAND_MAX) {
heap_offset *= GC_RAND_MAX;
heap_offset += RANDOM();
}
heap_offset %= GC_heapsize; /* This doesn't yield a uniform distribution, especially if */ /* e.g. RAND_MAX = 1.5* GC_heapsize. But for typical cases, */ /* it's not too bad. */ for (i = 0;; ++i) {
size_t size;
if (i >= GC_n_heap_sects)
ABORT("GC_generate_random_heap_address: size inconsistency");
/* Generate a random address inside a valid marked heap object. */
GC_API void * GC_CALL GC_generate_random_valid_address(void)
{
ptr_t result;
ptr_t base; do {
result = (ptr_t)GC_generate_random_heap_address();
base = (ptr_t)GC_base(result);
} while (NULL == base || !GC_is_marked(base)); return result;
}
/* Print back trace for p */
GC_API void GC_CALL GC_print_backtrace(void *p)
{ void *current = p; int i;
GC_ref_kind source;
size_t offset; void *base;
GC_print_heap_obj((ptr_t)GC_base(current));
for (i = 0; ; ++i) {
source = GC_get_back_ptr_info(current, &base, &offset); if (GC_UNREFERENCED == source) {
GC_err_printf("Reference could not be found\n"); goto out;
} if (GC_NO_SPACE == source) {
GC_err_printf("No debug info in object: Can't find reference\n"); goto out;
}
GC_err_printf("Reachable via %d levels of pointers from ", i); switch(source) { case GC_REFD_FROM_ROOT:
GC_err_printf("root at %p\n\n", base); goto out; case GC_REFD_FROM_REG:
GC_err_printf("root in register\n\n"); goto out; case GC_FINALIZER_REFD:
GC_err_printf("list of finalizable objects\n\n"); goto out; case GC_REFD_FROM_HEAP:
GC_err_printf("offset %ld in object:\n", (long)offset); /* Take GC_base(base) to get real base, i.e. header. */
GC_print_heap_obj((ptr_t)GC_base(base)); break; default:
GC_err_printf("INTERNAL ERROR: UNEXPECTED SOURCE!!!!\n"); goto out;
}
current = base;
}
out:;
}
if (GC_try_to_collect(GC_never_stop_func) == 0) {
GC_err_printf("Cannot generate a backtrace: " "garbage collection is disabled!\n"); return;
}
/* Generate/print a backtrace from a random heap address. */
LOCK();
current = GC_generate_random_valid_address();
UNLOCK();
GC_printf("\n****Chosen address %p in object\n", current);
GC_print_backtrace(current);
}
/* Check the allocation is successful, store debugging info into p, */ /* start the debugging mode (if not yet), and return displaced pointer. */ staticvoid *store_debug_info(void *p, size_t lb, constchar *fn, GC_EXTRA_PARAMS)
{ void *result;
DCL_LOCK_STATE;
/* Print a human-readable description of the object to stderr. */ /* p points to somewhere inside an object with the debugging info. */ STATICvoid GC_print_obj(ptr_t p)
{
oh * ohdr = (oh *)GC_base(p);
ptr_t q;
hdr * hhdr; int kind; constchar *kind_str; char buffer[GC_TYPE_DESCR_LEN + 1];
q = (ptr_t)(ohdr + 1); /* Print a type description for the object whose client-visible */ /* address is q. */
hhdr = GC_find_header(q);
kind = hhdr -> hb_obj_kind; if (0 != GC_describe_type_fns[kind] && GC_is_marked(ohdr)) { /* This should preclude free list objects except with */ /* thread-local allocation. */
buffer[GC_TYPE_DESCR_LEN] = 0;
(GC_describe_type_fns[kind])(q, buffer);
GC_ASSERT(buffer[GC_TYPE_DESCR_LEN] == 0);
kind_str = buffer;
} else { switch(kind) { case PTRFREE:
kind_str = "PTRFREE"; break; case NORMAL:
kind_str = "NORMAL"; break; case UNCOLLECTABLE:
kind_str = "UNCOLLECTABLE"; break; # ifdef GC_ATOMIC_UNCOLLECTABLE case AUNCOLLECTABLE:
kind_str = "ATOMIC_UNCOLLECTABLE"; break; # endif default:
