Fix heap-use-after-free issue detected by thread sanitizer

No need to stop Producer Notififer in the destructor of
dcpConnMap. This is already taken care of when the executor
pool is unregistered.

WARNING: ThreadSanitizer: heap-use-after-free (pid=158780)
  Read of size 8 at 0x7d180000c1a0 by main thread:
    #0 DcpConnMap::~DcpConnMap() /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/src/tasks.h:103 (ep.so+0x0000000453e1)
    #1 DcpConnMap::~DcpConnMap() /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/src/connmap.cc:954 (ep.so+0x0000000456f5)
    #2 EventuallyPersistentEngine::~EventuallyPersistentEngine() /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/src/ep_engine.cc:6410 (ep.so+0x0000000d0e5c)
    #3 EvpDestroy(engine_interface*, bool) /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/src/ep_engine.cc:147 (ep.so+0x0000000b27f7)
    #4 mock_destroy(engine_interface*, bool) /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/memcached/programs/engine_testapp/engine_testapp.cc:99 (engine_testapp+0x0000004cbd97)
    #5 destroy_bucket(engine_interface*, engine_interface_v1*, bool) /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/memcached/programs/engine_testapp/engine_testapp.cc:996 (engine_testapp+0x0000004cbc19)
    #6 perf_latency_baseline_multi_thread_bucket(test*, int, int, int) /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/tests/ep_perfsuite.cc:386 (ep_perfsuite.so+0x00000000dfc4)
    #7 perf_latency_baseline_multi_bucket_4(test*) /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/tests/ep_perfsuite.cc:429 (ep_perfsuite.so+0x0000000091ef)
    #8 execute_test(test, char const*, char const*) /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/memcached/programs/engine_testapp/engine_testapp.cc:1104 (engine_testapp+0x0000004cb21c)
    #9 __libc_start_main /build/buildd/eglibc-2.15/csu/libc-start.c:226 (libc.so.6+0x00000002176c)

  Previous write of size 8 at 0x7d180000c1a0 by thread T15 (mutexes: write M11751):
    #0 operator delete(void*) <null> (engine_testapp+0x0000004641db)
    #1 DcpConnMap::DcpProducerNotifier::~DcpProducerNotifier() /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/src/connmap.h:530 (ep.so+0x00000004ab85)
    #2 ExecutorThread::run() /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/src/atomic.h:325 (ep.so+0x0000000f17cb)
    #3 launch_executor_thread(void*) /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/ep-engine/src/executorthread.cc:33 (ep.so+0x0000000f15f5)
    #4 platform_thread_wrap(void*) /home/couchbase/jenkins/workspace/ep-engine-threadsanitizer-master/platform/src/cb_pthreads.cc:54 (libplatform.so.0.1.0+0x000000004e7b)

Change-Id: Ib458d0826cc33b4b233da5a422b90bcf08d408bb
Reviewed-on: http://review.couchbase.org/57699
Well-Formed: buildbot <build@couchbase.com>
Tested-by: buildbot <build@couchbase.com>
Reviewed-by: Chiyoung Seo <chiyoung@couchbase.com>

diff --git a/src/connmap.cc b/src/connmap.cc
index bf7b8ae..60268e7 100644 (file)
--- a/src/connmap.cc
+++ b/src/connmap.cc
@@ -933,10 +933,6 @@ DcpConnMap::DcpConnMap(EventuallyPersistentEngine &e)
     producerNotifier(NULL) {
 }
 
-DcpConnMap::~DcpConnMap() {
-    stopProducerNotifier();
-}
-
 DcpConsumer *DcpConnMap::newConsumer(const void* cookie,
                                      const std::string &name)
 {
@@ -1265,11 +1261,7 @@ void DcpConnMap::startProducerNotifier() {
 }
 
 void DcpConnMap::wakeProducerNotifier() {
-    if (producerNotifier->wakeMeUp()) {
+    if (static_cast<DcpProducerNotifier*>(producerNotifier.get())->wakeMeUp()) {
         ExecutorPool::get()->wake(producerNotifier->getId());
     }
 }
-
-void DcpConnMap::stopProducerNotifier() {
-    ExecutorPool::get()->cancel(producerNotifier->getId());
-}
\ No newline at end of file

diff --git a/src/connmap.h b/src/connmap.h
index 46be290..299d58e 100644 (file)
--- a/src/connmap.h
+++ b/src/connmap.h
@@ -435,8 +435,6 @@ public:
 
     DcpConnMap(EventuallyPersistentEngine &engine);
 
-    ~DcpConnMap();
-
     /**
      * Find or build a dcp connection for the given cookie and with
      * the given name.
@@ -476,7 +474,6 @@ public:
 
     void startProducerNotifier();
     void wakeProducerNotifier();
-    void stopProducerNotifier();
 
 private:
 
@@ -524,7 +521,7 @@ private:
 
     std::list<connection_t> deadConnections;
 
-    DcpProducerNotifier* producerNotifier;
+    ExTask producerNotifier;
 
     std::deque<DcpProducerNotification> notifications;
     Mutex notificationsLock;