wechat_qrcode: fix Counted reference count data race - #4198
Conversation
fallenmi
left a comment
There was a problem hiding this comment.
The atomic counter and single decrement/zero test address the reported intrusive-refcount race without changing the surrounding Ref contract. In an eight-thread stress oracle that repeatedly copies a stable Ref 800,000 times, exact base a8e9acd reports multiple ThreadSanitizer races and finishes with a corrupted count; exact head 37ce345 is TSan-clean and finishes at the expected count of one.
I also configured and built the complete opencv_wechat_qrcode native module against OpenCV 4.15-dev on Apple arm64. All derived Counted types compiled and linked cleanly, so the atomic member does not introduce an in-tree copyability/build regression. Diff check is clean. There are currently no published GitHub check runs on the PR head.
Reviewed with OpenAI Codex assistance; I reproduced the exact base/head concurrency behavior and completed the native module build locally.
Pull Request Readiness Checklist
See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request
Patch to opencv_extra has the same branch name.
Description
The reference counter in
zxing::Countedwas not safe for concurrent access.Under concurrent usage, the reference count could become inconsistent during
retain()/release()operations, potentially causing invalid objectlifetime management and heap corruption.
The issue was observed when using
wechat_qrcodeas a service. Both C++ andPython bindings could trigger the crash under concurrent workloads, with errors
such as:
malloc(): unsorted double linked list corrupted
corrupted double-linked list
Fix
This change:
unsigned inttostd::atomic<unsigned int>;release()a single atomic operation.Crash stack
Validation
The issue was observed in production. Before this change, the crash happened
intermittently (approximately once every few days under our workload).
After applying this change, the same workload has been running for about two
years without observing this heap corruption issue.