kind_str = NULL; /* The alternative is to use snprintf(buffer) but it is */ /* not quite portable (see vsnprintf in misc.c). */
}
}
#ifndef SHORT_DBG_HDRS /* Use GC_err_printf and friends to print a description of the object */ /* whose client-visible address is p, and which was smashed at */ /* clobbered_addr. */ STATICvoid GC_print_smashed_obj(constchar *msg, void *p,
ptr_t clobbered_addr)
{
oh * ohdr = (oh *)GC_base(p);
GC_ASSERT(I_DONT_HOLD_LOCK()); # ifdef LINT2 if (!ohdr) ABORT("Invalid GC_print_smashed_obj argument"); # endif if ((word)clobbered_addr <= (word)(&ohdr->oh_sz)
|| ohdr -> oh_string == 0) {
GC_err_printf( "%s %p in or near object at %p(, appr. sz= %lu)\n",
msg, (void *)clobbered_addr, p,
(unsignedlong)(GC_size((ptr_t)ohdr) - DEBUG_BYTES));
} else {
GC_err_printf("%s %p in or near object at %p (%s:%d, sz= %lu)\n",
msg, (void *)clobbered_addr, p,
(word)(ohdr -> oh_string) < HBLKSIZE ? "(smashed string)" :
ohdr -> oh_string[0] == '\0' ? "EMPTY(smashed?)" :
ohdr -> oh_string,
GET_OH_LINENUM(ohdr), (unsignedlong)(ohdr -> oh_sz));
PRINT_CALL_CHAIN(ohdr);
}
}
/* Note that according to malloc() specification, if size is 0 then */ /* malloc() returns either NULL, or a unique pointer value that can */ /* later be successfully passed to free(). We always do the latter. */ # ifdefined(_FORTIFY_SOURCE) && !defined(__clang__) /* Workaround to avoid "exceeds maximum object size" gcc warning. */
result = GC_malloc(lb < GC_SIZE_MAX - DEBUG_BYTES ? lb + DEBUG_BYTES
: GC_SIZE_MAX >> 1); # else
result = GC_malloc(SIZET_SAT_ADD(lb, DEBUG_BYTES)); # endif # ifdef GC_ADD_CALLER if (s == NULL) {
GC_caller_func_offset(ra, &s, &i);
} # endif return store_debug_info(result, lb, "GC_debug_malloc", OPT_RA s, i);
}
#ifdef DBG_HDRS_ALL /* An allocation function for internal use. Normally internally */ /* allocated objects do not have debug information. But in this */ /* case, we need to make sure that all objects have debug headers. */
GC_INNER void * GC_debug_generic_malloc_inner(size_t lb, int k)
{ void * result;
base = (ptr_t)GC_base(p); if (NULL == base) { # ifdefined(REDIRECT_MALLOC) \
&& ((defined(NEED_CALLINFO) && defined(GC_HAVE_BUILTIN_BACKTRACE)) \
|| defined(GC_LINUX_THREADS) || defined(GC_SOLARIS_THREADS) \
|| defined(MSWIN32)) /* In some cases, we should ignore objects that do not belong */ /* to the GC heap. See the comment in GC_free. */ if (!GC_is_heap_ptr(p)) return; # endif
ABORT_ARG1("Invalid pointer passed to free()", ": %p", p);
} if ((ptr_t)p - (ptr_t)base != sizeof(oh)) { # ifdefined(REDIRECT_FREE) && defined(USE_PROC_FOR_LIBRARIES) /* TODO: Suppress the warning if free() caller is in libpthread */ /* or libdl. */ # endif
GC_err_printf( "GC_debug_free called on pointer %p w/o debugging info\n", p);
} else { # ifndef SHORT_DBG_HDRS
ptr_t clobbered = GC_check_annotated_obj((oh *)base);
word sz = GC_size(base); if (clobbered != 0) {
GC_SET_HAVE_ERRORS(); /* no "release" barrier is needed */ if (((oh *)base) -> oh_sz == sz) {
GC_print_smashed_obj( "GC_debug_free: found previously deallocated (?) object at",
p, clobbered); return; /* ignore double free */
} else {
GC_print_smashed_obj("GC_debug_free: found smashed location at",
p, clobbered);
}
} /* Invalidate size (mark the object as deallocated) */
((oh *)base) -> oh_sz = sz; # endif /* !SHORT_DBG_HDRS */
