[Ekiga-devel-list] gmref_ptr

[Eugen Dedu <Eugen Dedu pu-pm univ-fcomte fr>]

Hi Snark,

What do you give me if I tell you a bug in gmref code which seems to 
annoy you much...?

I was looking to solve the crash on exit and came across something which 
seems a bug.

In services.cpp, ~ServiceCore executes pop_back(), and this function 
calls the destructor of the element 
(http://www.cplusplus.com/reference/stl/list/pop_back.html).  However, 
the refcount of the objects so deleted is not necessarily 0 (you can 
print their refcount just before deletion), so the destructor gets 
called twice (and the second time this might generate a segmfault).

Also, this might explain (yet to be analysed) your problem where a 
refcount is 11, afterwards 1; the memory is wrongly delete-d when it has 
refcount=11, and it is allocated again, which sets this field to 1.

Finally, I was wondering why is the whole gmref needed, since all the 
pointers in service_core could be freed at the real end of ekiga, when 
service_core itself is deleted (in engine_stop() from engine.cpp).

--
Eugen