From 3ca0cf6a68c9eab7668be14d2b07645277f8b833 Mon Sep 17 00:00:00 2001
From: Jason Evans <jasone@canonware.com>
Date: Thu, 17 Sep 2015 14:47:39 -0700
Subject: [PATCH] Fix prof_alloc_rollback().

Fix prof_alloc_rollback() to read tdata from thread-specific data rather
than dereferencing a potentially invalid tctx.
---
 ChangeLog  | 2 ++
 src/prof.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index b5e10c49..fb376b26 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,8 @@ brevity.  Much more detail can be found in the git revision history:
     so this fix removes buggy code without loss of generality.
   - Fix irallocx_prof_sample() to always allocate large regions, even when
     alignment is non-zero.
+  - Fix prof_alloc_rollback() to read tdata from thread-specific data rather
+    than dereferencing a potentially invalid tctx.
 
 * 4.0.1 (September 15, 2015)
 
diff --git a/src/prof.c b/src/prof.c
index d68478fd..0a08062c 100644
--- a/src/prof.c
+++ b/src/prof.c
@@ -209,7 +209,7 @@ prof_alloc_rollback(tsd_t *tsd, prof_tctx_t *tctx, bool updated)
 		 */
 		tdata = prof_tdata_get(tsd, true);
 		if (tdata != NULL)
-			prof_sample_threshold_update(tctx->tdata);
+			prof_sample_threshold_update(tdata);
 	}
 
 	if ((uintptr_t)tctx > (uintptr_t)1U) {