Make sure images containing BTranslators are not unloaded early

When a translator is uninstalled, BTranslatorPrivate::_RemoveTranslators is
called. This method used to unload the image containing the translator after
calling Release() on it resulting in several problems:

- If the translator was still busy, e.g. translating something while being
  installed, it crashed since the image was unloaded even though its refcount
  was larger than 0.
- Applications using code from one of the translators (e.g. its config view)
  would crash when the translator is uninstalled (this is bug #12005).

This problem is now fixed. The roster keeps track of all translators whose
image it manages (even if the translator was already removed from the roster).
It also keeps a refcount to all images. When a translator's refcount drops to
zero and it belonged to a roster at some point, it does not delete itself, but
notifies the roster that it is ready to destruct, which then removes it from
the roster if the translator is still in it, destroys the translator, decrements
the refcount of the image and if the new refcount is zero, unloads the image.
All of this is done in a message handler, since if the translator called
TranslatorDeleted like before, the unloaded image would be referenced when
the stack is walked up.

Finally, the DataTranslations preflet is required to Acquire() the translator
whose config view it is showing, because otherwise its refcount could be reduced
to 0 and the image unloaded. BTranslatorRoster now enables users to acquire a
translator by ID. By the time the translator has to be released, it might not
be part of the roster anymore though. Since BTranslatorRoster tries not to give
out raw pointers to the translators it manages, users who acquire a translator
through a roster now are given a BTranslatorReleaseDelegate, which allows for
releasing the BTranslator exactly once and then self-destructs.

Signed-off-by: Axel Dörfler <[email protected]>

headers/os/app/AppDefs.h

@@ -59,6 +59,7 @@ enum {
 	B_VALUE_CHANGED				= '_VCH',
 	B_TRANSLATOR_ADDED			= '_ART',
 	B_TRANSLATOR_REMOVED		= '_RRT',
+	B_DELETE_TRANSLATOR			= '_DRT',
 	B_VIEW_MOVED				= '_VMV',
 	B_VIEW_RESIZED				= '_VRS',
 	B_WINDOW_MOVED				= '_WMV',

headers/os/translation/TranslatorRoster.h

@@ -23,6 +23,17 @@ class BView;
 struct entry_ref;
 
 
+class BTranslatorReleaseDelegate {
+public:
+								BTranslatorReleaseDelegate(BTranslator* translator);
+
+			void				Release();
+
+private:
+			BTranslator*		fUnderlying;
+};
+
+
 class BTranslatorRoster : public BArchivable {
 public:
 								BTranslatorRoster();
@@ -86,6 +97,8 @@ public:
 									translator_id translatorID,
 									BMessage* ioExtension);
 
+			BTranslatorReleaseDelegate*	AcquireTranslator(int32 translatorID);
+
 			status_t			GetRefFor(translator_id translatorID,
 									entry_ref* ref);
 			bool				IsTranslator(entry_ref* ref);

src/kits/translation/Translator.cpp

@@ -24,8 +24,6 @@ BTranslator::BTranslator()
 
 BTranslator::~BTranslator()
 {
-	if (fOwningRoster != NULL)
-		fOwningRoster->TranslatorDeleted(fID);
 }
 
 
@@ -52,10 +50,24 @@ BTranslator *BTranslator::Acquire()
 BTranslator *BTranslator::Release()
 {
 	int32 oldValue = atomic_add(&fRefCount, -1);
-	if (oldValue > 0)
+	if (oldValue > 1)
 		return this;
 
-	delete this;
+	if (fOwningRoster == NULL) {
+		delete this;
+		return NULL;
+	}
+
+	// If we have ever been part of a roster, notify the roster to delete us
+	// and unload our image in a thread-safe way
+	BMessage deleteRequest(B_DELETE_TRANSLATOR);
+
+	deleteRequest.AddPointer("ptr", this);
+	deleteRequest.AddInt32("id", fID);
+
+	BMessenger sender(fOwningRoster);
+	sender.SendMessage(&deleteRequest);
+
 	return NULL;
 }
 

src/kits/translation/TranslatorRoster.cpp

@@ -193,9 +193,6 @@ BTranslatorRoster::Private::~Private()
 	while (iterator != fTranslators.end()) {
 		BTranslator* translator = iterator->second.translator;
 
