ref: don't leave dangling pointers around when freeing Dav1dRef

Signed-off-by: James Almer <jamrial@gmail.com>

src/cdf.c

@@ -4232,7 +4232,7 @@ void dav1d_cdf_thread_ref(CdfThreadContext *const dst,
 }
 
 void dav1d_cdf_thread_unref(CdfThreadContext *const cdf) {
-    dav1d_ref_dec(cdf->ref);
+    dav1d_ref_dec(&cdf->ref);
     memset(cdf, 0, sizeof(*cdf));
 }
 

src/data.c

@@ -69,7 +69,7 @@ void dav1d_data_unref(Dav1dData *const buf) {
 
     if (buf->ref) {
         validate_input(buf->data != NULL);
-        dav1d_ref_dec(buf->ref);
+        dav1d_ref_dec(&buf->ref);
     }
     memset(buf, 0, sizeof(*buf));
 }

src/decode.c

@@ -2760,20 +2760,16 @@ error:
     for (int i = 0; i < 7; i++) {
         if (f->refp[i].p.data[0])
             dav1d_thread_picture_unref(&f->refp[i]);
-        if (f->ref_mvs_ref[i])
-            dav1d_ref_dec(f->ref_mvs_ref[i]);
+        dav1d_ref_dec(&f->ref_mvs_ref[i]);
     }
 
     dav1d_thread_picture_unref(&f->cur);
     dav1d_cdf_thread_unref(&f->in_cdf);
     if (f->frame_hdr.refresh_context)
             dav1d_cdf_thread_unref(&f->out_cdf);
-    if (f->cur_segmap_ref)
-        dav1d_ref_dec(f->cur_segmap_ref);
-    if (f->prev_segmap_ref)
-        dav1d_ref_dec(f->prev_segmap_ref);
-    if (f->mvs_ref)
-        dav1d_ref_dec(f->mvs_ref);
+    dav1d_ref_dec(&f->cur_segmap_ref);
+    dav1d_ref_dec(&f->prev_segmap_ref);
+    dav1d_ref_dec(&f->mvs_ref);
 
     for (int i = 0; i < f->n_tile_data; i++)
         dav1d_data_unref(&f->tile[i].data);
@@ -3017,16 +3013,12 @@ int dav1d_submit_frame(Dav1dContext *const c) {
             memcpy(c->refs[i].gmv, f->frame_hdr.gmv, sizeof(c->refs[i].gmv));
             c->refs[i].film_grain = f->frame_hdr.film_grain.data;
 
-            if (c->refs[i].segmap)
-                dav1d_ref_dec(c->refs[i].segmap);
+            dav1d_ref_dec(&c->refs[i].segmap);
             c->refs[i].segmap = f->cur_segmap_ref;
             if (f->cur_segmap_ref)
                 dav1d_ref_inc(f->cur_segmap_ref);
-            if (c->refs[i].refmvs)
-                dav1d_ref_dec(c->refs[i].refmvs);
-            if (f->frame_hdr.allow_intrabc) {
-                c->refs[i].refmvs = NULL;
-            } else {
+            dav1d_ref_dec(&c->refs[i].refmvs);
+            if (!f->frame_hdr.allow_intrabc) {
                 c->refs[i].refmvs = f->mvs_ref;
                 if (f->mvs_ref)
                     dav1d_ref_inc(f->mvs_ref);
@@ -3045,14 +3037,8 @@ int dav1d_submit_frame(Dav1dContext *const c) {
                         dav1d_thread_picture_unref(&c->refs[i].p);
                     if (c->cdf[i].cdf)
                         dav1d_cdf_thread_unref(&c->cdf[i]);
-                    if (c->refs[i].segmap) {
-                        dav1d_ref_dec(c->refs[i].segmap);
-                        c->refs[i].segmap = NULL;
-                    }
-                    if (c->refs[i].refmvs) {
-                        dav1d_ref_dec(c->refs[i].refmvs);
-                        c->refs[i].refmvs = NULL;
-                    }
+                    dav1d_ref_dec(&c->refs[i].segmap);
+                    dav1d_ref_dec(&c->refs[i].refmvs);
                 }
             }
             return res;
@@ -3070,13 +3056,11 @@ error:
     for (int i = 0; i < 7; i++) {
         if (f->refp[i].p.data[0])
             dav1d_thread_picture_unref(&f->refp[i]);
-        if (f->ref_mvs_ref[i])
-            dav1d_ref_dec(f->ref_mvs_ref[i]);
+        dav1d_ref_dec(&f->ref_mvs_ref[i]);
     }
     dav1d_picture_unref(&c->out);
     dav1d_thread_picture_unref(&f->cur);
-    if (f->mvs_ref)
-        dav1d_ref_dec(f->mvs_ref);
+    dav1d_ref_dec(&f->mvs_ref);
 
