<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>20777</bug_id>
          
          <creation_ts>2008-09-11 03:57:44 -0700</creation_ts>
          <short_desc>[CURL] memory leak of ResouceHandles</short_desc>
          <delta_ts>2008-12-19 08:03:58 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebKitGTK</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>Curl</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Marco Barisione">marco.barisione</reporter>
          <assigned_to name="Marco Barisione">marco.barisione</assigned_to>
          <cc>fmarmond</cc>
    
    <cc>marco.barisione</cc>
    
    <cc>mike.emmel</cc>
    
    <cc>zaheer.mot</cc>
    
    <cc>zuh</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>90841</commentid>
    <comment_count>0</comment_count>
    <who name="Marco Barisione">marco.barisione</who>
    <bug_when>2008-09-11 03:57:44 -0700</bug_when>
    <thetext>ResourceHandle::start increases the ref count of the handle but this is never decrease so we leak ResourceHandles, see
See https://lists.webkit.org/pipermail/webkit-dev/2008-September/004851.html

Patch coming soon.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>90842</commentid>
    <comment_count>1</comment_count>
      <attachid>23343</attachid>
    <who name="Marco Barisione">marco.barisione</who>
    <bug_when>2008-09-11 04:07:35 -0700</bug_when>
    <thetext>Created attachment 23343
Fix the leak

Delete the ResourceHandle when the job is completed or there is an error. I used delete directly instead of deref because the win port is doing the same.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>90868</commentid>
    <comment_count>2</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2008-09-11 09:34:41 -0700</bug_when>
    <thetext>
This probably causes a crash it did last time I tried it. You need to verify that the loader code which owns the handle never references it past this point.

I had to deref in the next run of the event loop.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>90869</commentid>
    <comment_count>3</comment_count>
    <who name="Marco Barisione">marco.barisione</who>
    <bug_when>2008-09-11 09:41:07 -0700</bug_when>
    <thetext>(In reply to comment #2)
&gt; This probably causes a crash it did last time I tried it. You need to verify
&gt; that the loader code which owns the handle never references it past this point.

I used WebKit compiled with this patch for normal navigation and I didn&apos;t get any crash, but probably there are corner cases they I was not able to reproduce.
 
&gt; I had to deref in the next run of the event loop.

I wonder why the win port uses delete instead of deref, if we want to be more sure that nothing bad is going to happen we could deref the ResourceHandle in the next run of the event loop.

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>90870</commentid>
    <comment_count>4</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2008-09-11 09:45:22 -0700</bug_when>
    <thetext>
Have you looked at the ncurl patch ?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>90958</commentid>
    <comment_count>5</comment_count>
      <attachid>23343</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-09-12 12:26:57 -0700</bug_when>
    <thetext>Comment on attachment 23343
Fix the leak

I hate this kind of memory management.  (Nothing personal).  Could we change this API so that it either used ref-counting, or didn&apos;t have this kind of single-ownership memory model burried inside these functions which are named &quot;remove&quot; and not &quot;destroy&quot;.  Why is it clear that passing something for removal should destroy it!?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>90962</commentid>
    <comment_count>6</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2008-09-12 12:46:04 -0700</bug_when>
    <thetext>(In reply to comment #5)
&gt; (From update of attachment 23343 [edit])
&gt; I hate this kind of memory management.  (Nothing personal).  Could we change
&gt; this API so that it either used ref-counting, or didn&apos;t have this kind of
&gt; single-ownership memory model burried inside these functions which are named
&gt; &quot;remove&quot; and not &quot;destroy&quot;.  Why is it clear that passing something for removal
&gt; should destroy it!?
&gt; 

Eric if the loader would up the reference count by one we can drop ours at the right time and destroy the backend resources correctly. The ref count should be two IMHO.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>94230</commentid>
    <comment_count>7</comment_count>
    <who name="Marco Barisione">marco.barisione</who>
    <bug_when>2008-10-06 08:34:23 -0700</bug_when>
    <thetext>(In reply to comment #5)
&gt; (From update of attachment 23343 [edit])
&gt; I hate this kind of memory management.  (Nothing personal).  Could we change
&gt; this API so that it either used ref-counting, or didn&apos;t have this kind of
&gt; single-ownership memory model burried inside these functions which are named
&gt; &quot;remove&quot; and not &quot;destroy&quot;.  Why is it clear that passing something for removal
&gt; should destroy it!?

