From cb65a6b273ae8c050333600816557755d488b63c Mon Sep 17 00:00:00 2001 From: Chad Parry Date: Fri, 6 Nov 2015 11:52:10 -0800 Subject: [PATCH] Callbacks should ref the HHWheelTimer Summary: Callbacks sometimes outlive the `HHWheelTimer` that they reference. Then the `Callback` tries to reference the dead `HHWheelTimer` and it could either misbehave or crash. This was caught reliably by ASAN tests. Since `HHWheelTimer` already supports intrusive ref counting, the solution is to acquire a reference within the `Callback`. Reviewed By: djwatson Differential Revision: D2617966 fb-gh-sync-id: 02be9ffc5851c269d5933288a17ad394b33ac2dd --- folly/io/async/HHWheelTimer.cpp | 3 +++ folly/io/async/HHWheelTimer.h | 2 ++ 2 files changed, 5 insertions(+) diff --git a/folly/io/async/HHWheelTimer.cpp b/folly/io/async/HHWheelTimer.cpp index 1fd5e6d2..c62fb93d 100644 --- a/folly/io/async/HHWheelTimer.cpp +++ b/folly/io/async/HHWheelTimer.cpp @@ -21,6 +21,7 @@ #include #include +#include #include #include @@ -54,6 +55,7 @@ void HHWheelTimer::Callback::setScheduled(HHWheelTimer* wheel, assert(wheel_ == nullptr); assert(expiration_ == milliseconds(0)); + wheelGuard_ = DestructorGuard(wheel); wheel_ = wheel; // Only update the now_ time if we're not in a timeout expired callback @@ -72,6 +74,7 @@ void HHWheelTimer::Callback::cancelTimeoutImpl() { hook_.unlink(); wheel_ = nullptr; + wheelGuard_ = folly::none; expiration_ = milliseconds(0); } diff --git a/folly/io/async/HHWheelTimer.h b/folly/io/async/HHWheelTimer.h index 0609ea66..963af518 100644 --- a/folly/io/async/HHWheelTimer.h +++ b/folly/io/async/HHWheelTimer.h @@ -16,6 +16,7 @@ #pragma once +#include #include #include @@ -133,6 +134,7 @@ class HHWheelTimer : private folly::AsyncTimeout, void cancelTimeoutImpl(); HHWheelTimer* wheel_; + folly::Optional wheelGuard_; std::chrono::milliseconds expiration_; typedef boost::intrusive::list_member_hook< -- 2.34.1