Tue Sep 16 18:11:58 UTC 2014 Johnny Willemsen <jwillemsen@remedy.nl>

        * ace/Dev_Poll_Reactor.cpp:
        * ace/Reactor.h:
        * ace/Select_Reactor_T.cpp:
        * ace/WFMO_Reactor.inl:
          When using ACE_Event_Handler_var together with reference
          counting it is easy to pass the var.handler() to the
          cancel_timer() operation of the reactor to just cancel
          all timers at shutdown. But, when the application specific
          initialization fails which leads to the fact that the var
          contains a nullptr, this leads to a crash. Updated all
          cancel_timer operations to also check if a valid event
          handler pointer has been passed. If not, we just return 0

        * tests/MT_Reactor_Timer_Test.cpp:
          Added test for use case mentioned above

6 files changed, 33 insertions, 7 deletions

diff --git a/ACE/ChangeLog b/ACE/ChangeLog
index e6f40223bfb..3e759158fb9 100644
--- a/ACE/ChangeLog
+++ b/ACE/ChangeLog
@@ -1,3 +1,21 @@
+Tue Sep 16 18:11:58 UTC 2014  Johnny Willemsen  <jwillemsen@remedy.nl>
+
+        * ace/Dev_Poll_Reactor.cpp:
+        * ace/Reactor.h:
+        * ace/Select_Reactor_T.cpp:
+        * ace/WFMO_Reactor.inl:
+          When using ACE_Event_Handler_var together with reference
+          counting it is easy to pass the var.handler() to the
+          cancel_timer() operation of the reactor to just cancel
+          all timers at shutdown. But, when the application specific
+          initialization fails which leads to the fact that the var
+          contains a nullptr, this leads to a crash. Updated all
+          cancel_timer operations to also check if a valid event
+          handler pointer has been passed. If not, we just return 0
+
+        * tests/MT_Reactor_Timer_Test.cpp:
+          Added test for use case mentioned above
+
 Fri Sep 12 09:19:15 UTC 2014  Martin Corino  <mcorino@remedy.nl>
 
         * bin/PerlACE/TestTarget_Android.pm:
diff --git a/ACE/ace/Dev_Poll_Reactor.cpp b/ACE/ace/Dev_Poll_Reactor.cpp
index a9adbdd460d..c65fecbebb3 100644
--- a/ACE/ace/Dev_Poll_Reactor.cpp
+++ b/ACE/ace/Dev_Poll_Reactor.cpp
@@ -1961,17 +1961,17 @@ ACE_Dev_Poll_Reactor::reset_timer_interval (long timer_id,
 }
 
 int
-ACE_Dev_Poll_Reactor::cancel_timer (ACE_Event_Handler *event_handler,
+ACE_Dev_Poll_Reactor::cancel_timer (ACE_Event_Handler *handler,
                                     int dont_call_handle_close)
 {
   ACE_TRACE ("ACE_Dev_Poll_Reactor::cancel_timer");
 
   // Don't bother waking the poll - the worse that will happen is it will
   // wake up for a timer that doesn't exist then go back to waiting.
-  return (this->timer_queue_ == 0
-          ? 0
-          : this->timer_queue_->cancel (event_handler,
-                                        dont_call_handle_close));
+  if ((this->timer_queue_ != 0) && (handler != 0))
+    return this->timer_queue_->cancel (handler, dont_call_handle_close);
+  else
+    return 0;
 }
 
 int
diff --git a/ACE/ace/Reactor.h b/ACE/ace/Reactor.h
index 23d973c0c68..1e5b0880f18 100644
--- a/ACE/ace/Reactor.h
+++ b/ACE/ace/Reactor.h
@@ -625,6 +625,9 @@ public:
    * ACE_Event_Handler::remove_reference() will also be called once
    * for every timer associated with the event handler.
    *
+   * In case this operation is called with a nil event_handler
+   * it returns with 0 as the number of handlers cancelled.
+   *
    * Returns number of handlers cancelled.
    */
   virtual int cancel_timer (ACE_Event_Handler *event_handler,
diff --git a/ACE/ace/Select_Reactor_T.cpp b/ACE/ace/Select_Reactor_T.cpp
index 8737b483122..dce04e1ad90 100644
--- a/ACE/ace/Select_Reactor_T.cpp
+++ b/ACE/ace/Select_Reactor_T.cpp
@@ -703,7 +703,7 @@ ACE_Select_Reactor_T<ACE_SELECT_REACTOR_TOKEN>::cancel_timer (ACE_Event_Handler
   ACE_TRACE ("ACE_Select_Reactor_T::cancel_timer");
   ACE_MT (ACE_GUARD_RETURN (ACE_SELECT_REACTOR_TOKEN, ace_mon, this->token_, -1));
 
-  if (this->timer_queue_ != 0)
+  if ((this->timer_queue_ != 0) && (handler != 0))
     return this->timer_queue_->cancel (handler, dont_call_handle_close);
   else
     return 0;
diff --git a/ACE/ace/WFMO_Reactor.inl b/ACE/ace/WFMO_Reactor.inl
index d2e8d56bdba..eb81e727a5f 100644
--- a/ACE/ace/WFMO_Reactor.inl
+++ b/ACE/ace/WFMO_Reactor.inl
@@ -499,7 +499,7 @@ ACE_WFMO_Reactor::cancel_timer (ACE_Event_Handler *handler,
                                 int dont_call_handle_close)
 {
   ACE_TRACE ("ACE_WFMO_Reactor::cancel_timer");
-  if (0 != this->timer_queue_)
+  if ((0 != this->timer_queue_) && (0 != handler))
     return this->timer_queue_->cancel (handler, dont_call_handle_close);
   return 0;
 }
diff --git a/ACE/tests/MT_Reactor_Timer_Test.cpp b/ACE/tests/MT_Reactor_Timer_Test.cpp
index 01fc16210c4..fb845f3b2e5 100644
--- a/ACE/tests/MT_Reactor_Timer_Test.cpp
+++ b/ACE/tests/MT_Reactor_Timer_Test.cpp
@@ -114,6 +114,11 @@ Time_Handler::svc (void)
   ACE_TEST_ASSERT (r->cancel_timer (this->timer_id_[4]) == 1);
   this->timer_id_[4] = Time_Handler::TIMER_CANCELLED;
 
+  // Test that cancelling a timers through a nill ACE_Event_Handler
+  // pointer just does nothing instead of crash
+  ACE_Event_Handler_var timer_var;
+  ACE_TEST_ASSERT (r->cancel_timer (timer_var.handler()) == 0);
+
   return 0;
 }