Opened 17 months ago

Last modified 17 months ago

#18182 new bug

Crash on thread exit if image with TLS object with destructor is unloaded

Reported by: X512 Owned by: nobody
Priority: normal Milestone: Unscheduled
Component: System/runtime_loader Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Platform: All

Description

This is hrev56630.

Steps to reproduce:

  1. Dynamically load image that creates TLS object with destructor.
  2. Unload image.
  3. Exit thread. TLS object destructor from unloaded image will be called and cause crash.

Reproduce code attached.

Attachments (1)

LoaderBug2.zip (1.8 KB ) - added by X512 17 months ago.

Download all attachments as: .zip

Change History (6)

by X512, 17 months ago

Attachment: LoaderBug2.zip added

comment:1 by jessicah, 17 months ago

I wonder if adding an implementation of __cxa_thread_exit that can call into runtime_loader directly, would be the right way to do this. Will require updating buildtools once an implementation has been added.

comment:2 by waddlesplash, 17 months ago

We already have thread hooks that call TLS destructors: https://xref.landonf.org/source/xref/haiku/src/system/libroot/os/thread.c#170

So the real problem is that things are not called in the right order.

comment:3 by X512, 17 months ago

No, real problem is that TLS destructors should be called at image unload, not thread exit if image containing TLS variable is unloaded.

comment:4 by jessicah, 17 months ago

I wonder if it's not getting to https://github.com/haiku/haiku/master/src/system/runtime_loader/elf.cpp#L773, which is called via dlclose.

Version 0, edited 17 months ago by jessicah (next)
Note: See TracTickets for help on using tickets.