Skip to content
This repository has been archived by the owner on Dec 15, 2022. It is now read-only.

Synchronize deletion of mInterface in NSFW destructor #5

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

nathansobo
Copy link

@nathansobo nathansobo commented May 15, 2019

We're seeing intermittent crashes on Windows calling mInterface->isWatching() in StartWorker::Execute on a background thread. The only unsynchronized access to mInterface that we can find takes place in the destructor of NSFW itself, making us wonder if interleaved calls to start and stop might be causing the following race condition.

  • Start is called and sets the persistent handle to prevent the NSFW from being garbage collected
  • Stop is called
  • Before the StopWorker's HandleOkCallback runs and clears the
    persistent handle, we call start again
  • Start spawns a worker thread
  • Stop's ok callback clears the persistent handle, leaving the NSFW free to be collected as garbage
  • The garbage collector runs and runs the destructor on the NSFW object,
    which clears the mInterface field
  • The StartWorker accesses the mInterface pointer on a background thread, which now points to a deleted object

We don't have proof that this is what is happening, but if it is, I'm hoping that locking the field access in the destructor would prevent it.

I want to do some more local testing on Windows to see if I can reproduce the crash again without this change, then spend 2-3x more time running with this change to see if it avoids the crash. 😓

cc @as-cii @rafeca

We're seeing intermittent crashes on Windows calling 
mInterface->isWatching() in StartWorker::Execute on a background thread. 
The only unsynchronized access to mInterface that we can find takes 
place in the destructor of NSFW itself, making us wonder if interleaved 
calls to start and stop might be causing the following race condition.

* Start is called and sets the persistent handle
* Stop is called
* Before the StopWorker's HandleOkCallback runs and clears the 
persistent handle, we call start again
* Start spawns a worker thread
* Stop's ok callback clears the persistent handle
* The garbage collector runs and runs the destructor on the NSFW object, 
which clears the mInterface field
* The thread accesses the mInterface pointer, which has now been deleted

We don't have proof that this is what is happening, but if it is, I'm 
hoping that locking the field access in the destructor would prevent it.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant