libstdc++/2837: Reference counted string is not smp safe

[graemeb at econz dot co dot nz]

>Number:         2837
>Category:       libstdc++
>Synopsis:       Reference counted string is not smp safe
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue May 15 18:16:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     Graeme Bell
>Release:        2.95.2 and 2.95.3
>Organization:
>Environment:

>Description:
The reference count increment in method "Rep::grab" of the 
"basic_string" template class in "std/bastring.h" is not
smp safe on an intel machine. The most common effect seems
to be that the static global nilRep structure ends up with a 
zero reference count and gets deleted, nasty things follow.
>How-To-Repeat:

>Fix:
Fix is to lock the increment instruction. I've made the following
change to bastring.h, and have been successfully running the
resulting app for several days now without a problem.

#if defined __i486__ || defined __i586__ || defined __i686__
    charT* grab () { 
      if (selfish) 
        return clone (); 
      asm ("lock; incl %0" : "=m" (ref) : "0" (ref) : "memory" );
      return data (); 
    }
#else
    charT* grab () { if (selfish) return clone (); ++ref; return data (); }
#endif

Someone whos more familiar with the inline assembler options
on gcc may want to check this correct.

>Release-Note:
>Audit-Trail:
>Unformatted: