[PATCH 3/3] ole32: Always grab a reference to apt in CoGetClassObject().
huw at codeweavers.com
Thu Mar 29 05:31:37 CDT 2018
On Wed, Mar 28, 2018 at 09:01:58PM -0500, Zebediah Figura wrote:
> Signed-off-by: Zebediah Figura <z.figura12 at gmail.com>
> In a sense this is just to make the code simpler, but the problem it causes
> would happen anyway. The basic problem is that destroying an apartment cleans
> up its proxy manager, which calls proxy_manager_get_remunknown() in order to
> release the IRemUnknown if it exists, and this may end up unmarshalling the
> IRemUnknown, triggering calls to CoGetClassObject (as well as CoGetPSClsid()
> etc.) Later it's also necessary to call apartment_get_current_or_mta() in
> proxy_manager_get_remunknown() itself. As far as I understand we wouldn't tear
> down the proxy manager from a different thread than the MTA was initialized
> on, but we might call proxy_manager_get_remunknown() from a different thread,
> so this is necessary.
> Alternate solutions, I guess:
> * Use the apartment's critical section instead. This seems existentially not
> quite appropriate, and it's not clear to me what all of the implications of
> this would be.
> * Try to restructure where the apartment is grabbed.
> * Perhaps don't even grab a reference to the MTA at all. This seems terrible
> on its face, but it also seems true that an app which closes the MTA while
> it's using an MTA object is pretty broken.
> There is quite a lot of DCOM about, so I'd at least appreciate help in
> determining whether this solution or any of the alternates is best.
This will need some thought. I'll get back to you.
More information about the wine-devel