diff options
author | Peter Seiderer <ps.report@gmx.net> | 2013-06-17 20:56:08 +0200 |
---|---|---|
committer | The Qt Project <gerrit-noreply@qt-project.org> | 2013-07-29 22:28:41 +0200 |
commit | 72ecf5a7ecb688a7e19cbc2f70e358a94d02edf7 (patch) | |
tree | 3095145b1b9fd2c13e1ca90f53f2899876e06fdb /src/dbus/qdbuspendingcall_p.h | |
parent | 64e3bd481e5d54d555959ceecbd5c4576c571241 (diff) |
Remove QDBusPendingCallPrivate::autoDelete logic.
First step to fix race condition about deleting QDBusPendingCallPrivate.
In a multithreaded application on a slow/single core cpu the following
race (and segmentation fault) can occur:
First thread A is running:
A: QDBusPendingReply<> reply = pi->asyncCallWithArgumentList(method, argumentList);
Then when the dbus answer arrives thread B will call:
B: QDBusConnectionPrivate::processFinishedCall()
B: ...
B: locker.unlock()
and runs until here, go on with thread A:
A: reply.waitForFinished();
A: QDBusPendingCallPrivate::waitForFinished()
A: {
A: QMutexLocker locker(&mutex);
A: if (replyMessage.type() != QDBusMessage::InvalidMessage)
A: return;
which returns immediately (mutex acquired, replyMessage alread set), now
reply goes out of scope (destructor called) and QDBusPendingCall::d's
destructor of type QExplicitlySharedDataPointer<QDBusPendingCallPrivate>
deletes the reference counted object QDBusPendingCallPrivate.
Now thread B continues, still in processFinishedCall()
B: if (call->watcherHelper)
B: call->watcherHelper->emitSignals(msg, call->sentMessage);
B:
B: if (msg.type() == QDBusMessage::ErrorMessage)
B: emit connection->callWithCallbackFailed(QDBusError(msg),
B: call->sentMessage);
accessing alread deleted object QDBusPendingCallPrivate via call->...
Fixed QDBusPendingCallPrivate deletion by proper reference counting
will be done in the next commit.
Task-number: QTBUG-27809
Change-Id: I15b3f0242471b62eaafadc763fb6a33339ff2fe1
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Diffstat (limited to 'src/dbus/qdbuspendingcall_p.h')
-rw-r--r-- | src/dbus/qdbuspendingcall_p.h | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/src/dbus/qdbuspendingcall_p.h b/src/dbus/qdbuspendingcall_p.h index 36d0b9023a..d0b28b3c0e 100644 --- a/src/dbus/qdbuspendingcall_p.h +++ b/src/dbus/qdbuspendingcall_p.h @@ -85,7 +85,6 @@ public: QVector<int> metaTypes; int methodIdx; - bool autoDelete; // } mutable QMutex mutex; @@ -102,7 +101,7 @@ public: // } QDBusPendingCallPrivate(const QDBusMessage &sent, QDBusConnectionPrivate *connection) - : sentMessage(sent), connection(connection), autoDelete(false), watcherHelper(0), pending(0), waitingForFinished(false) + : sentMessage(sent), connection(connection), watcherHelper(0), pending(0), waitingForFinished(false) { } ~QDBusPendingCallPrivate(); bool setReplyCallback(QObject *target, const char *member); |