[libroot] double free in DestroyThreadLocalStorageValue

[diver]

This is hrev47387.

Running LD_PRELOAD=libroot_debug.so msggrep and attempting to reboot results in a crash.

[diver]

msggrep comes from gettext-0.18.1.1-5-x86_gcc2.hpkg

[waddlesplash]

Is there anything else that causes this? I mean, a GUI program that would affect users?

[diver]

Nope, or at least i'm not aware of one :-)

[diver]

Still here in hrev53129.

[waddlesplash]

Is this a duplicate of #13159?

[korli]

I have tested two fix possibilities:

• uninstall the destructor, so it won't be called a second time.
• call __cxa_finalize() before _thread_do_exit_work()

the first one sounds better.

diff --git a/src/system/libroot/posix/pthread/pthread_key.cpp b/src/system/libroot/posix/pthread/pthread_key.cpp
index 431a4d4481..9777205fa3 100644
--- a/src/system/libroot/posix/pthread/pthread_key.cpp
+++ b/src/system/libroot/posix/pthread/pthread_key.cpp
@@ -30,6 +30,8 @@ get_key_destructor(uint32 key, int32& sequence)
                destructor = sKeyTable[key].destructor;
        } while (sKeyTable[key].sequence != sequence);
 
+       sKeyTable[key].destructor = NULL;
+
        return destructor;
 }
 

and

diff --git a/src/system/libroot/posix/stdlib/exit.cpp b/src/system/libroot/posix/stdlib/exit.cpp
index 2bc67821e7..31a88fd5b3 100644
--- a/src/system/libroot/posix/stdlib/exit.cpp
+++ b/src/system/libroot/posix/stdlib/exit.cpp
@@ -310,12 +310,12 @@ atexit(void (*func)(void))
 void
 exit(int status)
 {
-       // BeOS on exit notification for the main thread
-       _thread_do_exit_work();
-
        // unwind the exit stack, calling the registered functions
        __cxa_finalize(NULL);
 
+       // BeOS on exit notification for the main thread
+       _thread_do_exit_work();
+
        // close all open files
        _IO_cleanup();
 

[korli]

Change submitted: ​https://review.haiku-os.org/c/haiku/+/1456

[waddlesplash]

Merged in hrev53150.

[nielx]

Assign tickets with status=closed and resolution=fixed within the R1/beta2 development window to the R1/beta2 Milestone