172480 - pthreads: PR_Cleanup and PR_UNJOINABLE_THREAD problem

Status: NEW

(NSPR :: NSPR, defect)

Description

[Wan-Teh Chang]

NSPR version: 4.2.2

There is a problem with PR_Cleanup and PR_UNJOINABLE_THREAD.

An example of this is a segmentation fault of the 'provider'
test on HP-UX 11.00, 32-bit optimized build.  The thread
stacks are:

(gdb) thread 3
[Current thread is already 3 (system thread 9962)]
(gdb) info threads
* 3 system thread 9962  0xc10afe14 in PR_Lock ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
  2 system thread 9963  0xc01eb460 in __kwakeup () from /usr/lib/libc.2
  1 system thread 9957  0xc10b9198 in _pt_thread_death ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
(gdb) thread 1
[Switching to thread 1 (system thread 9957)]
#0  0xc10b9198 in _pt_thread_death ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
(gdb) where
#0  0xc10b9198 in _pt_thread_death ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
#1  0xc10b95c0 in PR_Cleanup ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
#2  0xf7b4 in main ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/./provider
(gdb) thread 2
[Switching to thread 2 (system thread 9963)]
#0  0xc01eb460 in __kwakeup () from /usr/lib/libc.2
(gdb) where
#0  0xc01eb460 in __kwakeup () from /usr/lib/libc.2
#1  0xc04b7dac in _lwp_cond_signal () from /usr/lib/libpthread.1
#2  0xc04b7c74 in pthread_cond_signal () from /usr/lib/libpthread.1
#3  0xc10afcf8 in pt_PostNotifies ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
#4  0xc10afecc in PR_Unlock ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
#5  0xe65c in Worker ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/./provider
#6  0xdf34 in pthread_start ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/./provider
#7  0xc04b9c5c in __pthread_create_system () from /usr/lib/libpthread.1
(gdb) thread 1
[Switching to thread 1 (system thread 9957)]
#0  0xc10b9198 in _pt_thread_death ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
(gdb) where
#0  0xc10b9198 in _pt_thread_death ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
#1  0xc10b95c0 in PR_Cleanup ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/../../dist/lib/libnspr4.sl
#2  0xf7b4 in main ()
   from /tmp_mnt/share/builds/sbsrel2/nspr/nspr422/builds/20021003.1/build_tree_
ux/hpux32.opt/pr/tests/./provider
(gdb)

The test crashed because thread 1, in PR_Cleanup, has
already destroyed pt_book.ml and set it to NULL, while
thread 3, in _pt_thread_death, tried to lock pt_book.ml
and dereferenced a null pointer.

This can be fixed by having PR_UNJOINABLE_THREAD call
_pt_thread_death earlier at the end of _pt_root, instead
of calling it as a thread specific data destructor.

This is a pre-existing problem, i.e., we should be able
to reproduce the same crash with NSPR 4.1.2.

Comment 1

[Christophe Ravel]

The target milestone is already released. Resetting target milestone.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months and this bug has priority 'P1'.
:KaiE, could you have a look please?
For more information, please visit auto_nag documentation.