Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1b07c95b authored by Hans Boehm's avatar Hans Boehm
Browse files

Fix race bug in attemptIncStrong 

The compensating onLastStrongRef call could be made even when there
was no onIncStrongAttempted call to compensate for.  This
happened in the OBJECT_LIFETIME_STRONG case when e.g. curCount
was initially zero, but was concurrently incremented by another
thread.

I believe the old code was also incorrect in the
curCount = INITIAL_STRONG_VALUE + 1 case,
which seems to be possible under unlikely conditions.
In that case, I believe the compensating call IS needed.
Thus the condition was also changed.

Clean cherrypick of 7f27cbc3 from AOSP.

Bug: 30503444
Change-Id: I44bcbcbb1264e4b52b6d3750dc39b041c4140381
parent 0c572d01

libutils/RefBase.cpp

+9 −10
Original line number Diff line number Diff line
@@ -575,17 +575,16 @@ bool RefBase::weakref_type::attemptIncStrong(const void* id) 
            // grab a strong-reference, which is always safe due to the

            // extended life-time.

            curCount = impl->mStrong.fetch_add(1, std::memory_order_relaxed);

        }



            // If the strong reference count has already been incremented by

            // someone else, the implementor of onIncStrongAttempted() is holding

            // an unneeded reference.  So call onLastStrongRef() here to remove it.

            // (No, this is not pretty.)  Note that we MUST NOT do this if we

            // are in fact acquiring the first reference.

        if (curCount > 0 && curCount < INITIAL_STRONG_VALUE) {

            if (curCount != 0 && curCount != INITIAL_STRONG_VALUE) {

                impl->mBase->onLastStrongRef(id);

            }

        }

    }

    

    impl->addStrongRef(id);