Re: [PATCH v2 0/3] MR891: threadpoolwinrt: Initial implementation of RunAsync().

[Bernhard Kölbl (＠besentv)]

Bernhard Kölbl (@besentv) commented about dlls/threadpoolwinrt/main.c:
> -
>        ResumeThread(thread);
> -
>    }
> -
>    CloseHandle(thread);
> - }
> - else
> - {
> -
>    hr = submit_threadpool_work(item, priority);
> - }
> -
> - if (FAILED(hr))
> - {
> -
>    release_work_item(item);
> -
>    return hr;
> - }
> -
> - IAsyncAction_AddRef((*action = item->action));

Maybe I'm not seeing this correctly, but I think you're potentially accessing freed memory here.

Because in `alloc_work_item` you create IAsyncAction with refcount 1, then sumbit the work to Thread/Threadpool and free the work item inside the callback including IAsyncAction.