public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libstdc++/12658] New: Thread safety problems in locale::global() and locale::locale()
@ 2003-10-17 11:15 peturr02 at ru dot is
  2003-11-28  8:30 ` [Bug libstdc++/12658] " pinskia at gcc dot gnu dot org
                   ` (32 more replies)
  0 siblings, 33 replies; 34+ messages in thread
From: peturr02 at ru dot is @ 2003-10-17 11:15 UTC (permalink / raw)
  To: gcc-bugs

PLEASE REPLY TO gcc-bugzilla@gcc.gnu.org ONLY, *NOT* gcc-bugs@gcc.gnu.org.

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=12658

           Summary: Thread safety problems in locale::global() and
                    locale::locale()
           Product: gcc
           Version: 3.4
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libstdc++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: peturr02 at ru dot is
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu

1)
locale::global(const locale&) is defined so:

  locale
  locale::global(const locale& __other)
  {
    _S_initialize();

    // XXX MT
    _Impl* __old = _S_global;
    __other._M_impl->_M_add_reference();
    _S_global = __other._M_impl; 
    if (_S_global->_M_check_same_name() 
        && (std::strcmp(_S_global->_M_names[0], "*") != 0))
      setlocale(LC_ALL, __other.name().c_str());

    // Reference count sanity check: one reference removed for the
    // subsition of __other locale, one added by return-by-value. Net
    // difference: zero. When the returned locale object's destrutor
    // is called, then the reference count is decremented and possibly
    // destroyed.
    return locale(__old);
  }

If two threads run locale::global() at the same time, such that:
1) thread 1 begins and executes
      _Impl* __old = _S_global;
and then yields.
2) thread 2 runs locale::global() completely.
3) thread 1 resumes executions and completes.

Then the reference count of __old is decremented twice, although _S_global
only holds 1 reference. To compensate, the reference count of the locale
assigned to _S_global in thread 2 is incremented, but no reference to it
is stored so is leaked.

2)
locale::locale is defined so:

  locale::locale() throw()
  { 
    _S_initialize(); 
    (_M_impl = _S_global)->_M_add_reference(); 
  }

If
1) thread 1 runs locale::locale() and yields after executing
_M_impl = _S_global but before calling _M_add_reference(), and
the reference count of _S_global is 1.
2) thread 2 runs locale::global() completely and decrements the
reference count of _S_global.
3) thread 1 resumes execution and calls _M_impl->_M_add_reference()

The last reference to _S_global is removed in 2), so
_M_add_reference() in 3) is called on an object that has already been
deleted.


^ permalink raw reply	[flat|nested] 34+ messages in thread
end of thread, other threads:[~2004-07-30  8:26 UTC | newest]

Thread overview: 34+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-10-17 11:15 [Bug libstdc++/12658] New: Thread safety problems in locale::global() and locale::locale() peturr02 at ru dot is
2003-11-28  8:30 ` [Bug libstdc++/12658] " pinskia at gcc dot gnu dot org
2003-11-28 12:43 ` paolo at gcc dot gnu dot org
2003-11-29 11:02 ` paolo at gcc dot gnu dot org
2003-11-29 11:33 ` paolo at gcc dot gnu dot org
2003-11-30  8:18 ` pinskia at gcc dot gnu dot org
2003-12-11 10:08 ` Hans dot Heukenkamp at fidaso dot de
2003-12-13  6:35 ` bkoz at gcc dot gnu dot org
2003-12-13  6:44 ` bkoz at gcc dot gnu dot org
2003-12-13  7:12 ` rittle at latour dot rsch dot comm dot mot dot com
2003-12-13  8:55 ` pcarlini at unitus dot it
2003-12-13 18:38 ` bkoz at redhat dot com
2003-12-13 18:44 ` bkoz at gcc dot gnu dot org
2003-12-15  8:14 ` peturr02 at ru dot is
2003-12-15 21:08 ` cvs-commit at gcc dot gnu dot org
2003-12-18  8:32 ` paolo at gcc dot gnu dot org
2003-12-18  8:48 ` pinskia at gcc dot gnu dot org
2004-01-07 11:27 ` peturr02 at ru dot is
2004-01-07 17:40 ` cvs-commit at gcc dot gnu dot org
2004-01-07 18:30 ` pinskia at gcc dot gnu dot org
2004-01-08 18:37 ` bkoz at gcc dot gnu dot org
2004-03-07  1:33 ` cvs-commit at gcc dot gnu dot org
2004-03-08 22:11 ` cvs-commit at gcc dot gnu dot org
2004-03-11 17:40 ` bkoz at gcc dot gnu dot org
2004-07-13 17:09 ` pinskia at gcc dot gnu dot org
2004-07-28 17:40 ` peturr02 at ru dot is
2004-07-28 17:58 ` peturr02 at ru dot is
2004-07-28 20:27 ` pcarlini at suse dot de
2004-07-28 21:11 ` pinskia at gcc dot gnu dot org
2004-07-29  9:16 ` peturr02 at ru dot is
2004-07-29 15:55 ` cvs-commit at gcc dot gnu dot org
2004-07-30  7:52 ` cvs-commit at gcc dot gnu dot org
2004-07-30  8:25 ` pcarlini at suse dot de
2004-07-30  8:26 ` pcarlini at suse dot de

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).