https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=137145
--- Comment #10 from Andriy Gapon <a...@freebsd.org> --- (In reply to Gleb Smirnoff from comment #9) You are right when the scenario is going from one owner to more. But there is a scenario of multiple owners, some dropping their reference and some just getting it. For example, let's start with refcnt of 2 and three threads: T1, T2, T3. T1 and T2 are getting a new reference while T3 is dropping its reference. There is also another owner, Tx, that just keeps its reference. 1. T1 reads refcnt, sees 2; 2. T3 decrements refcnt to 1 3. T2 reads refctnt see 1; 4. T2 proceeds to non-atomic *refcnt += 1 and reads refcnt as 1 again; 5. T1 proceeds to atomic_add_int and increments refcnt to 2; 6. T2 sets refcnt to 2 as well (based on step 4); In the end, we have 3 owners (T1, T2, Tx) but the refcnt is 2. -- You are receiving this mail because: You are the assignee for the bug.
