ref: don't leave dangling pointers around when freeing Dav1dRef

Signed-off-by: James Almer's avatarJames Almer <jamrial@gmail.com>
parent 6fd4013a
...@@ -4232,7 +4232,7 @@ void dav1d_cdf_thread_ref(CdfThreadContext *const dst, ...@@ -4232,7 +4232,7 @@ void dav1d_cdf_thread_ref(CdfThreadContext *const dst,
} }
void dav1d_cdf_thread_unref(CdfThreadContext *const cdf) { void dav1d_cdf_thread_unref(CdfThreadContext *const cdf) {
dav1d_ref_dec(cdf->ref); dav1d_ref_dec(&cdf->ref);
memset(cdf, 0, sizeof(*cdf)); memset(cdf, 0, sizeof(*cdf));
} }
......
...@@ -69,7 +69,7 @@ void dav1d_data_unref(Dav1dData *const buf) { ...@@ -69,7 +69,7 @@ void dav1d_data_unref(Dav1dData *const buf) {
if (buf->ref) { if (buf->ref) {
validate_input(buf->data != NULL); validate_input(buf->data != NULL);
dav1d_ref_dec(buf->ref); dav1d_ref_dec(&buf->ref);
} }
memset(buf, 0, sizeof(*buf)); memset(buf, 0, sizeof(*buf));
} }
...@@ -2760,20 +2760,16 @@ error: ...@@ -2760,20 +2760,16 @@ error:
for (int i = 0; i < 7; i++) { for (int i = 0; i < 7; i++) {
if (f->refp[i].p.data[0]) if (f->refp[i].p.data[0])
dav1d_thread_picture_unref(&f->refp[i]); dav1d_thread_picture_unref(&f->refp[i]);
if (f->ref_mvs_ref[i]) dav1d_ref_dec(&f->ref_mvs_ref[i]);
dav1d_ref_dec(f->ref_mvs_ref[i]);
} }
dav1d_thread_picture_unref(&f->cur); dav1d_thread_picture_unref(&f->cur);
dav1d_cdf_thread_unref(&f->in_cdf); dav1d_cdf_thread_unref(&f->in_cdf);
if (f->frame_hdr.refresh_context) if (f->frame_hdr.refresh_context)
dav1d_cdf_thread_unref(&f->out_cdf); dav1d_cdf_thread_unref(&f->out_cdf);
if (f->cur_segmap_ref) dav1d_ref_dec(&f->cur_segmap_ref);
dav1d_ref_dec(f->cur_segmap_ref); dav1d_ref_dec(&f->prev_segmap_ref);
if (f->prev_segmap_ref) dav1d_ref_dec(&f->mvs_ref);
dav1d_ref_dec(f->prev_segmap_ref);
if (f->mvs_ref)
dav1d_ref_dec(f->mvs_ref);
for (int i = 0; i < f->n_tile_data; i++) for (int i = 0; i < f->n_tile_data; i++)
dav1d_data_unref(&f->tile[i].data); dav1d_data_unref(&f->tile[i].data);
...@@ -3017,16 +3013,12 @@ int dav1d_submit_frame(Dav1dContext *const c) { ...@@ -3017,16 +3013,12 @@ int dav1d_submit_frame(Dav1dContext *const c) {
memcpy(c->refs[i].gmv, f->frame_hdr.gmv, sizeof(c->refs[i].gmv)); memcpy(c->refs[i].gmv, f->frame_hdr.gmv, sizeof(c->refs[i].gmv));
c->refs[i].film_grain = f->frame_hdr.film_grain.data; c->refs[i].film_grain = f->frame_hdr.film_grain.data;
if (c->refs[i].segmap) dav1d_ref_dec(&c->refs[i].segmap);
dav1d_ref_dec(c->refs[i].segmap);
c->refs[i].segmap = f->cur_segmap_ref; c->refs[i].segmap = f->cur_segmap_ref;
if (f->cur_segmap_ref) if (f->cur_segmap_ref)
dav1d_ref_inc(f->cur_segmap_ref); dav1d_ref_inc(f->cur_segmap_ref);
if (c->refs[i].refmvs) dav1d_ref_dec(&c->refs[i].refmvs);
