Remove unprotected reads in the instance counting routines.
In the past, the instance counters would read the live bitmap, acquire
the heap lock, and then scan the live bitmap. Reading the live bitmap
ahead of acquiring the heap lock gives the holder of the heap lock an
opportunity to invalidate the copy of the live bitmap read by the
instance counter routine. For example, the garbage collector could
swap the mark and live bitmaps before releasing the heap lock. This
change makes the read of the live bitmap safe by moving it into the
critical section.
Bug: 3271510
Change-Id: Ic02171e9ec3b4d24e83773199f00a18a75707427
diff --git a/vm/alloc/Alloc.c b/vm/alloc/Alloc.c
index 629dc45..9ea92b6 100644
--- a/vm/alloc/Alloc.c
+++ b/vm/alloc/Alloc.c
@@ -325,8 +325,8 @@
size_t dvmCountInstancesOfClass(const ClassObject *clazz)
{
CountContext ctx = { clazz, 0 };
- HeapBitmap *bitmap = dvmHeapSourceGetLiveBits();
dvmLockHeap();
+ HeapBitmap *bitmap = dvmHeapSourceGetLiveBits();
dvmHeapBitmapWalk(bitmap, countInstancesOfClassCallback, &ctx);
dvmUnlockHeap();
return ctx.count;
@@ -346,8 +346,8 @@
size_t dvmCountAssignableInstancesOfClass(const ClassObject *clazz)
{
CountContext ctx = { clazz, 0 };
- HeapBitmap *bitmap = dvmHeapSourceGetLiveBits();
dvmLockHeap();
+ HeapBitmap *bitmap = dvmHeapSourceGetLiveBits();
dvmHeapBitmapWalk(bitmap, countAssignableInstancesOfClassCallback, &ctx);
dvmUnlockHeap();
return ctx.count;