-		translator->fOwningRoster = NULL;
-			// we don't want to be notified about this anymore
-
 		images.insert(iterator->second.image);
 		translator->Release();
 
@@ -318,6 +315,19 @@ BTranslatorRoster::Private::MessageReceived(BMessage* message)
 			break;
 		}
 
+		case B_DELETE_TRANSLATOR:
+		{
+			// A translator's refcount has been reduced to zero and it wants
+			// us to delete it.
+			int32 id;
+			void* self;
+			if (message->FindInt32("id", &id) == B_OK
+				&& message->FindPointer("ptr", &self) == B_OK) {
+				_TranslatorDeleted(id, (BTranslator*)self);
+			}
+			break;
+		}
+
 		default:
 			BHandler::MessageReceived(message);
 			break;
@@ -592,6 +602,7 @@ BTranslatorRoster::Private::CreateTranslators(const entry_ref& ref,
 			if (AddTranslator(translator, image, &ref, nodeRef.node) == B_OK) {
 				if (update)
 					update->AddInt32("translator_id", translator->fID);
+				fImageOrigins.insert(std::make_pair(translator, image));
 				count++;
 				created++;
 			} else {
@@ -600,8 +611,12 @@ BTranslatorRoster::Private::CreateTranslators(const entry_ref& ref,
 			}
 		}
 
-		if (created == 0)
+		if (created == 0) {
 			unload_add_on(image);
+		} else {
+			// Initial refcount for the image that was just loaded
+			fKnownImages.insert(std::make_pair(image, created));
+		}
 
 		quarantine.Remove();
 		return B_OK;
@@ -850,18 +865,27 @@ BTranslatorRoster::Private::GetRefFor(translator_id id, entry_ref& ref)
 
 
 void
-BTranslatorRoster::Private::TranslatorDeleted(translator_id id)
+BTranslatorRoster::Private::_TranslatorDeleted(translator_id id, BTranslator* self)
 {
 	BAutolock locker(this);
 
 	TranslatorMap::iterator iterator = fTranslators.find(id);
-	if (iterator == fTranslators.end())
-		return;
+	if (iterator != fTranslators.end())
+		fTranslators.erase(iterator);
 
-	fTranslators.erase(iterator);
+	image_id image = fImageOrigins[self];
+
+	delete self;
+
+	int32 former = atomic_add(&fKnownImages[image], -1);
+	if (former == 1)
+	{
+		unload_add_on(image);
+		fImageOrigins.erase(self);
+		fKnownImages.erase(image);
+	}
 }
 
-
 /*static*/ int
 BTranslatorRoster::Private::_CompareSupport(const void* _a, const void* _b)
 {
@@ -1073,9 +1097,6 @@ BTranslatorRoster::Private::_RemoveTranslators(const node_ref* nodeRef,
 		if ((ref != NULL && item.ref == *ref)
 			|| (nodeRef != NULL && item.ref.device == nodeRef->device
 				&& item.node == nodeRef->node)) {
-			item.translator->fOwningRoster = NULL;
-				// if the translator is busy, we don't want to be notified
-				// about the removal later on
 			item.translator->Release();
 			image = item.image;
 			update.AddInt32("translator_id", iterator->first);
@@ -1086,11 +1107,6 @@ BTranslatorRoster::Private::_RemoveTranslators(const node_ref* nodeRef,
 		iterator = next;
 	}
 
-	// Unload image from the removed translator
-
-	if (image >= B_OK)
-		unload_add_on(image);
-
 	_NotifyListeners(update);
 }
 
@@ -1150,6 +1166,21 @@ BTranslatorRoster::Private::_NotifyListeners(BMessage& update) const
 
 //	#pragma mark -
 
+BTranslatorReleaseDelegate::BTranslatorReleaseDelegate(BTranslator* translator)
+	:
+	fUnderlying(translator)
+{
+}
+
+
+void
+BTranslatorReleaseDelegate::Release()
+{
+	fUnderlying->Release();
+	// ReleaseDelegate is only allowed to release a translator once.
+	delete this;
+}
+
 
 BTranslatorRoster::BTranslatorRoster()
 {
@@ -1665,6 +1696,20 @@ BTranslatorRoster::MakeConfigurationView(translator_id id,
 }
 
