Author: stefan2 Date: Mon Dec 18 15:31:59 2017 New Revision: 1818584 URL: http://svn.apache.org/viewvc?rev=1818584&view=rev Log: Fix a refcounting / cleanup race in svn_object_pool causing crashes when exiting svnserve while using the --config-file option.
This patch has been outstandig for a while: https://lists.apache.org/thread.html/41ca5579bf7add3cb751234ea039fda531c1d22ffbed8cb2ec699e42@%3Cdev.subversion.apache.org%3E * subversion/libsvn_subr/object_pool.c (add_object_ref): If items of the container are being hold by parent pools of the container pool, ref counting updates would come too late if run during pool cleanup. Instead, run them in pre-cleanup. Modified: subversion/trunk/subversion/libsvn_subr/object_pool.c Modified: subversion/trunk/subversion/libsvn_subr/object_pool.c URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_subr/object_pool.c?rev=1818584&r1=1818583&r2=1818584&view=diff ============================================================================== --- subversion/trunk/subversion/libsvn_subr/object_pool.c (original) +++ subversion/trunk/subversion/libsvn_subr/object_pool.c Mon Dec 18 15:31:59 2017 @@ -172,9 +172,11 @@ add_object_ref(object_ref_t *object_ref, if (svn_atomic_inc(&object_ref->ref_count) == 0) svn_atomic_dec(&object_ref->object_pool->unused_count); - /* make sure the reference gets released automatically */ - apr_pool_cleanup_register(pool, object_ref, object_ref_cleanup, - apr_pool_cleanup_null); + /* Make sure the reference gets released automatically. + Since POOL might be a parent pool of OBJECT_REF->OBJECT_POOL, + to the reference counting update before destroing any of the + pool hierarchy. */ + apr_pool_pre_cleanup_register(pool, object_ref, object_ref_cleanup); } /* Actual implementation of svn_object_pool__lookup.
