mirror of
https://gitlab.gnome.org/GNOME/glib.git
synced 2024-12-24 22:46:15 +01:00
408dc69186
The previous g_object_unref() was racy. There were three places where we decremented the ref count, but still accessed the object afterwards (while assuming that somebody else might still hold a reference). For example: if (!g_atomic_int_compare_and_exchange_full ((int *) &object->ref_count, old_ref, old_ref - 1, &old_ref)) continue; TRACE (GOBJECT_OBJECT_UNREF (object, G_TYPE_FROM_INSTANCE (object), old_ref)); /* if we went from 2->1 we need to notify toggle refs if any */ if (old_ref == 2 && OBJECT_HAS_TOGGLE_REF (object)) { /* The last ref being held in this case is owned by the toggle_ref */ toggle_refs_notify (object, TRUE); } After we decrement the reference count (and gave up our reference), we are only allowed to access object if we know we have the only possible reference to it. In particular, if old_ref is larger than 1, then somebody else holds references and races against destroying object. The object might be a dangling pointer already. This is slightly complicated due to toggle references and clearing of weak-locations. For toggle references, we must take a lock on the mutex. Luckily, that is only necessary, when the current reference count is exactly 2. Note that we emit the TRACE() after the ref count was already decreased. If another thread unrefs the object, inside the TRACE() we might have a dangling pointer. That would only be fixable, by emitting the TRACE() before the actual unref (which has its own problems). This problem already existed previously. The change to the test is necessary and correct. Before this patch, g_object_unref() would call dispose() and decrement the reference count right after. In the test case at gobject/tests/reference.c:1108, the reference count after dispose and decrement is 1. Then it thaws the queue notification, which emits a property changed signal. The test then proceeds to reference the object again and notifying the toggle reference. Previously, the toggle reference was notified 3 times. After this change, the property changed signal is emitted before decreasing the reference count. Taking a reference then does not cause an additional toggle on+off, so in total only one toggle happens. That accounts for the change in the test. The new behavior is correct. |
||
---|---|---|
.. | ||
performance | ||
accumulator.c | ||
autoptr.c | ||
basic-signals.c | ||
basics-gobject.c | ||
binding.c | ||
bindinggroup.c | ||
boxed.c | ||
closure-refcount.c | ||
closure.c | ||
custom-dispatch.c | ||
cxx.cpp | ||
defaultiface.c | ||
deftype.c | ||
deprecated-properties.c | ||
dynamictests.c | ||
dynamictype.c | ||
enums.c | ||
flags.c | ||
genmarshal.py | ||
gobject-query.py | ||
ifaceproperties.c | ||
marshalers.list | ||
max-version.c | ||
meson.build | ||
mkenums.py | ||
notify-init2.c | ||
notify-init.c | ||
object.c | ||
objects-refcount1.c | ||
objects-refcount2.c | ||
override.c | ||
param.c | ||
private.c | ||
properties-introspection.c | ||
properties-refcount1.c | ||
properties-refcount2.c | ||
properties-refcount3.c | ||
properties-refcount4.c | ||
properties.c | ||
qdata.c | ||
reference.c | ||
references.c | ||
signal-handler.c | ||
signalgroup.c | ||
signals-refcount.c | ||
signals.c | ||
singleton.c | ||
taptestrunner.py | ||
testcommon.h | ||
testing.c | ||
testmodule.c | ||
testmodule.h | ||
threadtests.c | ||
type-flags.c | ||
type.c | ||
value.c |