RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 03:17:34 +00:00
Code Issues Activity Actions

Tests: Fix use-after-free in TestRefPtr.self_observers

Browse source 
We can't unref an object to destruction while there's still a live
RefPtr to the object, otherwise the RefPtr destructor will try to
destroy it again, accessing the refcount of a destroyed object (before
realizing that oops! the object is already dead)
This commit is contained in:
Andrew Kaster 2021-05-12 04:46:16 -06:00 • committed by Linus Groh
parent 28987d1b56
commit 09fe9f4542
1 changed files with 14 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

28
Tests/AK/TestRefPtr.cpp
View file

@ -129,22 +129,22 @@ TEST_CASE(assign_copy_self)
TEST_CASE(self_observers) TEST_CASE(self_observers)
{ {
RefPtr<SelfAwareObject> object = adopt_ref(*new SelfAwareObject); {
EXPECT_EQ(object->ref_count(), 1u); RefPtr<SelfAwareObject> object = adopt_ref(*new SelfAwareObject);
EXPECT_EQ(object->m_has_one_ref_left, false); EXPECT_EQ(object->ref_count(), 1u);
EXPECT_EQ(SelfAwareObject::num_destroyed, 0u); EXPECT_EQ(object->m_has_one_ref_left, false);
EXPECT_EQ(SelfAwareObject::num_destroyed, 0u);
object->ref(); object->ref();
EXPECT_EQ(object->ref_count(), 2u); EXPECT_EQ(object->ref_count(), 2u);
EXPECT_EQ(object->m_has_one_ref_left, false); EXPECT_EQ(object->m_has_one_ref_left, false);
EXPECT_EQ(SelfAwareObject::num_destroyed, 0u); EXPECT_EQ(SelfAwareObject::num_destroyed, 0u);
object->unref(); object->unref();
EXPECT_EQ(object->ref_count(), 1u); EXPECT_EQ(object->ref_count(), 1u);
EXPECT_EQ(object->m_has_one_ref_left, true); EXPECT_EQ(object->m_has_one_ref_left, true);
EXPECT_EQ(SelfAwareObject::num_destroyed, 0u); EXPECT_EQ(SelfAwareObject::num_destroyed, 0u);
}
object->unref();
EXPECT_EQ(SelfAwareObject::num_destroyed, 1u); EXPECT_EQ(SelfAwareObject::num_destroyed, 1u);
} }