john/cell
1
0
Fork 0
Code Issues 31 Pull Requests Packages Projects Releases 2 Wiki Activity

fix poison heap

Browse Source
This commit is contained in:
John Alanbrook
2026-02-03 02:06:29 -06:00
parent 3e40885e07
commit a80557283a
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
source/quickjs.c
View File

@@ -82,7 +82,7 @@
*/ */
// #define DUMP_BYTECODE (1) // #define DUMP_BYTECODE (1)
/* dump GC summary: old/new heap, recovery %, heap growth */ /* dump GC summary: old/new heap, recovery %, heap growth */
// #define DUMP_GC #define DUMP_GC
/* dump detailed GC: roots, scanning, object traversal (implies DUMP_GC) */ /* dump detailed GC: roots, scanning, object traversal (implies DUMP_GC) */
// #define DUMP_GC_DETAIL // #define DUMP_GC_DETAIL
#ifdef DUMP_GC_DETAIL #ifdef DUMP_GC_DETAIL
@@ -99,6 +99,7 @@
/* test the GC by forcing it before each object allocation */ /* test the GC by forcing it before each object allocation */
// #define FORCE_GC_AT_MALLOC // #define FORCE_GC_AT_MALLOC
#define POISON_HEAP
/* POISON_HEAP: Use ASan's memory poisoning to detect stale pointer access */ /* POISON_HEAP: Use ASan's memory poisoning to detect stale pointer access */
#ifdef POISON_HEAP #ifdef POISON_HEAP
#if defined(__has_feature) #if defined(__has_feature)
@@ -2504,11 +2505,11 @@ static int ctx_gc (JSContext *ctx) {
scan += obj_size; scan += obj_size;
} }
/* Return old block to buddy allocator */ /* Return old block to buddy allocator, then poison to catch stale accesses */
buddy_free (&rt->buddy, from_base, old_heap_size);
#ifdef POISON_HEAP #ifdef POISON_HEAP
gc_poison_region(from_base, old_heap_size); gc_poison_region(from_base, old_heap_size);
#endif #endif
buddy_free (&rt->buddy, from_base, old_heap_size);
/* Update context with new block */ /* Update context with new block */
size_t new_used = to_free - to_base; size_t new_used = to_free - to_base;

9
source/suite.c
View File

@@ -500,10 +500,15 @@ TEST(array_mixed_types) {
} }
TEST(array_many_elements_resize) { TEST(array_many_elements_resize) {
JSValue arr = JS_NewArray(ctx); JSGCRef arr_ref;
JSValue *arr_ptr = JS_AddGCRef(ctx, &arr_ref);
*arr_ptr = JS_NewArray(ctx);
for (int i = 0; i < 1000; i++) { for (int i = 0; i < 1000; i++) {
JS_ArrayPush(ctx, &arr, JS_NewInt32(ctx, i)); JS_ArrayPush(ctx, arr_ptr, JS_NewInt32(ctx, i));
} }
JSValue arr = *arr_ptr;
JS_DeleteGCRef(ctx, &arr_ref);
int64_t len; int64_t len;
JS_GetLength(ctx, arr, &len); JS_GetLength(ctx, arr, &len);