i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

exchange_with_empty() did not set the freeMagazine return value to NULL when

Browse Source 
the maximum magazine count wasn't reached yet. With object_depot_store() not
resetting its local variable, a magazine could thus be emptied and freed
twice. Fixes #5489 and #5497.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@35752 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Ingo Weinhold
2010-03-04 01:55:37 +00:00
parent 7197f1a67e
commit 2a196c6349
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/system/kernel/slab/ObjectDepot.cpp
+2 -2
View File
@@ -143,6 +143,7 @@ exchange_with_empty(object_depot* depot, DepotMagazine*& magazine,
if (depot->full_count < depot->max_count) {
_push(depot->full, magazine);
depot->full_count++;
freeMagazine = NULL;
} else
freeMagazine = magazine;
}
@@ -252,8 +253,6 @@ object_depot_obtain(object_depot* depot)
void
object_depot_store(object_depot* depot, void* object, uint32 flags)
{
DepotMagazine* freeMagazine = NULL;
ReadLocker readLocker(depot->outer_lock);
InterruptsLocker interruptsLocker;
@@ -268,6 +267,7 @@ object_depot_store(object_depot* depot, void* object, uint32 flags)
if (store->loaded != NULL && store->loaded->Push(object))
return;
DepotMagazine* freeMagazine = NULL;
if ((store->previous != NULL && store->previous->IsEmpty())
|| exchange_with_empty(depot, store->previous, freeMagazine)) {
std::swap(store->loaded, store->previous);