Don't call xfree from the watcher thread. Do it only in remove_watch.

1 files changed, 11 insertions, 19 deletions

diff --git a/src/w32notify.c b/src/w32notify.c
index 9fcd15e7f8f..afa03498ff3 100644
--- a/src/w32notify.c
+++ b/src/w32notify.c
@@ -214,14 +214,10 @@ watch_completion (DWORD status, DWORD bytes_ret, OVERLAPPED *io_info)
 	 The directory handle is already closed.  We should clean up
 	 and exit, signalling to the thread worker routine not to
 	 issue another call to ReadDirectoryChangesW.  Note that we
-	 don't free the dirwatch object itself; this is done by the
-	 main thread in remove_watch.  */
-      xfree (dirwatch->buf);
-      dirwatch->buf = NULL;
-      xfree (dirwatch->io_info);
-      dirwatch->io_info = NULL;
-      xfree (dirwatch->watchee);
-      dirwatch->watchee = NULL;
+	 don't free the dirwatch object itself nor the memory consumed
+	 by its buffers; this is done by the main thread in
+	 remove_watch.  Calling malloc/free from a thread other than
+	 the main thread is a no-no.  */
       dirwatch->dir = NULL;
       dirwatch->terminate = 1;
     }
@@ -254,19 +250,15 @@ watch_worker (LPVOID arg)
 	  {
 	    DebPrint (("watch_worker, abnormal exit: %lu\n", GetLastError ()));
 	    /* We cannot remove the dirwatch object from watch_list,
-	       because we are in a separate thread.  So we free and
-	       zero out all the pointers in the object, but do not
-	       free the object itself.  We also don't touch the
-	       signature.  This way, remove_watch can still identify
-	       the object, remove it, and free its memory.  */
-	    xfree (dirwatch->buf);
-	    dirwatch->buf = NULL;
-	    xfree (dirwatch->io_info);
-	    dirwatch->io_info = NULL;
+	       because we are in a separate thread.  For the same
+	       reason, we also cannot free memory consumed by the
+	       buffers allocated for the dirwatch object.  So we close
+	       the directory handle, but do not free the object itself
+	       or its buffers.  We also don't touch the signature.
+	       This way, remove_watch can still identify the object,
+	       remove it, and free its memory.  */
 	    CloseHandle (dirwatch->dir);
 	    dirwatch->dir = NULL;
-	    xfree (dirwatch->watchee);
-	    dirwatch->watchee = NULL;
 	    return 1;
 	  }
       }