Project

General

Profile

Bug #8391

Crash in active Wt::Http::Client destructor if started outside WApplication

Added by Dries Mys 3 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Start date:
04/21/2021
Due date:
% Done:

0%

Estimated time:

Description

Crash reason

The destructor of Http::Client calls abort which asynchronously aborts the http request.

If impl->hasServer() is false, a pointer to the Client's impl_ member is passed to asyncStop; see https://github.com/emweb/wt/blob/master/src/Wt/Http/Client.C#L850
This member will be destructed briefly after this call, as abort is called from inside the Http::Client destructor.
However, in the asynchronously executed stop function (https://github.com/emweb/wt/blob/master/src/Wt/Http/Client.C#L178), this (possibly) dangling pointer will be dereferenced.

Note that this code was added in commit 9c44b4e3c2 with commit message "Fixed possible race condition when resetting impl_ of HTTP Client". However it is unclear to me which in which scenario the mentioned race condition is avoided.

Steps to reproduce the issue

  1. Start a new thread
  2. Start a (long running) http request using Wt::Http::Client
  3. Destruct the Wt::Http::Client object (before the http request is finished.

No data to display

Also available in: Atom PDF