Revision: 3 http://trac.macosforge.org/projects/libdispatch/changeset/3 Author: kvv@apple.com Date: 2009-08-29 23:49:40 -0700 (Sat, 29 Aug 2009) Log Message: ----------- rdar://problem/7148356 Modified Paths: -------------- trunk/src/queue_internal.h trunk/src/source.c Modified: trunk/src/queue_internal.h =================================================================== --- trunk/src/queue_internal.h 2009-08-30 01:07:28 UTC (rev 2) +++ trunk/src/queue_internal.h 2009-08-30 06:49:40 UTC (rev 3) @@ -90,6 +90,7 @@ struct dispatch_object_s *prev, *head = _head._do, *tail = _tail._do; tail->do_next = NULL; + _dispatch_retain(dq); prev = fastpath(dispatch_atomic_xchg(&dq->dq_items_tail, tail)); if (prev) { // if we crash here with a value less than 0x1000, then we are at a known bug in client code @@ -99,6 +100,7 @@ dq->dq_items_head = head; _dispatch_wakeup(dq); } + _dispatch_release(dq); } #define _dispatch_queue_push(x, y) _dispatch_queue_push_list((x), (y), (y)) Modified: trunk/src/source.c =================================================================== --- trunk/src/source.c 2009-08-30 01:07:28 UTC (rev 2) +++ trunk/src/source.c 2009-08-30 06:49:40 UTC (rev 3) @@ -161,8 +161,15 @@ #if DISPATCH_DEBUG dispatch_debug(ds, __FUNCTION__); #endif + // Right after we set the cancel flag, someone else + // could potentially invoke the source, do the cancelation, + // unregister the source, and deallocate it. We would + // need to therefore retain/release before setting the bit + + _dispatch_retain(ds); dispatch_atomic_or(&ds->ds_atomic_flags, DSF_CANCELED); _dispatch_wakeup(ds); + _dispatch_release(ds); } #ifndef DISPATCH_NO_LEGACY