Fri Mar 7 11:56:10 UTC 2014 Johnny Willemsen <jwillemsen@remedy.nl>

        * ace/Timer_Queue_T.h:
        * ace/Timer_Queue_T.inl:
        * ace/Timer_Queue_T.cpp:
          Moved the expire() method from the inline to the cpp, it is 
          virtual so can't be inlined. Further, the expire() method
          had an optimization that it checked is_empty() before
          callig the real expire that grabs the lock. This is causing
          a potential data race because the timer hash overrides
is_empty
          and uses a member variable to determine whether the queue 
          is empty or not, this is now accessed without having the
          timer queue locked. Therefor the optimization was removed,
          we directly call into the real expire that first grabs its
          lock

4 files changed, 26 insertions, 12 deletions

diff --git a/ACE/ChangeLog b/ACE/ChangeLog
index eb608748639..47ea05ee9a8 100644
--- a/ACE/ChangeLog
+++ b/ACE/ChangeLog
@@ -1,3 +1,19 @@
+Fri Mar  7 11:56:10 UTC 2014  Johnny Willemsen  <jwillemsen@remedy.nl>
+
+        * ace/Timer_Queue_T.h:
+        * ace/Timer_Queue_T.inl:
+        * ace/Timer_Queue_T.cpp:
+          Moved the expire() method from the inline to the cpp, it is
+          virtual so can't be inlined. Further, the expire() method
+          had an optimization that it checked is_empty() before
+          callig the real expire that grabs the lock. This is causing
+          a potential data race because the timer hash overrides is_empty
+          and uses a member variable to determine whether the queue
+          is empty or not, this is now accessed without having the
+          timer queue locked. Therefor the optimization was removed,
+          we directly call into the real expire that first grabs its
+          lock
+
 Fri Mar  7 10:22:01 UTC 2014  Johnny Willemsen  <jwillemsen@remedy.nl>
 
         * bin/inspxe-cl.sup:
diff --git a/ACE/ace/Timer_Queue_T.cpp b/ACE/ace/Timer_Queue_T.cpp
index 0b9b1dc7e3b..f392b6a8cdd 100644
--- a/ACE/ace/Timer_Queue_T.cpp
+++ b/ACE/ace/Timer_Queue_T.cpp
@@ -250,6 +250,16 @@ ACE_Timer_Queue_T<TYPE, FUNCTOR, ACE_LOCK, TIME_POLICY>::schedule (const TYPE &t
   return result;
 }
 
+template <class TYPE, class FUNCTOR, class ACE_LOCK, typename TIME_POLICY> int
+ACE_Timer_Queue_T<TYPE, FUNCTOR, ACE_LOCK, TIME_POLICY>::expire (void)
+{
+  // We can't check here is the timer queue is empty, in some
+  // implementations (like the timer heap) calling is_empty()
+  // would at that moment access member variables without having
+  // locked ourself for thread safety
+  return this->expire (this->gettimeofday_static () + timer_skew_);
+}
+
 // Run the <handle_timeout> method for all Timers whose values are <=
 // <cur_time>.
 template <class TYPE, class FUNCTOR, class ACE_LOCK, typename TIME_POLICY> int
diff --git a/ACE/ace/Timer_Queue_T.h b/ACE/ace/Timer_Queue_T.h
index ee06e91332d..a8881d7a652 100644
--- a/ACE/ace/Timer_Queue_T.h
+++ b/ACE/ace/Timer_Queue_T.h
@@ -117,9 +117,6 @@ public:
    */
   virtual int dispatch_info (const ACE_Time_Value &current_time,
                              ACE_Timer_Node_Dispatch_Info_T<TYPE> &info);
-
-
-
   //@{
   /**
    * Implement the gettimeofday() virtual function
diff --git a/ACE/ace/Timer_Queue_T.inl b/ACE/ace/Timer_Queue_T.inl
index 94fdd42d382..a98177a6623 100644
--- a/ACE/ace/Timer_Queue_T.inl
+++ b/ACE/ace/Timer_Queue_T.inl
@@ -22,15 +22,6 @@ ACE_Timer_Queue_T<TYPE, FUNCTOR, ACE_LOCK, TIME_POLICY>::timer_skew (void) const
   return timer_skew_;
 }
 
-template <class TYPE, class FUNCTOR, class ACE_LOCK, typename TIME_POLICY> ACE_INLINE int
-ACE_Timer_Queue_T<TYPE, FUNCTOR, ACE_LOCK, TIME_POLICY>::expire (void)
-{
-  if (!this->is_empty ())
-    return this->expire (this->gettimeofday_static () + timer_skew_);
-  else
-    return 0;
-}
-
 template <class TYPE, class FUNCTOR, class ACE_LOCK, typename TIME_POLICY> int
 ACE_Timer_Queue_T<TYPE, FUNCTOR, ACE_LOCK, TIME_POLICY>::dispatch_info (const ACE_Time_Value &cur_time,
                                                            ACE_Timer_Node_Dispatch_Info_T<TYPE> &info)