[qpid-dispatch] branch master updated: DISPATCH-1309 - Move the decrement of the content ref-count below the buffer-trimming logic in qd_message_free. This eliminates the case where message content can be freed by one thread while another is doing buffer-trimming on the same content.

[tr...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

tross pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/qpid-dispatch.git


The following commit(s) were added to refs/heads/master by this push:
     new c27d73b  DISPATCH-1309 - Move the decrement of the content ref-count below the buffer-trimming logic in qd_message_free.  This eliminates the case where message content can be freed by one thread while another is doing buffer-trimming on the same content.
c27d73b is described below

commit c27d73b188fcf0a311b1c1d69e21cb9f4c58172d
Author: Ted Ross <tr...@redhat.com>
AuthorDate: Mon Apr 8 16:08:51 2019 -0400

    DISPATCH-1309 - Move the decrement of the content ref-count below the buffer-trimming logic in qd_message_free.  This eliminates the case where message content can be freed by one thread while another is doing buffer-trimming on the same content.
---
 src/message.c | 45 +++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/src/message.c b/src/message.c
index 1b3363e..c9ff14e 100644
--- a/src/message.c
+++ b/src/message.c
@@ -927,8 +927,29 @@ void qd_message_free(qd_message_t *in_msg)
 
     qd_message_content_t *content = msg->content;
 
-    rc = sys_atomic_dec(&content->ref_count) - 1;
+    if (msg->is_fanout) {
+        //
+        // Adjust the content's fanout count and decrement all buffer fanout
+        // counts starting with the msg cursor.  If the buffer count drops to
+        // zero we can free it.
+        //
+        LOCK(content->lock);
+
+        qd_buffer_t *buf = msg->cursor.buffer;
+        while (buf) {
+            qd_buffer_t *next_buf = DEQ_NEXT(buf);
+            if (qd_buffer_dec_fanout(buf) == 1) {
+                DEQ_REMOVE(content->buffers, buf);
+                qd_buffer_free(buf);
+            }
+            buf = next_buf;
+        }
+        --content->fanout;
 
+        UNLOCK(content->lock);
+    }
+
+    rc = sys_atomic_dec(&content->ref_count) - 1;
     if (rc == 0) {
         if (content->ma_field_iter_in)
             qd_iterator_free(content->ma_field_iter_in);
@@ -948,28 +969,8 @@ void qd_message_free(qd_message_t *in_msg)
 
         sys_mutex_free(content->lock);
         free_qd_message_content_t(content);
-
-    } else if (msg->is_fanout) {
-        //
-        // Adjust the content's fanout count and decrement all buffer fanout
-        // counts starting with the msg cursor.  If the buffer count drops to
-        // zero we can free it.
-        //
-        LOCK(content->lock);
-
-        qd_buffer_t *buf = msg->cursor.buffer;
-        while (buf) {
-            qd_buffer_t *next_buf = DEQ_NEXT(buf);
-            if (qd_buffer_dec_fanout(buf) == 1) {
-                DEQ_REMOVE(content->buffers, buf);
-                qd_buffer_free(buf);
-            }
-            buf = next_buf;
-        }
-        --content->fanout;
-
-        UNLOCK(content->lock);
     }
+
     free_qd_message_t((qd_message_t*) msg);
 }
 


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org