From: Christos Tsantilas <chtsanti@users.sourceforge.net>
Date: Mon, 11 May 2015 15:50:30 +0000 (-0700)
Subject: Bug 4238: assertion Read.cc:205: "params.data == data"
X-Git-Tag: SQUID_3_5_5~15
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ea56962faed8bd1b0a04418c4bc96becae327a19;p=thirdparty%2Fsquid.git

Bug 4238: assertion Read.cc:205: "params.data == data"

Inside IdleConnList::findUseable the IdleConnList::removeAt call can delete
"this" IdleConnList object. The IdleConnList::clearHandlers called imediatelly
after the removeAt method, will try to use the invalid "this" object in
a comm_read_cancel function call, causing this assertion or other similar.

This patch fixes the IdleConnList::findUseable, IdleConnList::pop and
IdleConnList::findAndClose methods to call IdleConnList::clearHandlers before
the IdleConnList::removeAt is called.

This is a Measurement Factory project
---

diff --git a/src/pconn.cc b/src/pconn.cc
index 6e1b1cf1a9..f8a7b398ca 100644
--- a/src/pconn.cc
+++ b/src/pconn.cc
@@ -218,9 +218,9 @@ IdleConnList::pop()
 
         // finally, a match. pop and return it.
         Comm::ConnectionPointer result = theList_[i];
+        clearHandlers(result);
         /* may delete this */
         removeAt(i);
-        clearHandlers(result);
         return result;
     }
 
@@ -264,9 +264,9 @@ IdleConnList::findUseable(const Comm::ConnectionPointer &key)
 
         // finally, a match. pop and return it.
         Comm::ConnectionPointer result = theList_[i];
+        clearHandlers(result);
         /* may delete this */
         removeAt(i);
-        clearHandlers(result);
         return result;
     }
 
@@ -281,9 +281,9 @@ IdleConnList::findAndClose(const Comm::ConnectionPointer &conn)
     if (index >= 0) {
         if (parent_)
             parent_->notifyManager("idle conn closure");
+        clearHandlers(conn);
         /* might delete this */
         removeAt(index);
-        clearHandlers(conn);
         conn->close();
     }
 }