tgs's gc bug.

R=r
DELTA=10  (7 added, 0 deleted, 3 changed)
OCL=24577
CL=24577

diff --git a/src/runtime/malloc.c b/src/runtime/malloc.c
index ac5de61a5a23ebe224546f45fbbe307e15157150..163ca8c73413213a7835dfa4e27eaf131f5a8a55 100644 (file)
--- a/src/runtime/malloc.c
+++ b/src/runtime/malloc.c
@@ -121,8 +121,8 @@ free(void *v)
 int32
 mlookup(void *v, byte **base, uintptr *size, uint32 **ref)
 {
-       uintptr n, i;
-       byte *p;
+       uintptr n, nobj, i;
+       byte *p, *ep;
        MSpan *s;
 
        s = MHeap_LookupMaybe(&mheap, (uintptr)v>>PageShift);
@@ -148,13 +148,20 @@ mlookup(void *v, byte **base, uintptr *size, uint32 **ref)
                return 1;
        }
 
+       if((byte*)v >= (byte*)s->gcref) {
+               // pointers into the gc ref counts
+               // do not count as pointers.
+               return 0;
+       }
+
        n = class_to_size[s->sizeclass];
        i = ((byte*)v - p)/n;
        if(base)
                *base = p + i*n;
        if(size)
                *size = n;
-       if((byte*)s->gcref < p || (byte*)s->gcref >= p+(s->npages<<PageShift)) {
+       nobj = (s->npages << PageShift) / (n + RefcountOverhead);
+       if((byte*)s->gcref < p || (byte*)(s->gcref+nobj) > p+(s->npages<<PageShift)) {
                printf("s->base sizeclass %d %p gcref %p block %D\n",
                        s->sizeclass, p, s->gcref, s->npages<<PageShift);
                throw("bad gcref");