commit 4d4fab1e60c18e89635ce099b50defede5e3f026
author Michael Lumish <mlumish@google.com> Thu Nov 09 09:31:05 2017 -0800
committer GitHub <noreply@github.com> Thu Nov 09 09:31:05 2017 -0800
tree fccfad1e4eb3d48d9fbbab78aca09695dd358db5
parent f4145c0a8f47e6ffeab5887c82c39d4fd9a51eee
parent 70e87c3dee2184c38426015e6c393f2d57a5154b

Merge pull request #13313 from murgatroid99/uv_assertion_fixes

Fix timer freed early in uv pollset

src/core/lib/iomgr/pollset_uv.cc

diff --git a/src/core/lib/iomgr/pollset_uv.cc b/src/core/lib/iomgr/pollset_uv.cc
index 6b9c53c..1d54942 100644
--- a/src/core/lib/iomgr/pollset_uv.cc
+++ b/src/core/lib/iomgr/pollset_uv.cc
@@ -40,7 +40,7 @@
 #endif
 
 struct grpc_pollset {
-  uv_timer_t timer;
+  uv_timer_t* timer;
   int shutting_down;
 };
 
@@ -78,12 +78,16 @@
 
 static void timer_run_cb(uv_timer_t* timer) {}
 
-static void timer_close_cb(uv_handle_t* handle) { handle->data = (void*)1; }
+static void timer_close_cb(uv_handle_t* handle) {
+  handle->data = (void*)1;
+  gpr_free(handle);
+}
 
 void grpc_pollset_init(grpc_pollset* pollset, gpr_mu** mu) {
   GRPC_UV_ASSERT_SAME_THREAD();
   *mu = &grpc_polling_mu;
-  uv_timer_init(uv_default_loop(), &pollset->timer);
+  pollset->timer = (uv_timer_t*)gpr_malloc(sizeof(uv_timer_t));
+  uv_timer_init(uv_default_loop(), pollset->timer);
   pollset->shutting_down = 0;
 }
 
@@ -104,11 +108,11 @@
 
 void grpc_pollset_destroy(grpc_exec_ctx* exec_ctx, grpc_pollset* pollset) {
   GRPC_UV_ASSERT_SAME_THREAD();
-  uv_close((uv_handle_t*)&pollset->timer, timer_close_cb);
+  uv_close((uv_handle_t*)pollset->timer, timer_close_cb);
   // timer.data is a boolean indicating that the timer has finished closing
-  pollset->timer.data = (void*)0;
+  pollset->timer->data = (void*)0;
   if (grpc_pollset_work_run_loop) {
-    while (!pollset->timer.data) {
+    while (!pollset->timer->data) {
       uv_run(uv_default_loop(), UV_RUN_NOWAIT);
     }
   }
@@ -130,11 +134,11 @@
     /* We special-case timeout=0 so that we don't bother with the timer when
        the loop won't block anyway */
     if (timeout > 0) {
-      uv_timer_start(&pollset->timer, timer_run_cb, timeout, 0);
+      uv_timer_start(pollset->timer, timer_run_cb, timeout, 0);
       /* Run until there is some I/O activity or the timer triggers. It doesn't
          matter which happens */
       uv_run(uv_default_loop(), UV_RUN_ONCE);
-      uv_timer_stop(&pollset->timer);
+      uv_timer_stop(pollset->timer);
     } else {
       uv_run(uv_default_loop(), UV_RUN_NOWAIT);
     }