[Ekiga-devel-list] gmref_ptr

Hi Snark,

What do you give me if I tell you a bug in gmref code which seems to annoy you much...?

I was looking to solve the crash on exit and came across something which seems a bug.

In services.cpp, ~ServiceCore executes pop_back(), and this function calls the destructor of the element (http://www.cplusplus.com/reference/stl/list/pop_back.html). However, the refcount of the objects so deleted is not necessarily 0 (you can print their refcount just before deletion), so the destructor gets called twice (and the second time this might generate a segmfault).

Also, this might explain (yet to be analysed) your problem where a refcount is 11, afterwards 1; the memory is wrongly delete-d when it has refcount=11, and it is allocated again, which sets this field to 1.

Finally, I was wondering why is the whole gmref needed, since all the pointers in service_core could be freed at the real end of ekiga, when service_core itself is deleted (in engine_stop() from engine.cpp).


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]