libdispatch-84.5.1.tar.gz

diff --git a/src/queue_internal.h b/src/queue_internal.h
index 05237c2022f2328b762edc05aecbb6cafd9839ce..b70c2d0a0c55e676a69e4acf789deddc2e7b2dd9 100644 (file)
--- a/src/queue_internal.h
+++ b/src/queue_internal.h
@@ -90,6 +90,7 @@ _dispatch_queue_push_list(dispatch_queue_t dq, dispatch_object_t _head, dispatch
        struct dispatch_object_s *prev, *head = _head._do, *tail = _tail._do;
 
        tail->do_next = NULL;
+       _dispatch_retain(dq);
        prev = fastpath(dispatch_atomic_xchg(&dq->dq_items_tail, tail));
        if (prev) {
                // if we crash here with a value less than 0x1000, then we are at a known bug in client code
@@ -99,6 +100,7 @@ _dispatch_queue_push_list(dispatch_queue_t dq, dispatch_object_t _head, dispatch
                dq->dq_items_head = head;
                _dispatch_wakeup(dq);
        }
+       _dispatch_release(dq);
 }
 
 #define _dispatch_queue_push(x, y) _dispatch_queue_push_list((x), (y), (y))

diff --git a/src/source.c b/src/source.c
index 7259b0b0d7e2b6f55ed44195f5ced6112d00fbf0..5a0dbc84803d32644784f6e1f1792d9da07e4322 100644 (file)
--- a/src/source.c
+++ b/src/source.c
@@ -161,8 +161,15 @@ dispatch_source_cancel(dispatch_source_t ds)
 #if DISPATCH_DEBUG
        dispatch_debug(ds, __FUNCTION__);
 #endif
+       // Right after we set the cancel flag, someone else
+       // could potentially invoke the source, do the cancelation, 
+       // unregister the source, and deallocate it. We would
+       // need to therefore retain/release before setting the bit
+
+       _dispatch_retain(ds);
        dispatch_atomic_or(&ds->ds_atomic_flags, DSF_CANCELED);
        _dispatch_wakeup(ds);
+       _dispatch_release(ds);
 }
 
 #ifndef DISPATCH_NO_LEGACY