From 2a196c634904e919ae9ee3dda90de522b7f3f5a3 Mon Sep 17 00:00:00 2001 From: Ingo Weinhold Date: Thu, 4 Mar 2010 01:55:37 +0000 Subject: [PATCH] exchange_with_empty() did not set the freeMagazine return value to NULL when the maximum magazine count wasn't reached yet. With object_depot_store() not resetting its local variable, a magazine could thus be emptied and freed twice. Fixes #5489 and #5497. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@35752 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/system/kernel/slab/ObjectDepot.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/system/kernel/slab/ObjectDepot.cpp b/src/system/kernel/slab/ObjectDepot.cpp index a67b93593e..60bab902c3 100644 --- a/src/system/kernel/slab/ObjectDepot.cpp +++ b/src/system/kernel/slab/ObjectDepot.cpp @@ -143,6 +143,7 @@ exchange_with_empty(object_depot* depot, DepotMagazine*& magazine, if (depot->full_count < depot->max_count) { _push(depot->full, magazine); depot->full_count++; + freeMagazine = NULL; } else freeMagazine = magazine; } @@ -252,8 +253,6 @@ object_depot_obtain(object_depot* depot) void object_depot_store(object_depot* depot, void* object, uint32 flags) { - DepotMagazine* freeMagazine = NULL; - ReadLocker readLocker(depot->outer_lock); InterruptsLocker interruptsLocker; @@ -268,6 +267,7 @@ object_depot_store(object_depot* depot, void* object, uint32 flags) if (store->loaded != NULL && store->loaded->Push(object)) return; + DepotMagazine* freeMagazine = NULL; if ((store->previous != NULL && store->previous->IsEmpty()) || exchange_with_empty(depot, store->previous, freeMagazine)) { std::swap(store->loaded, store->previous);