Re: [Qemu-devel] [PATCH v4 06/10] qemu-ga: Add Windows VSS provider to quiesce applications on fsfreeze

[Laszlo Ersek]

On 06/28/13 09:05, Paolo Bonzini wrote:
> Il 28/06/2013 00:25, Tomoki Sekiyama ha scritto:
>>>>>>>>>> +STDMETHODIMP CQGAVssProviderFactory::CreateInstance(
>>>>>>>>>> +    IUnknown *pUnknownOuter, REFIID iid, void **ppv)
>>>>>>>>>> +{
>>>>>>>>>> +    if (pUnknownOuter) {
>>>>>>>>>> +        return CLASS_E_NOAGGREGATION;
>>>>>>>>>> +    }
>>>>>>>>>> +    CQGAVssProvider *pObj = new CQGAVssProvider;
>>>>>>>>>> +    if (!pObj) {
>>>>>>>>>> +        return E_OUTOFMEMORY;
>>>>>>>>>> +    }
>>>>
>>>> (We generally assume that memory allocation never fails.)
>> Ah, OK...
> 
> Actually, we do because we use g_malloc/g_free.  The functions exit on
> memory allocation failure.  I'm not sure the same is true of the new
> operator... doesn't it throw an exception on allocation failure (that's
> what I vaguely remember)?

It throws std::bad_alloc on failure. There's another new operator (the
nothrow form) thar returns 0 on failure.

  18.4.1.1 Single-object forms [lib.new.delete.single]; p9:

    [Example:
      T* p1 = new T;          // throws bad_alloc if it fails
      T* p2 = new(nothrow) T; // returns 0 if it fails
    —end example]

(
"nothrow" in the above is std::nothrow, an object with static storage
duration, of type "nothrow_t" -- it's a dummy argument so that operator
new() can have to prototypes. It is passed by const reference.

  18.4 Dynamic memory management [lib.support.dynamic]; p1:

  namespace std {
    class bad_alloc;
    struct nothrow_t {};
    extern const nothrow_t nothrow;
    /* ... */
  }

  void* operator new(std::size_t size) throw(std::bad_alloc);
  void* operator new(std::size_t size, const std::nothrow_t&) throw();
)

As far as I can remember, older C++ implementations had problems with
bad_alloc. I believe though that any gcc release frome after the stone
age should handle this correctly; see also -fcheck-new.

Of course I have no idea what happens when a C++ exception tries to
propagate past a "DLL boundary".


> Also, this is not running in the context of qemu-ga, so I think it is
> better to be more conservative and trap memory allocation failure.

In that case other "new" calls must assume the nothrow form too, plus
other allocation functions should be checked as well (eg.
SysAllocStringLen(), although its only use might be in the function that
Tomoki plans to remove anyway).

Laszlo