intrusive_ptr not threadsafe

[Kenneth Heafield]

The reference counter is a bare size_t

marian-dev/src/common/intrusive_ptr.h

Lines 15 to 16 in 3daf4ee

 #define ENABLE_INTRUSIVE_PTR(type)           \ 
   size_t references_{0};                     \ 

and the pointer type is a bare pointer:

marian-dev/src/common/intrusive_ptr.h

Line 137 in 3daf4ee

 T* ptr_; 

If two threads destroy their references simultaneously, then both enter this function:

marian-dev/src/common/intrusive_ptr.h

Lines 23 to 28 in 3daf4ee

 inline friend void intrusivePtrRelease(type* x) { \ 
   if(x != 0 && --x->references_ == 0) {    \ 
     delete x;                              \ 
     x = 0;                                 \ 
   }                                        \ 
 }                                          \ 

It's possible both threads will read x != 0 and x->references_ == 2 then commit 1 back and leak the object.

Aside: this line doesn't do anything since it's in a function that takes type* x

marian-dev/src/common/intrusive_ptr.h

Line 26 in 3daf4ee

 x = 0;                                 \