InlineKlass::initialize_calling_convention has a path which frees the array 
after having called `set_extended_sig` without clearing the pointer. This can 
cause a double free.

Looked at other uses of this, and it seems like all other uses of 
`extended_sig` are explicitly or implicitly guarded from reading it incorrectly.

`InlineKlass::deallocate_contents` will however cause problems.

By clearing it once it is freed we both remove the use after free and double 
free, and will have a nullptr crash incase there is an incorrect use that pops 
up later.

---------
- [x] I confirm that I make this contribution in accordance with the [OpenJDK 
Interim AI Policy](https://openjdk.org/legal/ai).

-------------

Commit messages:
 - Fix dangling extended_sig pointer

Changes: https://git.openjdk.org/valhalla/pull/2408/files
  Webrev: https://webrevs.openjdk.org/?repo=valhalla&pr=2408&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8384079
  Stats: 1 line in 1 file changed: 1 ins; 0 del; 0 mod
  Patch: https://git.openjdk.org/valhalla/pull/2408.diff
  Fetch: git fetch https://git.openjdk.org/valhalla.git pull/2408/head:pull/2408

PR: https://git.openjdk.org/valhalla/pull/2408

Reply via email to