Modified: trunk/src/queue_internal.h (2 => 3)
--- trunk/src/queue_internal.h 2009-08-30 01:07:28 UTC (rev 2)
+++ trunk/src/queue_internal.h 2009-08-30 06:49:40 UTC (rev 3)
@@ -90,6 +90,7 @@
struct dispatch_object_s *prev, *head = _head._do, *tail = _tail._do;
tail->do_next = NULL;
+ _dispatch_retain(dq);
prev = fastpath(dispatch_atomic_xchg(&dq->dq_items_tail, tail));
if (prev) {
// if we crash here with a value less than 0x1000, then we are at a known bug in client code
@@ -99,6 +100,7 @@
dq->dq_items_head = head;
_dispatch_wakeup(dq);
}
+ _dispatch_release(dq);
}
#define _dispatch_queue_push(x, y) _dispatch_queue_push_list((x), (y), (y))
Modified: trunk/src/source.c (2 => 3)
--- trunk/src/source.c 2009-08-30 01:07:28 UTC (rev 2)
+++ trunk/src/source.c 2009-08-30 06:49:40 UTC (rev 3)
@@ -161,8 +161,15 @@
#if DISPATCH_DEBUG
dispatch_debug(ds, __FUNCTION__);
#endif
+ // Right after we set the cancel flag, someone else
+ // could potentially invoke the source, do the cancelation,
+ // unregister the source, and deallocate it. We would
+ // need to therefore retain/release before setting the bit
+
+ _dispatch_retain(ds);
dispatch_atomic_or(&ds->ds_atomic_flags, DSF_CANCELED);
_dispatch_wakeup(ds);
+ _dispatch_release(ds);
}
#ifndef DISPATCH_NO_LEGACY