     for (int i = 0; i < f->n_tile_data; i++)
         dav1d_data_unref(&f->tile[i].data);

src/lib.c

@@ -313,10 +313,8 @@ void dav1d_close(Dav1dContext **const c_out) {
             dav1d_cdf_thread_unref(&c->cdf[n]);
         if (c->refs[n].p.p.data[0])
             dav1d_thread_picture_unref(&c->refs[n].p);
-        if (c->refs[n].refmvs)
-            dav1d_ref_dec(c->refs[n].refmvs);
-        if (c->refs[n].segmap)
-            dav1d_ref_dec(c->refs[n].segmap);
+        dav1d_ref_dec(&c->refs[n].refmvs);
+        dav1d_ref_dec(&c->refs[n].segmap);
     }
     dav1d_freep_aligned(c_out);
 }

src/obu.c

@@ -1059,14 +1059,8 @@ int dav1d_parse_obus(Dav1dContext *const c, Dav1dData *const in) {
             for (int i = 0; i < 8; i++) {
                 if (c->refs[i].p.p.data[0])
                     dav1d_thread_picture_unref(&c->refs[i].p);
-                if (c->refs[i].segmap) {
-                    dav1d_ref_dec(c->refs[i].segmap);
-                    c->refs[i].segmap = NULL;
-                }
-                if (c->refs[i].refmvs) {
-                    dav1d_ref_dec(c->refs[i].refmvs);
-                    c->refs[i].refmvs = NULL;
-                }
+                dav1d_ref_dec(&c->refs[i].segmap);
+                dav1d_ref_dec(&c->refs[i].refmvs);
                 if (c->cdf[i].cdf)
                     dav1d_cdf_thread_unref(&c->cdf[i]);
             }
@@ -1188,14 +1182,11 @@ int dav1d_parse_obus(Dav1dContext *const c, Dav1dData *const in) {
                     c->refs[i].gmv[j] = dav1d_default_wm_params;
                 c->refs[i].film_grain = c->refs[r].film_grain;
 
-                if (c->refs[i].segmap)
-                    dav1d_ref_dec(c->refs[i].segmap);
+                dav1d_ref_dec(&c->refs[i].segmap);
                 c->refs[i].segmap = c->refs[r].segmap;
                 if (c->refs[r].segmap)
                     dav1d_ref_inc(c->refs[r].segmap);
-                if (c->refs[i].refmvs)
-                    dav1d_ref_dec(c->refs[i].refmvs);
-                c->refs[i].refmvs = NULL;
+                dav1d_ref_dec(&c->refs[i].refmvs);
                 c->refs[i].qidx = c->refs[r].qidx;
             }
         }

src/picture.c

@@ -198,7 +198,7 @@ void dav1d_picture_unref(Dav1dPicture *const p) {
 
     if (p->ref) {
         validate_input(p->data[0] != NULL);
-        dav1d_ref_dec(p->ref);
+        dav1d_ref_dec(&p->ref);
     }
     memset(p, 0, sizeof(*p));
 }

src/ref.c

@@ -72,9 +72,14 @@ void dav1d_ref_inc(Dav1dRef *const ref) {
     atomic_fetch_add(&ref->ref_cnt, 1);
 }
 
-void dav1d_ref_dec(Dav1dRef *const ref) {
+void dav1d_ref_dec(Dav1dRef **const pref) {
+    assert(pref != NULL);
+
+    Dav1dRef *const ref = *pref;
+    if (!ref) return;
+
     if (atomic_fetch_sub(&ref->ref_cnt, 1) == 1) {
         ref->free_callback(ref->const_data, ref->user_data);
-        free(ref);
+        freep(pref);
     }
 }

src/ref.h

@@ -46,6 +46,6 @@ Dav1dRef *dav1d_ref_wrap(const uint8_t *ptr,
                          void (*free_callback)(const uint8_t *data, void *user_data),
                          void *user_data);
 void dav1d_ref_inc(Dav1dRef *ref);
-void dav1d_ref_dec(Dav1dRef *ref);
+void dav1d_ref_dec(Dav1dRef **ref);
 
 #endif /* __DAV1D_SRC_REF_H__ */