[svn-commits] dvossel: trunk r231556 - /trunk/apps/app_queue.c

[SVN commits to the Digium repositories]

Author: dvossel
Date: Mon Nov 30 12:55:07 2009
New Revision: 231556

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=231556
Log:
app_queue crashes randomly, often during call-transfers

This patch adds a ref to the queue_ent object's parent call_queue
in queue_exec() so the call_queue won't be destroyed
while the the queue_ent still holds a pointer to it.

(closes issue 0015686)
Tested by: dvossel, aragon



Modified:
    trunk/apps/app_queue.c

Modified: trunk/apps/app_queue.c
URL: http://svnview.digium.com/svn/asterisk/trunk/apps/app_queue.c?view=diff&rev=231556&r1=231555&r2=231556
==============================================================================
--- trunk/apps/app_queue.c (original)
+++ trunk/apps/app_queue.c Mon Nov 30 12:55:07 2009
@@ -1101,6 +1101,11 @@
 		q->head = new;
 	}
 	new->next = cur;
+
+	/* every queue_ent must have a reference to it's parent call_queue, this
+	 * reference does not go away until the end of the queue_ent's life, meaning
+	 * that even when the queue_ent leaves the call_queue this ref must remain. */
+	queue_ref(q);
 	new->parent = q;
 	new->pos = ++(*pos);
 	new->opos = *pos;
@@ -5441,7 +5446,7 @@
 		AST_APP_ARG(position);
 	);
 	/* Our queue entry */
-	struct queue_ent qe;
+	struct queue_ent qe = { 0 };
 	
 	if (ast_strlen_zero(data)) {
 		ast_log(LOG_WARNING, "Queue requires an argument: queuename[,options[,URL[,announceoverride[,timeout[,agi[,macro[,gosub[,rule[,position]]]]]]]]]\n");
@@ -5452,7 +5457,6 @@
 	AST_STANDARD_APP_ARGS(args, parse);
 
 	/* Setup our queue entry */
-	memset(&qe, 0, sizeof(qe));
 	qe.start = time(NULL);
 
 	/* set the expire time based on the supplied timeout; */
@@ -5692,6 +5696,13 @@
 	leave_queue(&qe);
 	if (reason != QUEUE_UNKNOWN)
 		set_queue_result(chan, reason);
+
+	if (qe.parent) {
+		/* every queue_ent is given a reference to it's parent call_queue when it joins the queue.
+		 * This ref must be taken away right before the queue_ent is destroyed.  In this case
+		 * the queue_ent is about to be returned on the stack */
+		qe.parent = queue_unref(qe.parent);
+	}
 
 	return res;
 }