segfault at log4cpp::threading::ThreadLocalDataHolder<log4cpp::NDC>::freeHolder

[Gang Li]

Hi,

version 1.1.1.

It happens when I am stopping my application process (kill -9) which has
multiple threads using logger. Here is the backtrace.

// code placeholder 
87             inline static void freeHolder(void *p) {
 88                 assert(p != NULL);
 89                 delete reinterpret_cast<T *>(p);
 90              }

(gdb) bt

0 0x00007f63c73bb322 in

log4cpp::threading::ThreadLocalDataHolder<log4cpp::ndc>::freeHolder
(p=0x7f6394011f20) at ../include/log4cpp/threading/PThreads.hh:89</log4cpp::ndc>

1 0x00007f63c77e8bd2 in __nptl_deallocate_tsd () from

/lib64/libpthread.so.0

2 0x00007f63c77e8de3 in start_thread () from /lib64/libpthread.so.0

3 0x00007f63c4f78ead in clone () from /lib64/libc.so.6

The finding is in PThreads.hh, both the ~ThreadLocalDataHolder and a
callback freeHolder() registered to pthread will free data (type is NDC).
The destructor got called first and then the freeHolder(), where the core
happens.

~~~
83 inline ThreadLocalDataHolder() {
84 //::pthread_key_create(&_key, freeHolder); previous code
85 ::pthread_key_create(&_key, NULL);//hack
86 }
87
88 inline static void freeHolder(void p) {
89 assert(p != NULL);
90 delete reinterpret_cast<t *="">(p);
91 }
92
93 inline ~ThreadLocalDataHolder() {
94 T </t>data = get();
95 if (data != NULL) {
96 delete data;
97 }
98 ::pthread_key_delete(_key);
99 }

115 inline void reset(T p = NULL) {
116 T data = get();
117 if (data != NULL) {
118 delete data;
119 }
120 ::pthread_setspecific(_key, p);

I did a hack at line 85 and did a test. I repeated start/stop 7 times and
no core happens. If without the hack, I can reproduce it by start/stop 2 or
3 times. But this is log4cpp lib code, it does not seem right. Continuing
the investigation/fix.



BTW: Here is the place ThreadLocalDataHolder is initiated and data
allocated.

30 namespace {
31 threading::ThreadLocalDataHolder<ndc> _nDC;
32 }</ndc>

71 NDC& NDC::getNDC() {
72 NDC nDC = _nDC.get();
73
74 if (!nDC) {
75 nDC = new NDC();
76 _nDC.reset(nDC);
77 }
78
79 return nDC;
80 }
~~~

Is this a bug or it indicates I made some mistake? Please help. Thanks.

--
Best Regards,
Gang Li

[Alexander Perepelkin]

Hello,

just noticed your question. Will get back and read and thoroughly in nearest possible time.

Alexander

[Gang Li]

up

[Alexander Perepelkin]

Hello,

Do you mind sharing the minimal project which I can run locally to reproduce the trouble?

Thanks for the reminder.