I&apos;m not sure to understand what you mean. I copied the direct use of delete from the Windows port, would be enough for you to deref the object instead of deleting it?

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>94235</commentid>
    <comment_count>8</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2008-10-06 10:17:14 -0700</bug_when>
    <thetext>
Unless the code has changed you will see that the Ref is still accessed in the loader.
By using delete the memory is referenced after its freed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>96172</commentid>
    <comment_count>9</comment_count>
    <who name="Frederic Marmond">fmarmond</who>
    <bug_when>2008-10-22 08:27:04 -0700</bug_when>
    <thetext>I worked on this bug, and found that upgrading libcurl from 7.18.0 to 7.18.2 fixed memory leak problems.
Can you test please?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>96201</commentid>
    <comment_count>10</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2008-10-22 11:47:14 -0700</bug_when>
    <thetext>(In reply to comment #9)
&gt; I worked on this bug, and found that upgrading libcurl from 7.18.0 to 7.18.2
&gt; fixed memory leak problems.
&gt; Can you test please?
&gt; 

How did you get the ref count down to zero ?
The problem with the current patch is it deletes pointer leaving the ref pointed at freed memory.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>96297</commentid>
    <comment_count>11</comment_count>
    <who name="Frederic Marmond">fmarmond</who>
    <bug_when>2008-10-23 00:58:16 -0700</bug_when>
    <thetext>(In reply to comment #10)
&gt; (In reply to comment #9)
&gt; 
&gt; How did you get the ref count down to zero ?
&gt; The problem with the current patch is it deletes pointer leaving the ref
&gt; pointed at freed memory.
&gt; 

In fact, I didn&apos;t want to say upgrading libcurl solved ALL memory leaks, but lots of them, which were inside libcurl 7.18.0. I thought that this info may be useful to guys who are reading this bug.
Applying the attached patch didn&apos;t made any crash for me, and save few kB. upgrading libcurl saved me few MB (on gmail load, for example).
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>96298</commentid>
    <comment_count>12</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2008-10-23 01:02:43 -0700</bug_when>
    <thetext>
Understood.

Correct there are actually two issues.
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>100047</commentid>
    <comment_count>13</comment_count>
    <who name="Kalle Vahlman">zuh</who>
    <bug_when>2008-11-24 13:40:31 -0800</bug_when>
    <thetext>(In reply to comment #7)
&gt; (In reply to comment #5)
&gt; &gt; (From update of attachment 23343 [review] [edit])
&gt; &gt; I hate this kind of memory management.  (Nothing personal).  Could we change
&gt; &gt; this API so that it either used ref-counting, or didn&apos;t have this kind of
&gt; &gt; single-ownership memory model burried inside these functions which are named
&gt; &gt; &quot;remove&quot; and not &quot;destroy&quot;.  Why is it clear that passing something for removal
&gt; &gt; should destroy it!?
&gt; 
&gt; I&apos;m not sure to understand what you mean. I copied the direct use of delete
&gt; from the Windows port, would be enough for you to deref the object instead of
&gt; deleting it?

I switched the delete&apos;s to derefs() and the ResourceHandle leaks vanished from valgrind (for the cases I tested with, eg. planet.gnome.org).

Reading the code, the ResourceHandleCurl implementation adds a ref for itself (to protect against the ResourceLoader releasing it&apos;s ref) and then the ResourceHandleManager code removes it. Now, to me it looks like it would be clearer to move the ref from ResourceHandleCurl to ResourceHandleManager:add() so the ref is managed by ResourceHandleManager only.

I can redo Marco&apos;s patch if needed, but let&apos;s get this fixed! :)
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>100100</commentid>
    <comment_count>14</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2008-11-24 16:30:16 -0800</bug_when>
    <thetext>
You probably should take a look at the lifetime of the handle over in the loader code. The original problem was that the handle was accessed by the loader code after it was removed from curl and the loader code did not ref itself.

