Skip to content

IOVSvc: Fix refcounting bug in createCondObj

Scott Snyder requested to merge ssnyder/athena:refcount.IOVSvc-20200620 into master

CondAttrListCollection is a DataObject with a reference count. CondAttrListCollAddress holds an instance of CondAttrListCollection and manages its reference count.

However, what createCondObj does is to take the address, get the DataBucket from the address, take control of the underlying object via relinquish, and then store the underlying object in the CondCont. CondCont then takes ownership of the object, and it doesn't know about refcounting. Then finally the address is deleted. Normally this works ok even for CondAttrListCollection, since when we get the object from the address the refcount is incremented. Deleting the address will then just decrement the reference count again, and the CondCont is left as the only owner of the object.

But the range being inserted entirely overlaps with an existing range, then CondCont will delete the object rather than inserting it. In that case, when we try to delete the object, it tries to decrement the object's refcount using a dangling reference to the deleted object, which can crash.

Fix this by making sure that the address is deleted before we try to add the object to the CondCont.

Merge request reports