Reload: Don't free the saved class table while another thread may be reading it.

runtime/vm/isolate_reload.cc

 // Copyright (c) 2016, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/isolate_reload.h"
 
 #include "vm/become.h"
 #include "vm/bit_vector.h"
 #include "vm/code_generator.h"
 #include "vm/compiler.h"
@@ skipping 906 matching lines @@
   ASSERT(saved_num_cids_ > 0);
   ASSERT(saved_class_table_ != NULL);
   ClassTable* class_table = I->class_table();
   class_table->SetNumCids(saved_num_cids_);
   // Overwrite classes in class table with the saved classes.
   for (intptr_t i = 0; i < saved_num_cids_; i++) {
     if (class_table->IsValidIndex(i)) {
       class_table->SetAt(i, saved_class_table_[i]);
     }
   }
-  free(saved_class_table_);
+
+  RawClass** local_saved_class_table = saved_class_table_;
   saved_class_table_ = NULL;
-  saved_num_cids_ = 0;
+  // Can't free this table immediately as another thread (e.g., the sweeper) may
+  // be suspended between loading the table pointer and loading the table
+  // element. Table will be freed at the next major GC or isolate shutdown.
+  class_table->AddOldTable(local_saved_class_table);

[siva, 2016/08/12 21:10:45]

When does saved_num_cids_ get set to 0?

[rmacnak, 2016/08/12 21:15:29]

Never. We can't set it to zero here because another thread may be suspended
between reading the table pointer and asserting cid < saved_num_cids_.

 }
 
 
 void IsolateReloadContext::RollbackLibraries() {
   TIR_Print("---- ROLLING BACK LIBRARY CHANGES\n");
   Thread* thread = Thread::Current();
   Library& lib = Library::Handle();
   GrowableObjectArray& saved_libs = GrowableObjectArray::Handle(
       Z, saved_libraries());
   if (!saved_libs.IsNull()) {
@@ skipping 721 matching lines @@
         ASSERT(!super_cls.IsNull());
         super_cls.AddDirectSubclass(cls);
       }
     }
   }
 }
 
 #endif  // !PRODUCT
 
 }  // namespace dart