I think what should happen is both curl and the loader code should ref the handle until neither is using it i.e the ref count should be two for a active handle.

I suspect the loader code has been refactored to remove this problem. If so I may be wrong about needing the ref at all in curl you might be able to remove it.

So if your not segfaulting now maybe we don&apos;t need to ref at all. Thats the best approach i.e the lifetime of the Reference is fully controlled by the loader code.

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>100166</commentid>
    <comment_count>15</comment_count>
    <who name="Kalle Vahlman">zuh</who>
    <bug_when>2008-11-24 22:59:33 -0800</bug_when>
    <thetext>(In reply to comment #14)
&gt; You probably should take a look at the lifetime of the handle over in the
&gt; loader code. The original problem was that the handle was accessed by the
&gt; loader code after it was removed from curl and the loader code did not ref
&gt; itself.
&gt;
&gt; I think what should happen is both curl and the loader code should ref the
&gt; handle until neither is using it i.e the ref count should be two for a active
&gt; handle.
&gt; 
&gt; I suspect the loader code has been refactored to remove this problem. If so I
&gt; may be wrong about needing the ref at all in curl you might be able to remove
&gt; it.

Yes, I looked at the loader and it keeps a RefPtr of the ResourceHandle. I also checked that the refcount indeed was 2 when the handle comes in. The ref is really need for the curl manager since it needs to cleanup the curl side with the ResourceHandleInternal data and calling to the ResourceHandleClient callbacks might (and does) result in the client dropping its ref. I verified that whenever we hit the removeFromCurl() where the deref happens, the refcount was already 1 (ie. the client had released the ref).

&gt; So if your not segfaulting now maybe we don&apos;t need to ref at all. Thats the
&gt; best approach i.e the lifetime of the Reference is fully controlled by the
&gt; loader code.
 
I&apos;m not sure if that&apos;s easily possible as the curl seems to operate in async mode, but if the curl operations are reliably cancellable I suppose it would be doable by specifically cleaning the ongoing curl actions through ~ResourceHandle or so.

But before rewriting it, the patch with the proposed modifications should do the Right Thing for the current situation.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>100219</commentid>
    <comment_count>16</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2008-11-25 08:00:54 -0800</bug_when>
    <thetext>(In reply to comment #15)
&gt; (In reply to comment #14)
&gt; &gt; You probably should take a look at the lifetime of the handle over in the
&gt; &gt; loader code. The original problem was that the handle was accessed by the
&gt; &gt; loader code after it was removed from curl and the loader code did not ref
&gt; &gt; itself.
&gt; &gt;
&gt; &gt; I think what should happen is both curl and the loader code should ref the
&gt; &gt; handle until neither is using it i.e the ref count should be two for a active
&gt; &gt; handle.
&gt; &gt; 
&gt; &gt; I suspect the loader code has been refactored to remove this problem. If so I
&gt; &gt; may be wrong about needing the ref at all in curl you might be able to remove
&gt; &gt; it.
&gt; 
&gt; Yes, I looked at the loader and it keeps a RefPtr of the ResourceHandle. I also
&gt; checked that the refcount indeed was 2 when the handle comes in. The ref is
&gt; really need for the curl manager since it needs to cleanup the curl side with
&gt; the ResourceHandleInternal data and calling to the ResourceHandleClient
&gt; callbacks might (and does) result in the client dropping its ref. I verified
&gt; that whenever we hit the removeFromCurl() where the deref happens, the refcount
&gt; was already 1 (ie. the client had released the ref).
&gt; 
&gt; &gt; So if your not segfaulting now maybe we don&apos;t need to ref at all. Thats the
&gt; &gt; best approach i.e the lifetime of the Reference is fully controlled by the
&gt; &gt; loader code.
&gt; 
&gt; I&apos;m not sure if that&apos;s easily possible as the curl seems to operate in async
&gt; mode, but if the curl operations are reliably cancellable I suppose it would be
&gt; doable by specifically cleaning the ongoing curl actions through
&gt; ~ResourceHandle or so.
&gt; 
&gt; But before rewriting it, the patch with the proposed modifications should do
&gt; the Right Thing for the current situation.
&gt; 


Yep should finally work correctly your right it can be cleaned up later.
I&apos;d say get it submitted.
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>102547</commentid>
    <comment_count>17</comment_count>
      <attachid>26023</attachid>
    <who name="Kalle Vahlman">zuh</who>
    <bug_when>2008-12-14 23:33:28 -0800</bug_when>
    <thetext>Created attachment 26023
Updated patch with refs() and manager-side refcount handling 

So finally I found time to create and attach the patch, but I noticed the warning about test cases in the changelog entry and am now wondering if that will block inclusion..?

