[tf.data] Fixes for two recently introduced use-after-free bugs.
1. In ParallelMapIterator, do not call `cond_var_.notify_all()` without holding the associated mutex. In some cases, the iterator may have been deleted between releasing the lock and notifying the condition variable, which leads to a use-after-free. This change applies this style to all use of condition variables in tensorflow/core/kernels/data/. 2. In CapturedFunction::RunAsync(), do not use `shared_ptr` to manage the lifetime of objects that (potentially) borrow from runtime objects. The present code runs the destructor after the `done()` callback is called, but the `done()` callback may be the last action in a session, and thus trigger destruction of those borrowed objects. In that case, the `shared_ptr` destructor may use the borrowed objects after they are freed. PiperOrigin-RevId: 213872829
Loading
Please sign in to comment