From fe2feb978e0c4324047f749c3fcfb9cecaafcfdc Mon Sep 17 00:00:00 2001 From: Austin Clements Date: Mon, 17 Dec 2018 13:45:14 -0500 Subject: [PATCH] runtime: poison the write barrier buffer during flushing Currently we reset the write barrier buffer before processing the pointers in it. As a result, if there were any write barriers in the code that processes the buffer, it would corrupt the write barrier buffer and cause us to mark objects without later scanning them. As far as I can tell, this shouldn't be happening, but rather than relying on hope (and incomplete static analysis), this CL changes wbBufFlush1 to poison the write barrier buffer while processing it, and only reset it once it's done. Updates #27993. (Unlike many of the other changes for this issue, there's no need to roll back this CL. It's a good change in its own right.) Change-Id: I6d2d9f1b69b89438438b9ee624f3fff9f009e29d Reviewed-on: https://go-review.googlesource.com/c/154537 Run-TryBot: Austin Clements TryBot-Result: Gobot Gobot Reviewed-by: Michael Knyszek --- src/runtime/mwbbuf.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/runtime/mwbbuf.go b/src/runtime/mwbbuf.go index a698493a0a2..6f01bf68fdb 100644 --- a/src/runtime/mwbbuf.go +++ b/src/runtime/mwbbuf.go @@ -217,14 +217,16 @@ func wbBufFlush1(_p_ *p) { n := (_p_.wbBuf.next - start) / unsafe.Sizeof(_p_.wbBuf.buf[0]) ptrs := _p_.wbBuf.buf[:n] - // Reset the buffer. - _p_.wbBuf.reset() + // Poison the buffer to make extra sure nothing is enqueued + // while we're processing the buffer. + _p_.wbBuf.next = 0 if useCheckmark { // Slow path for checkmark mode. for _, ptr := range ptrs { shade(ptr) } + _p_.wbBuf.reset() return } @@ -275,4 +277,6 @@ func wbBufFlush1(_p_ *p) { // Enqueue the greyed objects. gcw.putBatch(ptrs[:pos]) + + _p_.wbBuf.reset() }