I have personally no experience in creating test cases so if someone would help with that (if needed), it&apos;d be great...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>102656</commentid>
    <comment_count>18</comment_count>
      <attachid>26023</attachid>
    <who name="Holger Freyther">zecke</who>
    <bug_when>2008-12-16 06:51:36 -0800</bug_when>
    <thetext>Comment on attachment 26023
Updated patch with refs() and manager-side refcount handling 

&gt; diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog

&gt; +        WARNING: NO TEST CASES ADDED OR CHANGED

Just remove this is if you think it is not testable. I would agree that testing this is incredible hard with a LayoutTest and from within the API... I will run run-webkit-tests and see if we crash...



&gt; index bbc31d4..ca24ec5 100644
&gt; --- a/WebCore/platform/network/curl/ResourceHandleCurl.cpp
&gt; +++ b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
&gt; @@ -104,7 +104,6 @@ ResourceHandle::~ResourceHandle()
&gt;  bool ResourceHandle::start(Frame* frame)
&gt;  {
&gt;      ASSERT(frame);
&gt; -    ref();
&gt;      ResourceHandleManager::sharedInstance()-&gt;add(this);
&gt;      return true;
&gt;  }

yes!



&gt; diff --git a/WebCore/platform/network/curl/ResourceHandleManager.cpp b/WebCore/platform/network/curl/ResourceHandleManager.cpp
&gt; index 410f9eb..f1a2be4 100644
&gt; --- a/WebCore/platform/network/curl/ResourceHandleManager.cpp
&gt; +++ b/WebCore/platform/network/curl/ResourceHandleManager.cpp
&gt; @@ -350,6 +350,7 @@ void ResourceHandleManager::removeFromCurl(ResourceHandle* job)
&gt;      curl_multi_remove_handle(m_curlMultiHandle, d-&gt;m_handle);
&gt;      curl_easy_cleanup(d-&gt;m_handle);
&gt;      d-&gt;m_handle = 0;
&gt; +    job-&gt;deref();
&gt;  }

deref when the job was started and finished by curl? looks right.



&gt;  
&gt;  void ResourceHandleManager::setupPUT(ResourceHandle*, struct curl_slist**)
&gt; @@ -443,6 +444,7 @@ void ResourceHandleManager::add(ResourceHandle* job)
&gt;  {
&gt;      // we can be called from within curl, so to avoid re-entrancy issues
&gt;      // schedule this job to be added the next time we enter curl download loop
&gt; +    job-&gt;ref();

yupp, ref it when we start to handle it..




&gt;          if (job == m_resourceHandleList[i]) {
&gt;              m_resourceHandleList.remove(i);
&gt; +            job-&gt;deref();
&gt;              return true;

