#15227 closed defect (fixed)

wxSharedPtr::Release is not thread safe

Reported by: plorkyeran Owned by: vadz
Priority: normal Milestone:
Component: base Version:
Keywords: Cc:
Blocked By: Blocking:
Patch: yes

Description

wxSharedPtr::Release uses wxAtomicDec, but it ignores the return value and does a separate read of the reference count afterwards. This can result in multiple threads seeing the ref count at zero and trying to delete the value. The fix is simply to use the return value of wxAtomicDec, which will only be 0 on one of the threads.

Attachments (1)

shared-ptr-release.diff download (435 bytes) - added by plorkyeran 17 months ago.

Download all attachments as: .zip

Change History (3)

Changed 17 months ago by plorkyeran

comment:1 Changed 17 months ago by vadz

  • Owner set to vadz
  • Status changed from new to accepted

That was definitely an interesting use of wxAtomicDec() :-(

Thanks for noticing and fixing it!

comment:2 Changed 17 months ago by VZ

  • Resolution set to fixed
  • Status changed from accepted to closed

(In [74065]) Make wxSharedPtr::Release() really MT-safe.

Using wxAtomicDec() is not enough, its result also must be checked as it will
return 0 only in one of the threads if multiple threads call it in parallel,
while the old test for m_count==0 could pass for more than one thread,
resulting in deleting the same pointer more than once.

Closes #15227.

Note: See TracTickets for help on using tickets.