Re: [Boost-users] shared_ptr race condition

From: Eduardo Panisset (eduardo.panisset_at_[hidden])
Date: 2008-08-16 19:46:03

On Sat, Aug 16, 2008 at 5:42 PM, David Abrahams <dave_at_[hidden]> wrote:

>
> on Sat Aug 16 2008, Mika Heiskanen <mika.heiskanen-AT-fmi.fi<http://mika.heiskanen-at-fmi.fi/>>
> wrote:
>
> > David Abrahams wrote:
> >> on Sat Aug 16 2008, "Eduardo Panisset" <eduardo.panisset-AT-gmail.com<http://eduardo.panisset-at-gmail.com/>>
> wrote:
> >>
> >>>         if( new_use_count == 0 )
> >>>         {
> >>>             dispose();
> >>>             weak_release();
> >>>         }
> >>>  How Can I ensure that the release member function wouldn't dispose
> >>> a pointee
> >>> more than one time ? (release executing concurrently from different
> >>> shared_ptr instances)
> >>
> >> Because the reference count was 1, there can be only one shared_ptr
> >> instance that owns the pointee.  No other threads can be referencing it.
> >
> > But since the mutex is released, a copy could be created before the
> > new_use_count test is reached? Or is it impossible to create a copy if
> > use_count_ is zero?
>
> What thread can create a copy?  We know exactly what the only thread
> that has a reference to the owned object is doing (it's executing the
> very code we're concerned with).

Ok, I agree with that. I increment the reference count by copying a
shared_ptr to another shared_ptr (before the shared_ptr releases its
pointee).
However, let me give another example:

There are  two threads, each one with its own shared_ptr. Thread 2 created
its shared_ptr2 by copying the shared_prt1 of thread 1. Then the reference
count is equal to 2.
Some time later, shared_ptr1 goes out of scope and then shared_prt2 also
goes out of scope.
Consider the following event sequence:

1. Thread 1 executes release member function, and it is preempted before
executing  comparation if (new_use_count == 0)
2. Thread 2 executes release member function until the end, disposing the
pointee.
3. Thread 1 is rescheduled, executes comparation if (new_use_count == 0) and
also diposes the pointee!

Is it possible, isn't it?