Bug in GC at Communicator::destroy()

acbell

Hi,

I am running 3.0.1 with the 3.0.1 GC patch installed.

The problem is that if an object pointer on stack/global space is the only reference to a GC object, GC::collectGarbage thinks that the GC object should be reclaimed, and deletes it. When the stack unwinds/global space cleans up, another attempt is made to delete the pointed to object and bad things happen (TM).

The problem looks to me to be the line:

counts.insert(pos, ObjectCounts::value_type(*i, (*i)->__getRefUnsafe() - 1));

I'm not sure why the "-1" is here, but then I'm not sure I totally understand the exact thinking.

I've attached a test case. I get a segfault when I hit CTRL-C to exit the program.

Thanks,

michi

Thanks a lot for that, I'll have a look at this today.

Cheers,

Michi.

michi

Thanks again for reporting this. It turns out that I got a bit carried away in my efforts to optimize the garbage collector and ended up introducing this bug.

I have updated both the GC patch against 3.0.0 and the GC patch against 3.0.1.

You can apply these patches against the original 3.0.0 or 3.0.1 source, respectively. Alternatively, you can use the attached src/Ice/GC.cpp and test/Ice/gc/Client.cpp files. If you have previously applied the original 3.0.0 or 3.0.1 patch, you can simply copy these files over the previously patched ones.

Cheers,

Michi.