From c2698519b0c60c2c6b0edbcbc2c5859e74d7ad4e Mon Sep 17 00:00:00 2001
From: Zoltan Varga <vargaz@gmail.com>
Date: Wed, 21 Mar 2018 21:25:21 -0400
Subject: [PATCH] [interp] Allocate ThreadContext structures on the heap
 instead of on the stack, the latter doesn't work in mixed mode if the native
 frame gets unwound during exception handling, so the set_context (NULL) call
 is never executed, leaving a dangling ref in the tls variable. (#7747)

---
 mono/mini/interp/interp.c | 24 +++++++-----------------
 mono/mini/mini-runtime.c  |  1 +
 2 files changed, 8 insertions(+), 17 deletions(-)

diff --git a/mono/mini/interp/interp.c b/mono/mini/interp/interp.c
index e8eaa06059c..8c0b903c88f 100644
--- a/mono/mini/interp/interp.c
+++ b/mono/mini/interp/interp.c
@@ -233,6 +233,7 @@ set_context (ThreadContext *context)
 	mono_native_tls_set_value (thread_context_id, context);
 	jit_tls = mono_tls_get_jit_tls ();
 	if (jit_tls)
+		/* jit_tls assumes ownership of 'context' */
 		jit_tls->interp_context = context;
 }
 
@@ -1500,12 +1501,11 @@ static MonoObject*
 interp_runtime_invoke (MonoMethod *method, void *obj, void **params, MonoObject **exc, MonoError *error)
 {
 	InterpFrame frame, *old_frame;
-	ThreadContext * volatile context = mono_native_tls_get_value (thread_context_id);
+	ThreadContext *context = mono_native_tls_get_value (thread_context_id);
 	MonoMethodSignature *sig = mono_method_signature (method);
 	MonoClass *klass = mono_class_from_mono_type (sig->ret);
 	stackval result;
 	stackval *args;
-	ThreadContext context_struct;
 	MonoMethod *target_method = method;
 
 	error_init (error);
@@ -1515,12 +1515,10 @@ interp_runtime_invoke (MonoMethod *method, void *obj, void **params, MonoObject
 	frame.ex = NULL;
 
 	if (context == NULL) {
-		context = &context_struct;
-		memset (context, 0, sizeof (ThreadContext));
+		context = g_new0 (ThreadContext, 1);
 		set_context (context);
-	} else {
-		old_frame = context->current_frame;
 	}
+	old_frame = context->current_frame;
 
 	MonoDomain *domain = mono_domain_get ();
 
@@ -1548,10 +1546,7 @@ interp_runtime_invoke (MonoMethod *method, void *obj, void **params, MonoObject
 
 	interp_exec_method (&frame, context);
 
-	if (context == &context_struct)
-		set_context (NULL);
-	else
-		context->current_frame = old_frame;
+	context->current_frame = old_frame;
 
 	if (frame.ex) {
 		if (exc) {
@@ -1579,7 +1574,6 @@ interp_entry (InterpEntryData *data)
 	InterpFrame frame;
 	InterpMethod *rmethod = data->rmethod;
 	ThreadContext *context = mono_native_tls_get_value (thread_context_id);
-	ThreadContext context_struct;
 	InterpFrame *old_frame;
 	stackval result;
 	stackval *args;
@@ -1597,8 +1591,7 @@ interp_entry (InterpEntryData *data)
 
 	frame.ex = NULL;
 	if (context == NULL) {
-		context = &context_struct;
-		memset (context, 0, sizeof (ThreadContext));
+		context = g_new0 (ThreadContext, 1);
 		set_context (context);
 	} else {
 		old_frame = context->current_frame;
@@ -1652,10 +1645,7 @@ interp_entry (InterpEntryData *data)
 	}
 
 	interp_exec_method (&frame, context);
-	if (context == &context_struct)
-		set_context (NULL);
-	else
-		context->current_frame = old_frame;
+	context->current_frame = old_frame;
 
 	// FIXME:
 	g_assert (frame.ex == NULL);
diff --git a/mono/mini/mini-runtime.c b/mono/mini/mini-runtime.c
index 7b0ac372a36..7b80dc6b454 100644
--- a/mono/mini/mini-runtime.c
+++ b/mono/mini/mini-runtime.c
@@ -939,6 +939,7 @@ free_jit_tls_data (MonoJitTlsData *jit_tls)
 	mono_free_altstack (jit_tls);
 
 	g_free (jit_tls->first_lmf);
+	g_free (jit_tls->interp_context);
 	g_free (jit_tls);
 }
 
-- 
2.11.4.GIT