I had thought that because
g_source_destroy() was called for the two
sources (cancel and timeout) in the
GTask finalize function for a
threaded resolver operation, that it would be fine to use a plain
pointer in the source callbacks to point to the
That turns out to not be true: because the source callbacks are executed
in the GLib worker thread, and the
GTask can be finalized in another
thread, it’s possible for a source callback (e.g.
be scheduled in the worker thread, then for the
GTask to be finalized,
and then the source callback to continue execution and find itself
doing a use-after-free.
Fix that by using a weak ref to the
GTask in the source callbacks,
rather than a plain pointer.
Signed-off-by: Philip Withnall firstname.lastname@example.org
Fixes: #3105 (closed)
Closes #3105 (closed)