Cool. It looks right. When we add something to m_resourceHandleList as ref the job, when we cancel/remove a not started job we deref, once curl finished (which means the job was started and removed from the m_resourceHandleList) we will deref it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>102661</commentid>
    <comment_count>19</comment_count>
    <who name="Holger Freyther">zecke</who>
    <bug_when>2008-12-16 07:32:01 -0800</bug_when>
    <thetext>Landed in r39334.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>102980</commentid>
    <comment_count>20</comment_count>
    <who name="Holger Freyther">zecke</who>
    <bug_when>2008-12-19 08:03:58 -0800</bug_when>
    <thetext>Closing it.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>23343</attachid>
            <date>2008-09-11 04:07:35 -0700</date>
            <delta_ts>2008-09-12 12:26:57 -0700</delta_ts>
            <desc>Fix the leak</desc>
            <filename>curl-leak.patch</filename>
            <type>text/plain</type>
            <size>1510</size>
            <attacher name="Marco Barisione">marco.barisione</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvcGxhdGZvcm0vbmV0d29yay9jdXJsL1Jlc291cmNlSGFuZGxlTWFuYWdl
ci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL2N1cmwvUmVzb3Vy
Y2VIYW5kbGVNYW5hZ2VyLmNwcAkocmV2aXNpb25lIDM2MzMyKQorKysgV2ViQ29yZS9wbGF0Zm9y
bS9uZXR3b3JrL2N1cmwvUmVzb3VyY2VIYW5kbGVNYW5hZ2VyLmNwcAkoY29waWEgbG9jYWxlKQpA
QCAtMzI2LDYgKzMyNiw3IEBACiAgICAgY3VybF9tdWx0aV9yZW1vdmVfaGFuZGxlKG1fY3VybE11
bHRpSGFuZGxlLCBkLT5tX2hhbmRsZSk7CiAgICAgY3VybF9lYXN5X2NsZWFudXAoZC0+bV9oYW5k
bGUpOwogICAgIGQtPm1faGFuZGxlID0gMDsKKyAgICBkZWxldGUgam9iOwogfQogCiB2b2lkIFJl
c291cmNlSGFuZGxlTWFuYWdlcjo6c2V0dXBQVVQoUmVzb3VyY2VIYW5kbGUqLCBzdHJ1Y3QgY3Vy
bF9zbGlzdCoqKQpAQCAtNDE0LDYgKzQxNSw3IEBACiAgICAgZm9yIChpbnQgaSA9IDA7IGkgPCBz
aXplOyBpKyspIHsKICAgICAgICAgaWYgKGpvYiA9PSBtX3Jlc291cmNlSGFuZGxlTGlzdFtpXSkg
ewogICAgICAgICAgICAgbV9yZXNvdXJjZUhhbmRsZUxpc3QucmVtb3ZlKGkpOworICAgICAgICAg
ICAgZGVsZXRlIGpvYjsKICAgICAgICAgICAgIHJldHVybiB0cnVlOwogICAgICAgICB9CiAgICAg
fQpJbmRleDogV2ViQ29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9DaGFuZ2VM
b2cJKHJldmlzaW9uZSAzNjMzMykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCShjb3BpYSBsb2NhbGUp
CkBAIC0xLDMgKzEsMTcgQEAKKzIwMDgtMDktMTEgIE1hcmNvIEJhcmlzaW9uZSAgPG1hcmNvLmJh
cmlzaW9uZUBjb2xsYWJvcmEuY28udWs+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP
T1BTISkuCisKKyAgICAgICAgW0NVUkxdIG1lbW9yeSBsZWFrIG9mIFJlc291Y2VIYW5kbGVzCisg
ICAgICAgIGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwNzc3CisKKyAg
ICAgICAgUmVzb3VyY2VIYW5kbGVzIHdlcmUgbmV2ZXIgZnJlZWQgaW4gdGhlIENVUkwgcG9ydC4g
VGhhbmtzIHRvIFphaGVlcgorICAgICAgICBBaG1hZCBmb3Igc3BvdHRpbmcgdGhlIGxlYWsuCisK
KyAgICAgICAgKiBwbGF0Zm9ybS9uZXR3b3JrL2N1cmwvUmVzb3VyY2VIYW5kbGVNYW5hZ2VyLmNw
cDoKKyAgICAgICAgKFdlYkNvcmU6OlJlc291cmNlSGFuZGxlTWFuYWdlcjo6cmVtb3ZlRnJvbUN1
cmwpOgorICAgICAgICAoV2ViQ29yZTo6UmVzb3VyY2VIYW5kbGVNYW5hZ2VyOjpyZW1vdmVTY2hl
ZHVsZWRKb2IpOgorCiAyMDA4LTA5LTExICBEaXJrIFNjaHVsemUgIDx2YnM4NUBnbXguZGU+CiAK
ICAgICAgICAgUmV2aWV3ZWQgYnkgU2ltb24uCg==
</data>
<flag name="review"
          id="10409"
          type_id="1"
          status="-"
          setter="eric"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>26023</attachid>
            <date>2008-12-14 23:33:28 -0800</date>
            <delta_ts>2008-12-16 06:51:36 -0800</delta_ts>
            <desc>Updated patch with refs() and manager-side refcount handling </desc>
            <filename>curl-resourcehandle-leak.diff</filename>
            <type>text/plain</type>
            <size>2710</size>
            <attacher name="Kalle Vahlman">zuh</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg
ODhlZWRiZC4uMjgwMmIyMSAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi
Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyMiBAQAorMjAwOC0xMi0xMCAgS2FsbGUgVmFobG1h
biAgPGthbGxlLnZhaGxtYW5AbW92aWFsLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP
RFkgKE9PUFMhKS4KKworICAgICAgICBbQ1VSTF0gbWVtb3J5IGxlYWsgb2YgUmVzb3VjZUhhbmRs
ZXMKKyAgICAgICAgaHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA3NzcK
KyAgICAgICAgCisgICAgICAgIEZpeCBSZXNvdXJjZUhhbmRsZSByZWYgbWFuYWdlbWVudCB0byBi
ZSBjb25zaXN0ZW50IGFuZCBjb3JyZWN0LgorICAgICAgICBPcmlnaW5hbCBwYXRjaCBmcm9tIE1h
cmNvIEJhcmlzaW9uZS4KKworICAgICAgICBXQVJOSU5HOiBOTyBURVNUIENBU0VTIEFEREVEIE9S
IENIQU5HRUQKKworICAgICAgICAqIHBsYXRmb3JtL25ldHdvcmsvY3VybC9SZXNvdXJjZUhhbmRs
ZUN1cmwuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVzb3VyY2VIYW5kbGU6OnN0YXJ0KToKKyAg
ICAgICAgKiBwbGF0Zm9ybS9uZXR3b3JrL2N1cmwvUmVzb3VyY2VIYW5kbGVNYW5hZ2VyLmNwcDoK
KyAgICAgICAgKFdlYkNvcmU6OlJlc291cmNlSGFuZGxlTWFuYWdlcjo6cmVtb3ZlRnJvbUN1cmwp
OgorICAgICAgICAoV2ViQ29yZTo6UmVzb3VyY2VIYW5kbGVNYW5hZ2VyOjphZGQpOgorICAgICAg
ICAoV2ViQ29yZTo6UmVzb3VyY2VIYW5kbGVNYW5hZ2VyOjpyZW1vdmVTY2hlZHVsZWRKb2IpOgor
CiAyMDA4LTEyLTA5ICBOaWtvbGFzIFppbW1lcm1hbm4gIDxuaWtvbGFzLnppbW1lcm1hbm5AdG9y
Y2htb2JpbGUuY29tPgogCiAgICAgICAgIFJ1YmJlci1zdGFtcGVkIGJ5IEFsZXhleSBQcm9za3Vy
eWFrb3YuCmRpZmYgLS1naXQgYS9XZWJDb3JlL3BsYXRmb3JtL25ldHdvcmsvY3VybC9SZXNvdXJj
