-
Michael Stahl yazdı
OWeakObject::m_pWeakConnectionPoint is returned from OWeakObject::queryAdapter(), and stored in OWeakRefListener::m_xWeakConnectionPoint. This is cleared in OWeakRefListener::dispose(), called from OWeakConnectionPoint::dispose(), called from OWeakObject::disposeWeakConnectionPoint(), but it can happen that another thread is in WeakReferenceHelper::get() and has copied m_xWeakConnectionPoint onto the stack before the OWeakObject is released and deleted, then calls OWeakConnectionPoint::queryAdapted() after it is released, accessing the dead m_pObject. Change-Id: I7782e6fb7e07f5a48cf7064115217376714ba8e8
131e6040