[libroot] double free in DestroyThreadLocalStorageValue

[diver]

This is hrev47387.

Running LD_PRELOAD=libroot_debug.so msggrep and attempting to reboot results in a crash.

[diver]

msggrep comes from gettext-0.18.1.1-5-x86_gcc2.hpkg

[waddlesplash]

Is there anything else that causes this? I mean, a GUI program that would affect users?

[diver]

Nope, or at least i'm not aware of one :-)

[diver]

Still here in hrev53129.

[waddlesplash]

Is this a duplicate of #13159?

[korli]

UPDATE: was wrongly uninstalling the destructor.

I have tested two fix possibilities:

• reset the value, so it won't be called a second time.
• call __cxa_finalize() before _thread_do_exit_work()

the first one sounds better.

diff --git a/src/system/libroot/posix/pthread/pthread_key.cpp b/src/system/libroot/posix/pthread/pthread_key.cpp
index 431a4d4481..a34ab022f0 100644
--- a/src/system/libroot/posix/pthread/pthread_key.cpp
+++ b/src/system/libroot/posix/pthread/pthread_key.cpp
@@ -54,6 +54,8 @@ get_key_value(pthread_thread* thread, uint32 key, int32 sequence)
                value = keyData.value;
        } while (specificSequence != sequence);
 
+       keyData.value = NULL;
+
        return value;
 }
 

and

diff --git a/src/system/libroot/posix/stdlib/exit.cpp b/src/system/libroot/posix/stdlib/exit.cpp
index 2bc67821e7..31a88fd5b3 100644
--- a/src/system/libroot/posix/stdlib/exit.cpp
+++ b/src/system/libroot/posix/stdlib/exit.cpp
@@ -310,12 +310,12 @@ atexit(void (*func)(void))
 void
 exit(int status)
 {
-       // BeOS on exit notification for the main thread
-       _thread_do_exit_work();
-
        // unwind the exit stack, calling the registered functions
        __cxa_finalize(NULL);
 
+       // BeOS on exit notification for the main thread
+       _thread_do_exit_work();
+
        // close all open files
        _IO_cleanup();
 

[korli]

Change submitted: ​https://review.haiku-os.org/c/haiku/+/1456

[waddlesplash]

Merged in hrev53150.

[nielx]

Assign tickets with status=closed and resolution=fixed within the R1/beta2 development window to the R1/beta2 Milestone