---

yaml
---
r: 94520
b: refs/heads/try
c: e121d75
h: refs/heads/master
v: v3

Author: alexcrichton

[refs]

@@ -2,7 +2,7 @@
 refs/heads/master: 0da105a8b7b6b1e0568e8ff20f6ff4b13cc7ecc2
 refs/heads/snap-stage1: e33de59e47c5076a89eadeb38f4934f58a3618a6
 refs/heads/snap-stage3: a6d3e57dca68fde4effdda3e4ae2887aa535fcd6
-refs/heads/try: 51c03c1f35f6b076928a1e5b94ec81e6d00c3ac2
+refs/heads/try: e121d7556cc577c7a89acb3a609fcafcc8fc9204
 refs/tags/release-0.1: 1f5c5126e96c79d22cb7862f75304136e204f105
 refs/heads/ndm: f3868061cd7988080c30d6d5bf352a5a5fe2460b
 refs/heads/try2: 147ecfdd8221e4a4d4e090486829a06da1e0ca3c

branches/try/src/librustuv/uvio.rs

@@ -57,14 +57,18 @@ impl UvEventLoop {
         UvEventLoop {
             uvio: UvIoFactory {
                 loop_: loop_,
-                handle_pool: handle_pool,
+                handle_pool: Some(handle_pool),
             }
         }
     }
 }
 
 impl Drop for UvEventLoop {
     fn drop(&mut self) {
+        // Must first destroy the pool of handles before we destroy the loop
+        // because otherwise the contained async handle will be destroyed after
+        // the loop is free'd (use-after-free)
+        self.uvio.handle_pool.take();
         self.uvio.loop_.close();
     }
 }
@@ -117,14 +121,14 @@ fn test_callback_run_once() {
 
 pub struct UvIoFactory {
     loop_: Loop,
-    priv handle_pool: ~QueuePool,
+    priv handle_pool: Option<~QueuePool>,
 }
 
 impl UvIoFactory {
     pub fn uv_loop<'a>(&mut self) -> *uvll::uv_loop_t { self.loop_.handle }
 
     pub fn make_handle(&mut self) -> HomeHandle {
-        HomeHandle::new(self.id(), &mut *self.handle_pool)
+        HomeHandle::new(self.id(), &mut **self.handle_pool.get_mut_ref())
     }
 }