[PATCH 3/3] ole32: Always grab a reference to apt in CoGetClassObject().

[Huw Davies]

On Wed, Mar 28, 2018 at 09:01:58PM -0500, Zebediah Figura wrote:
> Signed-off-by: Zebediah Figura <z.figura12 at gmail.com>
> ---
> In a sense this is just to make the code simpler, but the problem it causes
> would happen anyway. The basic problem is that destroying an apartment cleans
> up its proxy manager, which calls proxy_manager_get_remunknown() in order to
> release the IRemUnknown if it exists, and this may end up unmarshalling the
> IRemUnknown, triggering calls to CoGetClassObject (as well as CoGetPSClsid()
> etc.) Later it's also necessary to call apartment_get_current_or_mta() in
> proxy_manager_get_remunknown() itself. As far as I understand we wouldn't tear
> down the proxy manager from a different thread than the MTA was initialized
> on, but we might call proxy_manager_get_remunknown() from a different thread,
> so this is necessary.
> 
> Alternate solutions, I guess:
> * Use the apartment's critical section instead. This seems existentially not
>   quite appropriate, and it's not clear to me what all of the implications of
>   this would be.
> * Try to restructure where the apartment is grabbed.
> * Perhaps don't even grab a reference to the MTA at all. This seems terrible
>   on its face, but it also seems true that an app which closes the MTA while
>   it's using an MTA object is pretty broken.
> There is quite a lot of DCOM about, so I'd at least appreciate help in
> determining whether this solution or any of the alternates is best.

This will need some thought.  I'll get back to you.

Huw.