svn commit: r1818584 - /subversion/trunk/subversion/libsvn_subr/object_pool.c

[st...@apache.org]

Author: stefan2
Date: Mon Dec 18 15:31:59 2017
New Revision: 1818584

URL: http://svn.apache.org/viewvc?rev=1818584&view=rev
Log:
Fix a refcounting / cleanup race in svn_object_pool causing crashes when
exiting svnserve while using the --config-file option.

This patch has been outstandig for a while:
https://lists.apache.org/thread.html/41ca5579bf7add3cb751234ea039fda531c1d22ffbed8cb2ec699e42@%3Cdev.subversion.apache.org%3E

* subversion/libsvn_subr/object_pool.c
  (add_object_ref):  If items of the container are being hold by parent pools
                     of the container pool, ref counting updates would come
                     too late if run during pool cleanup.  Instead, run them
                     in pre-cleanup.

Modified:
    subversion/trunk/subversion/libsvn_subr/object_pool.c

Modified: subversion/trunk/subversion/libsvn_subr/object_pool.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_subr/object_pool.c?rev=1818584&r1=1818583&r2=1818584&view=diff
==============================================================================
--- subversion/trunk/subversion/libsvn_subr/object_pool.c (original)
+++ subversion/trunk/subversion/libsvn_subr/object_pool.c Mon Dec 18 15:31:59 2017
@@ -172,9 +172,11 @@ add_object_ref(object_ref_t *object_ref,
   if (svn_atomic_inc(&object_ref->ref_count) == 0)
     svn_atomic_dec(&object_ref->object_pool->unused_count);
 
-  /* make sure the reference gets released automatically */
-  apr_pool_cleanup_register(pool, object_ref, object_ref_cleanup,
-                            apr_pool_cleanup_null);
+  /* Make sure the reference gets released automatically.
+     Since POOL might be a parent pool of OBJECT_REF->OBJECT_POOL,
+     to the reference counting update before destroing any of the
+     pool hierarchy. */
+  apr_pool_pre_cleanup_register(pool, object_ref, object_ref_cleanup);
 }
 
 /* Actual implementation of svn_object_pool__lookup.