Opened 5 years ago

Closed 5 years ago

#15227 closed defect (fixed)

wxSharedPtr::Release is not thread safe

Reported by: plorkyeran Owned by: vadz
Priority: normal Milestone:
Component: base Version:
Keywords: Cc:
Blocked By: Blocking:
Patch: yes


wxSharedPtr::Release uses wxAtomicDec, but it ignores the return value and does a separate read of the reference count afterwards. This can result in multiple threads seeing the ref count at zero and trying to delete the value. The fix is simply to use the return value of wxAtomicDec, which will only be 0 on one of the threads.

Attachments (1)

shared-ptr-release.diff download (435 bytes) - added by plorkyeran 5 years ago.

Download all attachments as: .zip

Change History (3)

Changed 5 years ago by plorkyeran

comment:1 Changed 5 years ago by vadz

  • Owner set to vadz
  • Status changed from new to accepted

That was definitely an interesting use of wxAtomicDec() :-(

Thanks for noticing and fixing it!

comment:2 Changed 5 years ago by VZ

  • Resolution set to fixed
  • Status changed from accepted to closed

(In [74065]) Make wxSharedPtr::Release() really MT-safe.

Using wxAtomicDec() is not enough, its result also must be checked as it will
return 0 only in one of the threads if multiple threads call it in parallel,
while the old test for m_count==0 could pass for more than one thread,
resulting in deleting the same pointer more than once.

Closes #15227.

Note: See TracTickets for help on using tickets.