---

yaml
---
r: 96932
b: refs/heads/dist-snap
c: e121d75
h: refs/heads/master
v: v3

Author: alexcrichton

[refs]

@@ -6,7 +6,7 @@ refs/heads/try: c274a6888410ce3e357e014568b43310ed787d36
 refs/tags/release-0.1: 1f5c5126e96c79d22cb7862f75304136e204f105
 refs/heads/ndm: f3868061cd7988080c30d6d5bf352a5a5fe2460b
 refs/heads/try2: 147ecfdd8221e4a4d4e090486829a06da1e0ca3c
-refs/heads/dist-snap: 51c03c1f35f6b076928a1e5b94ec81e6d00c3ac2
+refs/heads/dist-snap: e121d7556cc577c7a89acb3a609fcafcc8fc9204
 refs/tags/release-0.2: c870d2dffb391e14efb05aa27898f1f6333a9596
 refs/tags/release-0.3: b5f0d0f648d9a6153664837026ba1be43d3e2503
 refs/heads/try3: 9387340aab40a73e8424c48fd42f0c521a4875c0

branches/dist-snap/src/librustuv/uvio.rs

@@ -57,14 +57,18 @@ impl UvEventLoop {
         UvEventLoop {
             uvio: UvIoFactory {
                 loop_: loop_,
-                handle_pool: handle_pool,
+                handle_pool: Some(handle_pool),
             }
         }
     }
 }
 
 impl Drop for UvEventLoop {
     fn drop(&mut self) {
+        // Must first destroy the pool of handles before we destroy the loop
+        // because otherwise the contained async handle will be destroyed after
+        // the loop is free'd (use-after-free)
+        self.uvio.handle_pool.take();
         self.uvio.loop_.close();
     }
 }
@@ -117,14 +121,14 @@ fn test_callback_run_once() {
 
 pub struct UvIoFactory {
     loop_: Loop,
-    priv handle_pool: ~QueuePool,
+    priv handle_pool: Option<~QueuePool>,
 }
 
 impl UvIoFactory {
     pub fn uv_loop<'a>(&mut self) -> *uvll::uv_loop_t { self.loop_.handle }
 
     pub fn make_handle(&mut self) -> HomeHandle {
-        HomeHandle::new(self.id(), &mut *self.handle_pool)
+        HomeHandle::new(self.id(), &mut **self.handle_pool.get_mut_ref())
     }
 }