[gc] Fix crash when doing WaitForPendingFinalizers
authorLudovic Henry <ludovic@xamarin.com>
Sun, 7 Aug 2016 11:45:56 +0000 (13:45 +0200)
committerLudovic Henry <ludovic@xamarin.com>
Sun, 7 Aug 2016 11:45:56 +0000 (13:45 +0200)
commitdf3278863addd5fccec504b22bf59f33989011ca
treef324578f7b1f3eade6698ec8db20a0ee8e139d54
parent8194bea584317323bb7d44b0bdd3d8aa151a0498
[gc] Fix crash when doing WaitForPendingFinalizers

The crash would come from a use-after-free of stack memory: in coop_cond_timedwait_alertable, we would allocate the struct we pass to the mono_thread_info_install_interrupt function on the stack. But there is no guarantee as to when break_coop_alertable_wait is run. The fix is to allocate the data passed to mono_thread_info_install_interrupt on the heap, and free it in the callback, or if it hasn't been interrupted.
mono/metadata/gc.c