Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-39279

Race between ServiceContext::ClientDeleter and waitForClientsToFinish()

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 4.1.9
    • Affects Version/s: None
    • Component/s: Internal Code
    • Labels:
      None
    • Fully Compatible
    • ALL
    • Storage NYC 2019-03-25
    • 61
    • 2

      ServiceContext::ClientDeleter::operator()(Client* client) accesses the serviceContext outside the serviceContext's mutex to call the registered observers on onDestroy(), while the serviceContext may have already been destroyed by service_context_test_fixture, since the client vector is empty, checked by waitForClientsToFinish.

      void ServiceContext::ClientDeleter::operator()(Client* client) const {
          ServiceContext* const service = client->getServiceContext();
          {
              stdx::lock_guard<stdx::mutex> lk(service->_mutex);
              invariant(service->_clients.erase(client));
              if (service->_clients.empty()) {
                  service->_clientsEmptyCondVar.notify_all();
              }
          }
          // The serviceContext may have already been destroyed.
          onDestroy(client, service->_clientObservers);
          delete client;
      }
      

            Assignee:
            louis.williams@mongodb.com Louis Williams
            Reporter:
            siyuan.zhou@mongodb.com Siyuan Zhou
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: