Project

General

Profile

Bug #8391

Crash in active Wt::Http::Client destructor if started outside WApplication

Added by Dries Mys about 1 year ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Target version:
Start date:
04/21/2021
Due date:
% Done:

100%

Estimated time:

Description

Crash reason

The destructor of Http::Client calls abort which asynchronously aborts the http request.

If impl->hasServer() is false, a pointer to the Client's impl_ member is passed to asyncStop; see https://github.com/emweb/wt/blob/master/src/Wt/Http/Client.C#L850
This member will be destructed briefly after this call, as abort is called from inside the Http::Client destructor.
However, in the asynchronously executed stop function (https://github.com/emweb/wt/blob/master/src/Wt/Http/Client.C#L178), this (possibly) dangling pointer will be dereferenced.

Note that this code was added in commit 9c44b4e3c2 with commit message "Fixed possible race condition when resetting impl_ of HTTP Client". However it is unclear to me which in which scenario the mentioned race condition is avoided.

Steps to reproduce the issue

  1. Start a new thread
  2. Start a (long running) http request using Wt::Http::Client
  3. Destruct the Wt::Http::Client object (before the http request is finished.

Files

issue_8391.cpp (210 Bytes) issue_8391.cpp Roel Standaert, 08/09/2021 11:51 AM
#1

Updated by Roel Standaert 11 months ago

  • Status changed from New to InProgress
  • Assignee set to Roel Standaert
  • Target version set to 4.6.0
#2

Updated by Roel Standaert 11 months ago

Added a simple test that reproduces this issue when built with address sanitizer.

#3

Updated by Roel Standaert 10 months ago

  • Status changed from InProgress to Review
#4

Updated by Roel Standaert 10 months ago

  • Status changed from Review to Implemented @Emweb
#5

Updated by Roel Standaert 10 months ago

  • % Done changed from 0 to 100
#6

Updated by Roel Standaert 10 months ago

  • Status changed from Implemented @Emweb to Resolved
#7

Updated by Roel Standaert 6 months ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF