Skip to content

Commit 342119d

Browse files
committed
http.c: clear the 'finished' member once we are done with it
In http.c, the run_active_slot() function allows the given "slot" to make progress by calling step_active_slots() in a loop repeatedly, and the loop is not left until the request held in the slot completes. Ages ago, we used to use the slot->in_use member to get out of the loop, which misbehaved when the request in "slot" completes (at which time, the result of the request is copied away from the slot, and the in_use member is cleared, making the slot ready to be reused), and the "slot" gets reused to service a different request (at which time, the "slot" becomes in_use again, even though it is for a different request). The loop terminating condition mistakenly thought that the original request has yet to be completed. Today's code, after baa7b67 (HTTP slot reuse fixes, 2006-03-10) fixed this issue, uses a separate "slot->finished" member that is set in run_active_slot() to point to an on-stack variable, and the code that completes the request in finish_active_slot() clears the on-stack variable via the pointer to signal that the particular request held by the slot has completed. It also clears the in_use member (as before that fix), so that the slot itself can safely be reused for an unrelated request. One thing that is not quite clean in this arrangement is that, unless the slot gets reused, at which point the finished member is reset to NULL, the member keeps the value of &finished, which becomes a dangling pointer into the stack when run_active_slot() returns. Clear the finished member before the control leaves the function, which has a side effect of unconfusing compilers like recent GCC 12 that is over-eager to warn against such an assignment. Signed-off-by: Junio C Hamano <[email protected]>
1 parent d516b2d commit 342119d

File tree

1 file changed

+26
-0
lines changed

1 file changed

+26
-0
lines changed

http.c

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1367,6 +1367,32 @@ void run_active_slot(struct active_request_slot *slot)
13671367
select(max_fd+1, &readfds, &writefds, &excfds, &select_timeout);
13681368
}
13691369
}
1370+
1371+
/*
1372+
* The value of slot->finished we set before the loop was used
1373+
* to set our "finished" variable when our request completed.
1374+
*
1375+
* 1. The slot may not have been reused for another requst
1376+
* yet, in which case it still has &finished.
1377+
*
1378+
* 2. The slot may already be in-use to serve another request,
1379+
* which can further be divided into two cases:
1380+
*
1381+
* (a) If call run_active_slot() hasn't been called for that
1382+
* other request, slot->finished may still have the
1383+
* address of our &finished.
1384+
*
1385+
* (b) If the request did call run_active_slot(), then the
1386+
* call would have updated slot->finished at the beginning
1387+
* of this function, and with the clearing of the member
1388+
* below, we would find that slot->finished is now NULL.
1389+
*
1390+
* In all cases, slot->finished has no useful information to
1391+
* anybody at this point. Some compilers warn us for
1392+
* attempting to smuggle a pointer that is about to become
1393+
* invalid, i.e. &finished. We clear it here to assure them.
1394+
*/
1395+
slot->finished = NULL;
13701396
}
13711397

13721398
static void release_active_slot(struct active_request_slot *slot)

0 commit comments

Comments
 (0)