} if (GC_find_leak # ifndef SHORT_DBG_HDRS
&& ((ptr_t)p - (ptr_t)base != sizeof(oh) || !GC_findleak_delay_free) # endif
) {
GC_free(base);
} else {
hdr * hhdr = HDR(p); if (hhdr -> hb_obj_kind == UNCOLLECTABLE # ifdef GC_ATOMIC_UNCOLLECTABLE
|| hhdr -> hb_obj_kind == AUNCOLLECTABLE # endif
) {
GC_free(base);
} else {
word i;
word sz = hhdr -> hb_sz;
word obj_sz = BYTES_TO_WORDS(sz - sizeof(oh));
for (i = 0; i < obj_sz; ++i)
((word *)p)[i] = GC_FREED_MEM_MARKER;
GC_ASSERT((word *)p + i == (word *)(base + sz)); /* Update the counter even though the real deallocation */ /* is deferred. */
LOCK();
GC_bytes_freed += sz;
UNLOCK();
}
} /* !GC_find_leak */
}
/* List of smashed (clobbered) locations. We defer printing these, */ /* since we can't always print them nicely with the allocation lock */ /* held. We put them here instead of in GC_arrays, since it may be */ /* useful to be able to look at them with the debugger. */ #ifndef MAX_SMASHED # define MAX_SMASHED 20 #endif STATIC ptr_t GC_smashed[MAX_SMASHED] = {0}; STATICunsigned GC_n_smashed = 0;
STATICvoid GC_add_smashed(ptr_t smashed)
{
GC_ASSERT(GC_is_marked(GC_base(smashed))); /* FIXME: Prevent adding an object while printing smashed list. */
GC_smashed[GC_n_smashed] = smashed; if (GC_n_smashed < MAX_SMASHED - 1) ++GC_n_smashed; /* In case of overflow, we keep the first MAX_SMASHED-1 */ /* entries plus the last one. */
GC_SET_HAVE_ERRORS();
}
/* Print all objects on the list. Clear the list. */ STATICvoid GC_print_all_smashed_proc(void)
{ unsigned i;
GC_ASSERT(I_DONT_HOLD_LOCK()); if (GC_n_smashed == 0) return;
GC_err_printf("GC_check_heap_block: found %u smashed heap objects:\n",
GC_n_smashed); for (i = 0; i < GC_n_smashed; ++i) {
ptr_t base = (ptr_t)GC_base(GC_smashed[i]);
/* Check all marked objects in the given block for validity */ /* Avoid GC_apply_to_each_object for performance reasons. */ STATICvoid GC_check_heap_block(struct hblk *hbp, word dummy GC_ATTR_UNUSED)
{ struct hblkhdr * hhdr = HDR(hbp);
word sz = hhdr -> hb_sz;
word bit_no; char *p, *plim;
p = hbp->hb_body; if (sz > MAXOBJBYTES) {
plim = p;
} else {
plim = hbp->hb_body + HBLKSIZE - sz;
} /* go through all words in block */ for (bit_no = 0; (word)p <= (word)plim;
bit_no += MARK_BIT_OFFSET(sz), p += sz) { if (mark_bit_from_hdr(hhdr, bit_no) && GC_HAS_DEBUG_INFO((ptr_t)p)) {
ptr_t clobbered = GC_check_annotated_obj((oh *)p); if (clobbered != 0)
GC_add_smashed(clobbered);
}
}
}
/* This assumes that all accessible objects are marked, and that */ /* I hold the allocation lock. Normally called by collector. */ STATICvoid GC_check_heap_proc(void)
{
GC_STATIC_ASSERT((sizeof(oh) & (GRANULE_BYTES - 1)) == 0); /* FIXME: Should we check for twice that alignment? */
GC_apply_to_all_blocks(GC_check_heap_block, 0);
}
GC_INNER GC_bool GC_check_leaked(ptr_t base)
{
word i;
word obj_sz;
word *p;
/* Validate freed object's content. */
p = (word *)(base + sizeof(oh));
obj_sz = BYTES_TO_WORDS(HDR(base)->hb_sz - sizeof(oh)); for (i = 0; i < obj_sz; ++i) if (p[i] != GC_FREED_MEM_MARKER) {
GC_set_mark_bit(base); /* do not reclaim it in this cycle */
GC_add_smashed((ptr_t)(&p[i])); /* alter-after-free detected */ break; /* don't report any other smashed locations in the object */
}
returnFALSE; /* GC_debug_free() has been called */
}
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung ist noch experimentell.