bneradt opened a new pull request, #13527: URL: https://github.com/apache/trafficserver/pull/13527
In DEBUG builds Mutex_trylock() passed the mutex's own srcloc and handler to lock_waiting() after failing to acquire it. Those fields belong to whichever thread holds the mutex; a thread that just failed to acquire it holds nothing, so reading them races with the holder publishing them in Mutex_trylock()/Mutex_lock() and clearing them in Mutex_unlock(). SourceLocation::str() loads `file` twice, once for valid() and again for strrchr(). Mutex_unlock() clears srcloc before releasing the mutex, so a waiter can pass the validity check and then re-read `file` as nullptr, crashing in strrchr(). That is a rare Fedora CI segfault in the cache unit tests, which are the only tests that enable the `locks` debug tag and thus the only ones that call str() on this path. Pass the waiting site instead. It is a MakeSourceLocation() temporary owned by the caller, so it cannot be raced, and a holder snapshot is stale the moment it is taken regardless. lock_holding() still reports the holder, from Mutex_unlock(), where the caller owns the fields. Fixes: #13524 Co-Authored-By: Claude Opus 5 <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
