Fix stale operation instance for connection error paths #540
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix #502
This change adds a reference count to the InteractionProtcolHandler_Operation structure to address the race condition between InteractionProtocolHandler_Operation_Strand_Finish and InteractionProtocolHandler_Session_CommonInstanceCode.
For connection errors, the operation instance was being freed before returning to InteractionProtocolHandler_Session_Connect. This resulted in Session_Connect referencing a stale instance pointer and, later, a double free to occur on the operation instance.
The fix is as follows:
1: Set the reference count to 2 when the operation created
2: Remove the PAL_Free(operation) call from the error path in InteractionProtocolHandler_Operation_Close. This was causing a double free in error paths.
For error paths, the final release occurs in CommonInstanceCode since Finish has already been called.
For success paths, the final release typically occurs in Finish sometime after CommonInstanceCode has released it's reference.