Bug 666551-Fix a few dangling pointers

When removing an item from the list, check the next one's my_owner,
and fix it accordingly. And take this case into account when last
of the list is deleted.

Also, assign NULL to 'my_owner' in g_thread_xp_WakeConditionVariable.

diff --git a/glib/gthread-win32.c b/glib/gthread-win32.c
index 3ec908d..94a56e2 100644 (file)
--- a/glib/gthread-win32.c
+++ b/glib/gthread-win32.c
@@ -867,6 +867,10 @@ g_thread_xp_SleepConditionVariableSRW (gpointer cond,
       EnterCriticalSection (&g_thread_xp_lock);
       if (waiter->my_owner)
         {
+          if (waiter->next)
+            waiter->next->my_owner = waiter->my_owner;
+          else
+            cv->last_ptr = waiter->my_owner;
           *waiter->my_owner = waiter->next;
           waiter->my_owner = NULL;
         }
@@ -887,6 +891,7 @@ g_thread_xp_WakeConditionVariable (gpointer cond)
   waiter = cv->first;
   if (waiter != NULL)
     {
+      waiter->my_owner = NULL;
       cv->first = waiter->next;
       if (cv->first != NULL)
         cv->first->my_owner = &cv->first;