Re: PR_GetThreadID() fails with SEGV

Julien R Pierre - Sun Microsystems wrote:
> Jonathan,
> 
> Jonathan Leighton wrote:
> 
>>> Please provide a crash stack. Even for a deprecated function, I would 
>>> not expect a crash. Are you passing a valid PRThread* pointer ?
>>
>> Hi Julien -
>>
>> I haven't yet tried to create a simple case where this fails, but 
>> where I ran into the problem was in NSPR 4.8's socket.c test code.  
>> Line 501 is:
>>
>>         DPRINTF(("TCP_Server: Created Serve_Client = 0x%lx\n", t));
>>
>> If I replace "t" with "PR_GetThreadID(t)" I get a SEGV on line 1097 of 
>> ptthread.c.  I found this to happen in Solaris 5.10 and OpenSolaris 
>> 5.11, but not in FreeBSD 7.2, Linux 2.6.28, or Mac OS X 10.5.6 
>> (Intel).  Below is the output from dbx on Solarix 5.10.
>>
>> - Jon
>>
>> .
>> .
>> .
>> t@2 (l@2) signal SEGV (no mapping at the fault address) in 
>> PR_GetThreadID at line 1097 in file "ptthread.c"
>>  1097       return (PRUint32)thred->id;  /* and I don't know what they 
>> will do with it */
>> (dbx) where
>> current thread: t@2
>> =>[1] PR_GetThreadID(thred = 0xa), line 1097 in "ptthread.c"
>>   [2] TCP_Server(arg = 0x8068af0), line 501 in "socket.c"
>>   [3] _pt_root(arg = 0x806b408), line 228 in "ptthread.c"
>>   [4] _thr_setup(0xfea50200), at 0xfeea7055
>>   [5] _lwp_start(0x1, 0xfeb5efac, 0x8052a93, 0xa, 0x0, 0xfea50200), at 
>> 0xfeea7340
>> (dbx)
> 
> Sorry for the late answer.
> 
> Your stack clearly shows an invalid PRThread pointer (thred = 0xa) being 
> passed to PR_GetThreadID.
> 
> I was able to reproduce this crash. Even when not setting the _debug_on 
> global variable, and simply fetching the thread id in a local like this, 
> in the TCP_Server function :
> 
> {
>     int tid = PR_GetThreadID(t);
> }
> 
> It turns out there is some memory corruption in this test program.
> The dbx "check -all" feature reports several "read from unallocated" 
> from multiple threads. I haven't narrowed down the cause of the 
> corruption exactly. Please file a bug on this.

Hi Julien -

Thanks for getting back to me.  I just filed the bug report.  The 
problem seems to be that the create_new_thread() routine is returning a 
thread pointer that only has local scope.  It's easily fixed.

- Jon