dav1d_ref_dec(c->refs[i].refmvs); if (!f->frame_hdr.allow_intrabc) {
if (f->frame_hdr.allow_intrabc) {
c->refs[i].refmvs = NULL;
} else {
c->refs[i].refmvs = f->mvs_ref; c->refs[i].refmvs = f->mvs_ref;
if (f->mvs_ref) if (f->mvs_ref)
dav1d_ref_inc(f->mvs_ref); dav1d_ref_inc(f->mvs_ref);
...@@ -3045,14 +3037,8 @@ int dav1d_submit_frame(Dav1dContext *const c) { ...@@ -3045,14 +3037,8 @@ int dav1d_submit_frame(Dav1dContext *const c) {
dav1d_thread_picture_unref(&c->refs[i].p); dav1d_thread_picture_unref(&c->refs[i].p);
if (c->cdf[i].cdf) if (c->cdf[i].cdf)
dav1d_cdf_thread_unref(&c->cdf[i]); dav1d_cdf_thread_unref(&c->cdf[i]);
if (c->refs[i].segmap) { dav1d_ref_dec(&c->refs[i].segmap);
dav1d_ref_dec(c->refs[i].segmap); dav1d_ref_dec(&c->refs[i].refmvs);
c->refs[i].segmap = NULL;
}
if (c->refs[i].refmvs) {
dav1d_ref_dec(c->refs[i].refmvs);
c->refs[i].refmvs = NULL;
}
} }
} }
return res; return res;
...@@ -3070,13 +3056,11 @@ error: ...@@ -3070,13 +3056,11 @@ error:
for (int i = 0; i < 7; i++) { for (int i = 0; i < 7; i++) {
if (f->refp[i].p.data[0]) if (f->refp[i].p.data[0])
dav1d_thread_picture_unref(&f->refp[i]); dav1d_thread_picture_unref(&f->refp[i]);
if (f->ref_mvs_ref[i]) dav1d_ref_dec(&f->ref_mvs_ref[i]);
dav1d_ref_dec(f->ref_mvs_ref[i]);
} }
dav1d_picture_unref(&c->out); dav1d_picture_unref(&c->out);
dav1d_thread_picture_unref(&f->cur); dav1d_thread_picture_unref(&f->cur);
if (f->mvs_ref) dav1d_ref_dec(&f->mvs_ref);
dav1d_ref_dec(f->mvs_ref);
for (int i = 0; i < f->n_tile_data; i++) for (int i = 0; i < f->n_tile_data; i++)
dav1d_data_unref(&f->tile[i].data); dav1d_data_unref(&f->tile[i].data);
......
...@@ -313,10 +313,8 @@ void dav1d_close(Dav1dContext **const c_out) { ...@@ -313,10 +313,8 @@ void dav1d_close(Dav1dContext **const c_out) {
dav1d_cdf_thread_unref(&c->cdf[n]); dav1d_cdf_thread_unref(&c->cdf[n]);
if (c->refs[n].p.p.data[0]) if (c->refs[n].p.p.data[0])
dav1d_thread_picture_unref(&c->refs[n].p); dav1d_thread_picture_unref(&c->refs[n].p);
if (c->refs[n].refmvs) dav1d_ref_dec(&c->refs[n].refmvs);
dav1d_ref_dec(c->refs[n].refmvs); dav1d_ref_dec(&c->refs[n].segmap);
if (c->refs[n].segmap)
dav1d_ref_dec(c->refs[n].segmap);
} }
dav1d_freep_aligned(c_out); dav1d_freep_aligned(c_out);
} }
...@@ -1059,14 +1059,8 @@ int dav1d_parse_obus(Dav1dContext *const c, Dav1dData *const in) { ...@@ -1059,14 +1059,8 @@ int dav1d_parse_obus(Dav1dContext *const c, Dav1dData *const in) {
for (int i = 0; i < 8; i++) { for (int i = 0; i < 8; i++) {
if (c->refs[i].p.p.data[0]) if (c->refs[i].p.p.data[0])
dav1d_thread_picture_unref(&c->refs[i].p); dav1d_thread_picture_unref(&c->refs[i].p);
if (c->refs[i].segmap) { dav1d_ref_dec(&c->refs[i].segmap);
