Global reference leak in `Callback.bind()`

[K-ANOY]

I found a possible JNI global reference leak in Callback.bind() when native callback registration fails halfway through initialization.

File: bundles/org.eclipse.swt/Eclipse SWT/common/library/callback.c

Function: CALLBACK_NATIVE(bind)

Relevant code:

for (i=0; i<MAX_CALLBACKS; i++) {
    if (!callbackData[i].callback) {
        if ((callbackData[i].callback = (*env)->NewGlobalRef(env, callbackObject)) == NULL) goto fail;
        if ((callbackData[i].object = (*env)->NewGlobalRef(env, object)) == NULL) goto fail;
        callbackData[i].isStatic = isStatic;
        callbackData[i].isArrayBased = isArrayBased;
        callbackData[i].argCount = argCount;
        callbackData[i].errorResult = errorResult;
        callbackData[i].methodID = mid;

        result = (jlong) fnx_array[argCount][i];
        break;
    }
}

fail:
    if (method && methodString) (*env)->ReleaseStringUTFChars(env, method, methodString);
    if (signature && sigString) (*env)->ReleaseStringUTFChars(env, signature, sigString);
    return result;

NewGlobalRef() returns a new global reference:

callbackData[i].callback = (*env)->NewGlobalRef(env, callbackObject)

If this first global reference succeeds but the second one fails:

callbackData[i].object = (*env)->NewGlobalRef(env, object)

the function jumps to fail. The fail block releases the UTF strings, but it does not delete the already-created callbackData[i].callback global reference and does not clear the partially initialized slot.

This leaves a global reference to the Java Callback object stored in callbackData[i].callback. Since bind() returns 0 on this path, the Java constructor reports callback allocation failure and the normal unbind() path is not reached for this partially initialized entry.

The successful cleanup path does release both global references:

if (callbackData[i].callback != NULL) (*env)->DeleteGlobalRef(env, callbackData[i].callback);
if (callbackData[i].object != NULL) (*env)->DeleteGlobalRef(env, callbackData[i].object);
memset(&callbackData[i], 0, sizeof(CALLBACK_DATA));

but that cleanup is only in CALLBACK_NATIVE(unbind), not in the partial-failure path of bind().

Suggested fix: avoid storing the global references into callbackData[i] until both have been created successfully, or explicitly roll back the first global reference and clear the slot before jumping to fail.