RequestContext: Fix race condition in releasing clear and delete counts of RequestData
Summary: Fix race condition between releaseRefClearDelete and releaseRefDeleteOnly by fixing handling in releaseRefClearDelete of the case where the clear count is 1 and the delete count is > 1. The correct behavior of releaseRefClearDelete when delete count > 1 is to release the clear count first and then release the delete count, instead of releasing the two counts in one step. The following sequence of events demonstrates the problem in the absence of the fix: - clear count == 1 and delete count == 2 - Thread 1 calls releaseRefClearDeleteCount - Thread 2 calls releaseRefDeleteOnly - Thread 1 atomically decrements the counts to 0 and 1 - Thread 2 atomically decrements the delete count to 0 - Thread 2 deletes the RequestData object - Thread 1 call to onClear accesses deleted object Reviewed By: yfeldblum, davidtgoldblatt Differential Revision: D21705266 fbshipit-source-id: 8ec2151c4e98968beaef7e9ccec0a786ca5ae267
Showing
Please register or sign in to comment