Fix refcounting issues with waifs when pushing E_PROPNF.

sorressean · Mar 12, 2022 · 694b80a · 694b80a
1 parent acffcf3
commit 694b80a
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 4 deletions.
diff --git a/docs/ChangeLog.md b/docs/ChangeLog.md
@@ -19,6 +19,8 @@
 - Disable virtual timers when running under the Windows Subsystem for Linux. (This fixes things like `seconds_left()` returning 0.)
 - Fix a potential crash when threaded SQLite functions attempt to write object numbers.
 - Add a ceiling to `ctime()` to prevent overflows with large integer arguments.
+- Fix an issue where friendly tracebacks involving non-existent properties on waifs could crash the server.
+- Fix an issue where waifs could get stuck "recycling" forever.
 
 ### New Features
 - Support TLS / SSL connections in both `listen()` and `open_network_connection()`. Certificate and key can be configured in options.h, specifed as command-line arguments, or given as arguments to in-MOO functions. See warnings at the end of this changelog for important information about these changes.

diff --git a/src/execute.cc b/src/execute.cc
@@ -1935,7 +1935,7 @@ run(char raise, enum error resumption_error, Var * result)
                     err = waif_get_prop(obj.v.waif, propname.v.str, &prop, RUN_ACTIV.progr);
                     free_var(obj);
                     if (err == E_PROPNF)
-                        PUSH_X_NOT_FOUND(E_PROPNF, propname, var_ref(obj));
+                        PUSH_X_NOT_FOUND(E_PROPNF, var_ref(propname), obj);
                     else {
                         free_var(propname);
                         if (err == E_NONE)
@@ -1985,7 +1985,7 @@ run(char raise, enum error resumption_error, Var * result)
                     if (err == E_NONE)
                         PUSH(prop);
                     else if (err == E_PROPNF)
-                        PUSH_X_NOT_FOUND(E_PROPNF, propname, var_ref(obj));
+                        PUSH_X_NOT_FOUND(E_PROPNF, var_ref(propname), obj);
                     else
                         PUSH_ERROR(err);
                 } else if (!obj.is_object() || propname.type != TYPE_STR) {
@@ -2025,7 +2025,7 @@ run(char raise, enum error resumption_error, Var * result)
                     } else {
                         free_var(rhs);
                         if (err == E_PROPNF) {
-                            PUSH_X_NOT_FOUND(E_PROPNF, propname, var_ref(obj));
+                            PUSH_X_NOT_FOUND(E_PROPNF, var_ref(propname), obj);
                         } else {
                             free_var(propname);
                             PUSH_ERROR(err);

diff --git a/src/server.cc b/src/server.cc
@@ -671,7 +671,7 @@ recycle_waifs()
             destroyed_waifs[x.first] = true;
             /* Flag it as destroyed. Now we just wait for the refcount to hit zero so we can free it. */
         }
-        if (refcount(x.first) == 0) {
+        if (refcount(x.first) <= 0) {
             removals.push_back(x.first);
         }
     }