id,summary,reporter,owner,description,type,status,milestone,component,version,severity,resolution,keywords,cc
5847,sp_counted_base_pt.hpp: appears to suffer a race conditions,Jeffrey Walton <noloader@…>,Peter Dimov,"It appears release() suffers a race condition:


{{{
pthread_mutex_lock( &m_ );
long new_use_count = --use_count_;
pthread_mutex_unlock( &m_ );

if( new_use_count == 0 )
{
  dispose();
  weak_release();
}
}}}

In a multithreaded and/or multicore environment, its not hard to imagine Thread A beginning a dispose()/weak_release(), Thread A preemption, and then Thread B acquiring a reference.

multicore is more interesting, as you might need a memory barrier between the locked read of {{{new_use_count}}} and the subsequent test of {{{new_use_count}}} in the 'if' statement.

For add_ref_copy(), imagine a scenario where Thread A reads use_count, Thread A preemption, Thread B read/increment/write use_count, then Thread A increcemt/write use_count:

{{{
void add_ref_copy()
{
  ++use_count_;
}
}}}

weak_add_ref() and weak_release() suffer similar problems:

{{{
void weak_add_ref() // nothrow
{
  ++weak_count_;
}
}}}
and
{{{
void weak_release() // nothrow
{
  if( --weak_count_ == 0 )
  {
    destroy();
  }
}
}}}
",Bugs,closed,To Be Determined,smart_ptr,Boost 1.47.0,Problem,invalid,,