From 8636bade176d692672f191bbfb8ded8bbb6aa88c Mon Sep 17 00:00:00 2001
From: David Faure <david.faure@kdab.com>
Date: Fri, 23 May 2014 20:22:02 +0200
Subject: [PATCH] qfreelist: fix data race on v[at].next

Detected by clang's -fsanitize=thread in tst_qcoreapplication.

Task-number: QTBUG-39024
Change-Id: I60b7cece0384f89dc62ac5128faf39a4084e72e2
Reviewed-by: Olivier Goffart <ogoffart@woboq.com>
---
 src/corelib/tools/qfreelist_p.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/corelib/tools/qfreelist_p.h b/src/corelib/tools/qfreelist_p.h
index 69b7fc67a0..ca946cbd8a 100644
--- a/src/corelib/tools/qfreelist_p.h
+++ b/src/corelib/tools/qfreelist_p.h
@@ -73,7 +73,7 @@ struct QFreeListElement
     typedef T &ReferenceType;
 
     T _t;
-    int next;
+    QAtomicInt next;
 
     inline ConstReferenceType t() const { return _t; }
     inline ReferenceType t() { return _t; }
@@ -90,7 +90,7 @@ struct QFreeListElement<void>
     typedef void ConstReferenceType;
     typedef void ReferenceType;
 
-    int next;
+    QAtomicInt next;
 
     inline void t() const { }
     inline void t() { }
@@ -172,7 +172,7 @@ class QFreeList
         // qDebug("QFreeList: allocating %d elements (%ld bytes) with offset %d", size, size * sizeof(ElementType), offset);
         ElementType *v = new ElementType[size];
         for (int i = 0; i < size; ++i)
-            v[i].next = offset + i + 1;
+            v[i].next.store(offset + i + 1);
         return v;
     }
 
@@ -254,7 +254,7 @@ inline int QFreeList<T, ConstantsType>::next()
             }
         }
 
-        newid = v[at].next | (id & ~ConstantsType::IndexMask);
+        newid = v[at].next.load() | (id & ~ConstantsType::IndexMask);
     } while (!_next.testAndSetRelaxed(id, newid));
     // qDebug("QFreeList::next(): returning %d (_next now %d, serial %d)",
     //        id & ConstantsType::IndexMask,
@@ -273,7 +273,7 @@ inline void QFreeList<T, ConstantsType>::release(int id)
     int x, newid;
     do {
         x = _next.loadAcquire();
-        v[at].next = x & ConstantsType::IndexMask;
+        v[at].next.store(x & ConstantsType::IndexMask);
 
         newid = incrementserial(x, id);
     } while (!_next.testAndSetRelease(x, newid));