Commit ae59a5e9 authored by Subodh Iyengar's avatar Subodh Iyengar Committed by facebook-github-bot-9

Fix potential delete behavior of guard

Summary: There is a potential double free in destructor guard
if someone calls a method which takes a DG in the destructor
of the DG.

This is potential in the case when someone is holding onto
a DG while calling destroy() on the object.

Reviewed By: @djwatson

Differential Revision: D2463113
parent 9722033f
...@@ -104,6 +104,7 @@ class DelayedDestruction : public DelayedDestructionBase { ...@@ -104,6 +104,7 @@ class DelayedDestruction : public DelayedDestructionBase {
if (delayed && !destroyPending_) { if (delayed && !destroyPending_) {
return; return;
} }
destroyPending_ = false;
delete this; delete this;
}; };
} }
...@@ -111,7 +112,7 @@ class DelayedDestruction : public DelayedDestructionBase { ...@@ -111,7 +112,7 @@ class DelayedDestruction : public DelayedDestructionBase {
private: private:
/** /**
* destroyPending_ is set to true if destoy() is called while guardCount_ is * destroyPending_ is set to true if destoy() is called while guardCount_ is
* non-zero. * non-zero. It is set to false before the object is deleted.
* *
* If destroyPending_ is true, the object will be destroyed the next time * If destroyPending_ is true, the object will be destroyed the next time
* guardCount_ drops to 0. * guardCount_ drops to 0.
......
/*
* Copyright 2015 Facebook, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <folly/io/async/DelayedDestruction.h>
#include <gtest/gtest.h>
using namespace folly;
class DeleteGuarder : public DelayedDestruction {
~DeleteGuarder() {
doFoo();
}
void doFoo() {
DelayedDestructionBase::DestructorGuard dg(this);
LOG(INFO) << "foo";
}
};
TEST(DelayedDestructionTest, GuardOnDelete) {
auto dg = new DeleteGuarder();
dg->destroy();
}
TEST(DelayedDestructionTest, GuardOnDeleteWithPreGuard) {
auto dg = new DeleteGuarder();
DelayedDestructionBase::DestructorGuard guard(dg);
dg->destroy();
}
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment