[PATCH] Remove potential reference count races

[max at mtew.isa-geek.net]

From: Max TenEyck Woodbury <max at mtew.isa-geek.net>

---
 dlls/jscript/dispex.c |   34 +++++++++++++++++-----------------
 1 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/dlls/jscript/dispex.c b/dlls/jscript/dispex.c
index 211ed8a..0bba3ae 100644
--- a/dlls/jscript/dispex.c
+++ b/dlls/jscript/dispex.c
@@ -110,7 +110,7 @@ static const builtin_prop_t *find_builtin_prop(jsdisp_t *This, const WCHAR *name
 static inline unsigned string_hash(const WCHAR *name)
 {
     unsigned h = 0;
-    for(; *name; name++)
+    for(; *name; ++name)
         h = (h>>(sizeof(unsigned)*8-4)) ^ (h<<4) ^ tolowerW(*name);
     return h;
 }
@@ -134,12 +134,12 @@ static inline HRESULT resize_props(jsdisp_t *This)
     This->buf_size *= 2;
     This->props = props;
 
-    for(i=0; i<This->buf_size; i++) {
+    for(i=0; i<This->buf_size; ++i) {
         This->props[i].bucket_head = 0;
         This->props[i].bucket_next = 0;
     }
 
-    for(i=1; i<This->prop_cnt; i++) {
+    for(i=1; i<This->prop_cnt; ++i) {
         props = This->props+i;
 
         bucket = get_props_idx(This, props->hash);
@@ -296,7 +296,7 @@ static IDispatch *get_this(DISPPARAMS *dp)
 {
     DWORD i;
 
-    for(i=0; i < dp->cNamedArgs; i++) {
+    for(i=0; i < dp->cNamedArgs; ++i) {
         if(dp->rgdispidNamedArgs[i] == DISPID_THIS) {
             if(V_VT(dp->rgvarg+i) == VT_DISPATCH)
                 return V_DISPATCH(dp->rgvarg+i);
@@ -327,7 +327,7 @@ static HRESULT convert_params(const DISPPARAMS *dp, jsval_t *buf, unsigned *argc
         argv = buf;
     }
 
-    for(i = 0; i < cnt; i++) {
+    for(i = 0; i < cnt; ++i) {
         hres = variant_to_jsval(dp->rgvarg+dp->cArgs-i-1, argv+i);
         if(FAILED(hres)) {
             while(i--)
@@ -492,7 +492,7 @@ static HRESULT fill_protrefs(jsdisp_t *This)
 
     fill_protrefs(This->prototype);
 
-    for(iter = This->prototype->props; iter < This->prototype->props+This->prototype->prop_cnt; iter++) {
+    for(iter = This->prototype->props; iter < This->prototype->props+This->prototype->prop_cnt; ++iter) {
         if(!iter->name)
             continue;
         hres = find_prop_name(This, iter->hash, iter->name, &prop);
@@ -557,7 +557,7 @@ static ULONG WINAPI DispatchEx_AddRef(IDispatchEx *iface)
 static ULONG WINAPI DispatchEx_Release(IDispatchEx *iface)
 {
     jsdisp_t *This = impl_from_IDispatchEx(iface);
-    ULONG ref = --This->ref;
+    ULONG ref = InterlockedDecrement(&This->ref);
     if(!ref)
         jsdisp_free(This);
     return ref;
@@ -592,7 +592,7 @@ static HRESULT WINAPI DispatchEx_GetIDsOfNames(IDispatchEx *iface, REFIID riid,
     TRACE("(%p)->(%s %p %u %u %p)\n", This, debugstr_guid(riid), rgszNames, cNames,
           lcid, rgDispId);
 
-    for(i=0; i < cNames; i++) {
+    for(i=0; i < cNames; ++i) {
         hres = IDispatchEx_GetDispID(&This->IDispatchEx_iface, rgszNames[i], 0, rgDispId+i);
         if(FAILED(hres))
             return hres;
@@ -684,7 +684,7 @@ static HRESULT WINAPI DispatchEx_InvokeEx(IDispatchEx *iface, DISPID id, LCID lc
         jsval_t val;
         DWORD i;
 
-        for(i=0; i < pdp->cNamedArgs; i++) {
+        for(i=0; i < pdp->cNamedArgs; ++i) {
             if(pdp->rgdispidNamedArgs[i] == DISPID_PROPERTYPUT)
                 break;
         }
@@ -810,7 +810,7 @@ static HRESULT WINAPI DispatchEx_GetNextDispID(IDispatchEx *iface, DWORD grfdex,
             *pid = prop_to_id(This, iter);
             return S_OK;
         }
-        iter++;
+        ++iter;
     }
 
     *pid = DISPID_STARTENUM;
@@ -914,7 +914,7 @@ void jsdisp_free(jsdisp_t *obj)
 
     TRACE("(%p)\n", obj);
 
-    for(prop = obj->props; prop < obj->props+obj->prop_cnt; prop++) {
+    for(prop = obj->props; prop < obj->props+obj->prop_cnt; ++prop) {
         if(prop->type == PROP_JSVAL)
             jsval_release(prop->u.val);
         heap_free(prop->name);
@@ -934,14 +934,14 @@ void jsdisp_free(jsdisp_t *obj)
 
 jsdisp_t *jsdisp_addref(jsdisp_t *jsdisp)
 {
-    ULONG ref = ++jsdisp->ref;
+    ULONG ref = InterlockedIncrement(&jsdisp->ref);
     TRACE("(%p) ref=%d\n", jsdisp, ref);
     return jsdisp;
 }
 
 void jsdisp_release(jsdisp_t *jsdisp)
 {
-    ULONG ref = --jsdisp->ref;
+    ULONG ref = InterlockedDecrement(&jsdisp->ref);
 
     TRACE("(%p) ref=%d\n", jsdisp, ref);
 
@@ -1097,7 +1097,7 @@ HRESULT disp_call(script_ctx_t *ctx, IDispatch *disp, DISPID id, WORD flags, uns
         dp.rgvarg = buf;
     }
 
-    for(i=0; i<argc; i++) {
+    for(i=0; i<argc; ++i) {
         hres = jsval_to_variant(argv[i], dp.rgvarg+argc-i-1);
         if(FAILED(hres)) {
             while(i--)
@@ -1127,7 +1127,7 @@ HRESULT disp_call(script_ctx_t *ctx, IDispatch *disp, DISPID id, WORD flags, uns
         hres = IDispatch_Invoke(disp, id, &IID_NULL, ctx->lcid, flags, &dp, ret ? &retv : NULL, &ctx->ei.ei, &err);
     }
 
-    for(i=0; i<argc; i++)
+    for(i=0; i<argc; ++i)
         VariantClear(dp.rgvarg+argc-i-1);
     if(dp.rgvarg != buf)
         heap_free(dp.rgvarg);
@@ -1187,7 +1187,7 @@ HRESULT disp_call_value(script_ctx_t *ctx, IDispatch *disp, IDispatch *jsthis, W
         dp.rgvarg = buf;
     }
 
-    for(i=0; i<argc; i++) {
+    for(i=0; i<argc; ++i) {
         hres = jsval_to_variant(argv[i], dp.rgvarg+dp.cArgs-i-1);
         if(FAILED(hres)) {
             while(i--)
@@ -1221,7 +1221,7 @@ HRESULT disp_call_value(script_ctx_t *ctx, IDispatch *disp, IDispatch *jsthis, W
         hres = IDispatch_Invoke(disp, DISPID_VALUE, &IID_NULL, ctx->lcid, flags, &dp, r ? &retv : NULL, &ctx->ei.ei, &err);
     }
 
-    for(i=0; i<argc; i++)
+    for(i=0; i<argc; ++i)
         VariantClear(dp.rgvarg+dp.cArgs-i-1);
     if(dp.rgvarg != buf)
         heap_free(dp.rgvarg);
-- 
1.7.7.6