59f39b325d
It's possible for a proxy to be released during the middle of an Invoke. E.g. a specific case where this happened was a single-shot event sink which, upon receiving the event it was waiting for, would immediately call DispEventUnadvise. This removed the proxy pointing to that sink from the connection point's list of subscribers and released the last refcount on the proxy itself. Therefore, all state used to complete an RPC call must be on the stack; once NdrProxySendReceive pumps STA messages and permits reentrancy, the proxy cannot be accessed or relied on to own anything. Add test showing MIDL_STUB_MESSAGE::pRpcChannelBuffer owns a refcount (to ensure it can read [out] parameters from the channel) |
||
|---|---|---|
| .. | ||
| tests | ||
| cproxy.c | ||
| cpsf.c | ||
| cpsf.h | ||
| cstub.c | ||
| epm.idl | ||
| epm_towers.h | ||
| Makefile.in | ||
| ncastatus.h | ||
| ndr_clientserver.c | ||
| ndr_contexthandle.c | ||
| ndr_es.c | ||
| ndr_fullpointer.c | ||
| ndr_marshall.c | ||
| ndr_misc.h | ||
| ndr_ole.c | ||
| ndr_stubless.c | ||
| ndr_stubless.h | ||
| ndr_typelib.c | ||
| ndr_types.idl | ||
| rpc_assoc.c | ||
| rpc_assoc.h | ||
| rpc_async.c | ||
| rpc_binding.c | ||
| rpc_binding.h | ||
| rpc_defs.h | ||
| rpc_epmap.c | ||
| rpc_message.c | ||
| rpc_message.h | ||
| rpc_server.c | ||
| rpc_server.h | ||
| rpc_transport.c | ||
| rpcrt4.spec | ||
| rpcrt4_main.c | ||
| version.rc | ||