dav1d_ref_dec(c->refs[i].segmap); dav1d_ref_dec(&c->refs[i].refmvs);
c->refs[i].segmap = NULL;
}
if (c->refs[i].refmvs) {
dav1d_ref_dec(c->refs[i].refmvs);
c->refs[i].refmvs = NULL;
}
if (c->cdf[i].cdf) if (c->cdf[i].cdf)
dav1d_cdf_thread_unref(&c->cdf[i]); dav1d_cdf_thread_unref(&c->cdf[i]);
} }
...@@ -1188,14 +1182,11 @@ int dav1d_parse_obus(Dav1dContext *const c, Dav1dData *const in) { ...@@ -1188,14 +1182,11 @@ int dav1d_parse_obus(Dav1dContext *const c, Dav1dData *const in) {
c->refs[i].gmv[j] = dav1d_default_wm_params; c->refs[i].gmv[j] = dav1d_default_wm_params;
c->refs[i].film_grain = c->refs[r].film_grain; c->refs[i].film_grain = c->refs[r].film_grain;
if (c->refs[i].segmap) dav1d_ref_dec(&c->refs[i].segmap);
dav1d_ref_dec(c->refs[i].segmap);
c->refs[i].segmap = c->refs[r].segmap; c->refs[i].segmap = c->refs[r].segmap;
if (c->refs[r].segmap) if (c->refs[r].segmap)
dav1d_ref_inc(c->refs[r].segmap); dav1d_ref_inc(c->refs[r].segmap);
if (c->refs[i].refmvs) dav1d_ref_dec(&c->refs[i].refmvs);
dav1d_ref_dec(c->refs[i].refmvs);
c->refs[i].refmvs = NULL;
c->refs[i].qidx = c->refs[r].qidx; c->refs[i].qidx = c->refs[r].qidx;
} }
} }
......
...@@ -198,7 +198,7 @@ void dav1d_picture_unref(Dav1dPicture *const p) { ...@@ -198,7 +198,7 @@ void dav1d_picture_unref(Dav1dPicture *const p) {
if (p->ref) { if (p->ref) {
validate_input(p->data[0] != NULL); validate_input(p->data[0] != NULL);
dav1d_ref_dec(p->ref); dav1d_ref_dec(&p->ref);
} }
memset(p, 0, sizeof(*p)); memset(p, 0, sizeof(*p));
} }
......
...@@ -72,9 +72,14 @@ void dav1d_ref_inc(Dav1dRef *const ref) { ...@@ -72,9 +72,14 @@ void dav1d_ref_inc(Dav1dRef *const ref) {
atomic_fetch_add(&ref->ref_cnt, 1); atomic_fetch_add(&ref->ref_cnt, 1);
} }
void dav1d_ref_dec(Dav1dRef *const ref) { void dav1d_ref_dec(Dav1dRef **const pref) {
assert(pref != NULL);
Dav1dRef *const ref = *pref;
if (!ref) return;
if (atomic_fetch_sub(&ref->ref_cnt, 1) == 1) { if (atomic_fetch_sub(&ref->ref_cnt, 1) == 1) {
ref->free_callback(ref->const_data, ref->user_data); ref->free_callback(ref->const_data, ref->user_data);
free(ref); freep(pref);
} }
} }
...@@ -46,6 +46,6 @@ Dav1dRef *dav1d_ref_wrap(const uint8_t *ptr, ...@@ -46,6 +46,6 @@ Dav1dRef *dav1d_ref_wrap(const uint8_t *ptr,
void (*free_callback)(const uint8_t *data, void *user_data), void (*free_callback)(const uint8_t *data, void *user_data),
void *user_data); void *user_data);
void dav1d_ref_inc(Dav1dRef *ref); void dav1d_ref_inc(Dav1dRef *ref);
void dav1d_ref_dec(Dav1dRef *ref); void dav1d_ref_dec(Dav1dRef **ref);
#endif /* __DAV1D_SRC_REF_H__ */ #endif /* __DAV1D_SRC_REF_H__ */
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment