On Thu, 7 May 2026 08:55:48 GMT, Axel Boldt-Christmas <[email protected]> wrote:
> InlineKlass::initialize_calling_convention has a path which frees the array > after having called `set_extended_sig` without clearing the pointer. This can > cause a double free. > > Looked at other uses of this, and it seems like all other uses of > `extended_sig` are explicitly or implicitly guarded from reading it > incorrectly. > > `InlineKlass::deallocate_contents` will however cause problems. > > By clearing it once it is freed we both remove the use after free and double > free, and will have a nullptr crash incase there is an incorrect use that > pops up later. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). This pull request has now been integrated. Changeset: be1bc9a8 Author: Axel Boldt-Christmas <[email protected]> URL: https://git.openjdk.org/valhalla/commit/be1bc9a823143038e585adfe0bc9a7dfdd61e147 Stats: 1 line in 1 file changed: 1 ins; 0 del; 0 mod 8384079: [lworld] extended_sig may be left as a dangling pointer Reviewed-by: thartmann ------------- PR: https://git.openjdk.org/valhalla/pull/2408