 
+BTranslatorReleaseDelegate*
+BTranslatorRoster::AcquireTranslator(int32 id)
+{
+	BAutolock locker(fPrivate);
+
+	BTranslator* translator = fPrivate->FindTranslator(id);
+	if (translator == NULL)
+		return NULL;
+
+	translator->Acquire();
+	return new BTranslatorReleaseDelegate(translator);
+}
+
+
 /*!
 	Gets the configuration setttings for the translator
 	specified by \a id and puts them into \a ioExtension.

src/kits/translation/TranslatorRosterPrivate.h

@@ -33,6 +33,8 @@ typedef std::map<translator_id, translator_item> TranslatorMap;
 typedef std::vector<BMessenger> MessengerList;
 typedef std::vector<node_ref> NodeRefList;
 typedef std::set<entry_ref> EntryRefSet;
+typedef std::map<image_id, int32> ImageMap;
+typedef std::map<BTranslator*, image_id> TranslatorImageMap;
 
 
 class BTranslatorRoster::Private : public BHandler, public BLocker {
@@ -78,8 +80,6 @@ public:
 			status_t			StartWatching(BMessenger target);
 			status_t			StopWatching(BMessenger target);
 
-			void				TranslatorDeleted(translator_id id);
-
 private:
 	static	int					_CompareSupport(const void* _a, const void* _b);
 
@@ -107,11 +107,15 @@ private:
 									const char* name);
 			void				_EntryAdded(const entry_ref& ref);
 			void				_NotifyListeners(BMessage& update) const;
+			void				_TranslatorDeleted(translator_id id,
+									BTranslator *self);
 
 			NodeRefList			fDirectories;
 			TranslatorMap		fTranslators;
 			MessengerList		fMessengers;
 			EntryRefSet			fRescanEntries;
+			ImageMap			fKnownImages;
+			TranslatorImageMap	fImageOrigins;
 			const char*			fABISubDirectory;
 			int32				fNextID;
 			bool				fLazyScanning;

src/preferences/datatranslations/DataTranslationsWindow.cpp

@@ -53,7 +53,8 @@ DataTranslationsWindow::DataTranslationsWindow()
 	:
 	BWindow(BRect(0, 0, 550, 350), B_TRANSLATE_SYSTEM_NAME("DataTranslations"),
 		B_TITLED_WINDOW, B_ASYNCHRONOUS_CONTROLS | B_NOT_ZOOMABLE
-		| B_NOT_RESIZABLE | B_AUTO_UPDATE_SIZE_LIMITS)
+		| B_NOT_RESIZABLE | B_AUTO_UPDATE_SIZE_LIMITS),
+	fRelease(NULL)
 {
 	MoveTo(DataTranslationsSettings::Instance()->WindowCorner());
 
@@ -151,6 +152,10 @@ DataTranslationsWindow::_ShowConfigView(int32 id)
 		fRightBox->RemoveChild(fConfigView);
 		delete fConfigView;
 		fConfigView = NULL;
+		if (fRelease != NULL) {
+			fRelease->Release();
+			fRelease = NULL;
+		}
 	}
 
 	BMessage emptyMsg;
@@ -165,6 +170,10 @@ DataTranslationsWindow::_ShowConfigView(int32 id)
 		// force config views to all have the same color
 	fRightBox->AddChild(fConfigView);
 
+	// Make sure the translator's image doesn't get unloaded while we are still
+	// showing a config view whose code is in the image
+	fRelease = roster->AcquireTranslator(id);
+
 	return B_OK;
 }
 
@@ -176,6 +185,11 @@ DataTranslationsWindow::_ShowInfoView()
 		fRightBox->RemoveChild(fConfigView);
 		delete fConfigView;
 		fConfigView = NULL;
+		if (fRelease != NULL) {
+			fRelease->Release();
+			fRelease = NULL;
+		}
+
 	}
 
 	BTextView* view = new BTextView("info text");

src/preferences/datatranslations/DataTranslationsWindow.h

@@ -20,6 +20,7 @@
 
 #include "TranslatorListView.h"
 
+class BTranslatorReleaseDelegate;
 
 class DataTranslationsWindow : public BWindow {
 public:
@@ -39,6 +40,7 @@ private:
 			void			_SetupViews();
 
 			TranslatorListView*	fTranslatorListView;
+			BTranslatorReleaseDelegate*		fRelease;
 
 			BBox*			fRightBox;
 			BView*			fConfigView;