On Thu, 7 May 2026 08:55:48 GMT, Axel Boldt-Christmas <[email protected]> wrote:
> InlineKlass::initialize_calling_convention has a path which frees the array > after having called `set_extended_sig` without clearing the pointer. This can > cause a double free. > > Looked at other uses of this, and it seems like all other uses of > `extended_sig` are explicitly or implicitly guarded from reading it > incorrectly. > > `InlineKlass::deallocate_contents` will however cause problems. > > By clearing it once it is freed we both remove the use after free and double > free, and will have a nullptr crash incase there is an incorrect use that > pops up later. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). Thanks for the review. ------------- PR Comment: https://git.openjdk.org/valhalla/pull/2408#issuecomment-4404818936