ZUhhbmRsZUN1cmwuY3BwIGIvV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL2N1cmwvUmVzb3VyY2VI
YW5kbGVDdXJsLmNwcAppbmRleCBiYmMzMWQ0Li5jYTI0ZWM1IDEwMDY0NAotLS0gYS9XZWJDb3Jl
L3BsYXRmb3JtL25ldHdvcmsvY3VybC9SZXNvdXJjZUhhbmRsZUN1cmwuY3BwCisrKyBiL1dlYkNv
cmUvcGxhdGZvcm0vbmV0d29yay9jdXJsL1Jlc291cmNlSGFuZGxlQ3VybC5jcHAKQEAgLTEwNCw3
ICsxMDQsNiBAQCBSZXNvdXJjZUhhbmRsZTo6flJlc291cmNlSGFuZGxlKCkKIGJvb2wgUmVzb3Vy
Y2VIYW5kbGU6OnN0YXJ0KEZyYW1lKiBmcmFtZSkKIHsKICAgICBBU1NFUlQoZnJhbWUpOwotICAg
IHJlZigpOwogICAgIFJlc291cmNlSGFuZGxlTWFuYWdlcjo6c2hhcmVkSW5zdGFuY2UoKS0+YWRk
KHRoaXMpOwogICAgIHJldHVybiB0cnVlOwogfQpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9wbGF0Zm9y
bS9uZXR3b3JrL2N1cmwvUmVzb3VyY2VIYW5kbGVNYW5hZ2VyLmNwcCBiL1dlYkNvcmUvcGxhdGZv
cm0vbmV0d29yay9jdXJsL1Jlc291cmNlSGFuZGxlTWFuYWdlci5jcHAKaW5kZXggNDEwZjllYi4u
ZjFhMmJlNCAxMDA2NDQKLS0tIGEvV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL2N1cmwvUmVzb3Vy
Y2VIYW5kbGVNYW5hZ2VyLmNwcAorKysgYi9XZWJDb3JlL3BsYXRmb3JtL25ldHdvcmsvY3VybC9S
ZXNvdXJjZUhhbmRsZU1hbmFnZXIuY3BwCkBAIC0zNTAsNiArMzUwLDcgQEAgdm9pZCBSZXNvdXJj
ZUhhbmRsZU1hbmFnZXI6OnJlbW92ZUZyb21DdXJsKFJlc291cmNlSGFuZGxlKiBqb2IpCiAgICAg
Y3VybF9tdWx0aV9yZW1vdmVfaGFuZGxlKG1fY3VybE11bHRpSGFuZGxlLCBkLT5tX2hhbmRsZSk7
CiAgICAgY3VybF9lYXN5X2NsZWFudXAoZC0+bV9oYW5kbGUpOwogICAgIGQtPm1faGFuZGxlID0g
MDsKKyAgICBqb2ItPmRlcmVmKCk7CiB9CiAKIHZvaWQgUmVzb3VyY2VIYW5kbGVNYW5hZ2VyOjpz
ZXR1cFBVVChSZXNvdXJjZUhhbmRsZSosIHN0cnVjdCBjdXJsX3NsaXN0KiopCkBAIC00NDMsNiAr
NDQ0LDcgQEAgdm9pZCBSZXNvdXJjZUhhbmRsZU1hbmFnZXI6OmFkZChSZXNvdXJjZUhhbmRsZSog
am9iKQogewogICAgIC8vIHdlIGNhbiBiZSBjYWxsZWQgZnJvbSB3aXRoaW4gY3VybCwgc28gdG8g
YXZvaWQgcmUtZW50cmFuY3kgaXNzdWVzCiAgICAgLy8gc2NoZWR1bGUgdGhpcyBqb2IgdG8gYmUg
YWRkZWQgdGhlIG5leHQgdGltZSB3ZSBlbnRlciBjdXJsIGRvd25sb2FkIGxvb3AKKyAgICBqb2It
PnJlZigpOwogICAgIG1fcmVzb3VyY2VIYW5kbGVMaXN0LmFwcGVuZChqb2IpOwogICAgIGlmICgh
bV9kb3dubG9hZFRpbWVyLmlzQWN0aXZlKCkpCiAgICAgICAgIG1fZG93bmxvYWRUaW1lci5zdGFy
dE9uZVNob3QocG9sbFRpbWVTZWNvbmRzKTsKQEAgLTQ1NCw2ICs0NTYsNyBAQCBib29sIFJlc291
cmNlSGFuZGxlTWFuYWdlcjo6cmVtb3ZlU2NoZWR1bGVkSm9iKFJlc291cmNlSGFuZGxlKiBqb2Ip
CiAgICAgZm9yIChpbnQgaSA9IDA7IGkgPCBzaXplOyBpKyspIHsKICAgICAgICAgaWYgKGpvYiA9
PSBtX3Jlc291cmNlSGFuZGxlTGlzdFtpXSkgewogICAgICAgICAgICAgbV9yZXNvdXJjZUhhbmRs
ZUxpc3QucmVtb3ZlKGkpOworICAgICAgICAgICAgam9iLT5kZXJlZigpOwogICAgICAgICAgICAg
cmV0dXJuIHRydWU7CiAgICAgICAgIH0KICAgICB9Cg==
</data>
<flag name="review"
          id="12252"
          type_id="1"
          status="+"
          setter="zecke"
    />
          </attachment>
      

    </bug>

</bugzilla>