threads->kill() coredumps if thread has called threads->exit()

[p5pRT]

Migrated from rt.perl.org#119507 (status was 'resolved')

Searchable as RT119507$

[p5pRT]

From @jimav

This is a bug report for perl from james_avera@​yahoo.com,
generated with the help of perlbug 1.39 running under perl 5.14.2.

---

A segfault occurs if $thr->kill is called on a thread which
has already called threads->exit(). The segfault only occurs
if the thread did set up a handler before exiting.

#!/usr/bin/perl
use strict; use warnings;
use threads;

sub thread_main {
  $SIG{INT} = sub {
  print "Thread caught signal\n";
  threads->exit();
  };
  print "Thread ", threads->self()->tid(), " started, now exiting\n";
  threads->exit();
}

my $th = threads->create(\&thread_main);
threads->yield() for (1..1000); # many of these seem necessary
$th->kill('SIGINT'); # segfault
$th->join();
exit 0;

---

---

Flags​:
  category=library
  severity=medium
  module=threads

---

Site configuration information for perl 5.14.2​:

Configured by Debian Project at Mon Apr 15 15​:34​:46 UTC 2013.

Summary of my perl5 (revision 5 version 14 subversion 2) configuration​:
 
  Platform​:
  osname=linux, osvers=3.2.0-37-generic, archname=x86_64-linux-gnu-thread-multi
  uname='linux lamiak 3.2.0-37-generic #58-ubuntu smp thu jan 24 15​:28​:10 utc 2013 x86_64 x86_64 x86_64 gnulinux '
  config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Dldflags= -Wl,-Bsymbolic-functions -Wl,-z,relro -Dlddlflags=-shared -Wl,-Bsymbolic-functions -Wl,-z,relro -Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr -Dprivlib=/usr/share/perl/5.14 -Darchlib=/usr/lib/perl/5.14 -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5 -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl/5.14.2 -Dsitearch=/usr/local/lib/perl/5.14.2 -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Dsiteman3dir=/usr/local/man/man3 -Duse64bitint -Dman1ext=1 -Dman3ext=3perl -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio -Uusenm -Ui_libutil -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib -Dlibperl=libperl.so.5.14.2 -des'
  hint=recommended, useposix=true, d_sigaction=define
  useithreads=define, usemultiplicity=define
  useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
  use64bitint=define, use64bitall=define, uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fstack-protector -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
  optimize='-O2 -g',
  cppflags='-D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fstack-protector -fno-strict-aliasing -pipe -I/usr/local/include'
  ccversion='', gccversion='4.7.3', gccosandvers=''
  intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
  ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
  alignbytes=8, prototype=define
  Linker and Libraries​:
  ld='cc', ldflags =' -fstack-protector -L/usr/local/lib'
  libpth=/usr/local/lib /lib/x86_64-linux-gnu /lib/../lib /usr/lib/x86_64-linux-gnu /usr/lib/../lib /lib /usr/lib
  libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt
  perllibs=-ldl -lm -lpthread -lc -lcrypt
  libc=, so=so, useshrplib=true, libperl=libperl.so.5.14.2
  gnulibc_version='2.17'
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
  cccdlflags='-fPIC', lddlflags='-shared -L/usr/local/lib -fstack-protector'

Locally applied patches​:
 

---

@​INC for perl 5.14.2​:
  /home/jima/lib/perl
  /home/jima/perl5/lib/perl5/x86_64-linux-gnu-thread-multi
  /home/jima/perl5/lib/perl5/x86_64-linux-gnu-thread-multi
  /home/jima/perl5/lib/perl5
  /etc/perl
  /usr/local/lib/perl/5.14.2
  /usr/local/share/perl/5.14.2
  /usr/lib/perl5
  /usr/share/perl5
  /usr/lib/perl/5.14
  /usr/share/perl/5.14
  /usr/local/lib/site_perl
  .

---

Environment for perl 5.14.2​:
  HOME=/home/jima
  LANG=en_US.UTF-8
  LANGUAGE (unset)
  LD_LIBRARY_PATH=/home/jima/local/lib
  LOGDIR (unset)
  PATH=/home/jima/perl5/bin​:/home/jima/bin​:/home/jima/local/bin​:/home/jima/jima_tools/x86_64/bin​:/home/jima/jima_tools/bin​:/opt/libreoffice3.6/program​:/usr/bin​:/bin​:/usr/sbin​:/sbin​:/usr/bin/X11​:/usr/local/bin​:/usr/lib/lightdm/lightdm​:/usr/local/sbin​:/usr/games​:/usr/local/games​:/usr/lib/jvm/java-7-oracle/bin​:/usr/lib/jvm/java-7-oracle/db/bin​:/usr/lib/jvm/java-7-oracle/jre/bin​:.
  PERL5LIB=/home/jima/lib/perl​:/home/jima/perl5/lib/perl5/x86_64-linux-gnu-thread-multi​:/home/jima/perl5/lib/perl5
  PERL_BADLANG (unset)
  PERL_LOCAL_LIB_ROOT=/home/jima/perl5
  PERL_MB_OPT=--install_base /home/jima/perl5
  PERL_MM_OPT=INSTALL_BASE=/home/jima/perl5
  SHELL=/bin/bash

[p5pRT]

From @jkeenan

On Wed Aug 28 14​:29​:22 2013, jimav wrote​:

This is a bug report for perl from james_avera@​yahoo.com,
generated with the help of perlbug 1.39 running under perl 5.14.2.

-----------------------------------------------------------------
A segfault occurs if $thr->kill is called on a thread which
has already called threads->exit(). The segfault only occurs
if the thread did set up a handler before exiting.

#!/usr/bin/perl
use strict; use warnings;
use threads;

sub thread_main {
$SIG{INT} = sub {
print "Thread caught signal\n";
threads->exit();
};
print "Thread ", threads->self()->tid(), " started, now exiting\n";
threads->exit();
}

my $th = threads->create(\&thread_main);
threads->yield() for (1..1000); # many of these seem necessary
$th->kill('SIGINT'); # segfault
$th->join();
exit 0;

-----------------------------------------------------------------
---
Flags​:
category=library
severity=medium
module=threads
---
Site configuration information for perl 5.14.2​:

To test the poster's claim, I built a threaded perl on the dromedary
server, albeit with only '-Dusethreads' rather than all the
configuration arguments he used (see attachment).

I then adapted his script to take a command-line argument for the number
of repetitions in the 'for' loop. Here is some output at different
numbers of repetitions.

#####
$ ./perl -Ilib ../p5p/119507-threads.pl 1
Signal INT received in thread 1, but no signal handler set. at
../p5p/119507-threads.pl line 20.
Perl exited with active threads​:
  1 running and unjoined
  0 finished and unjoined
  0 running and detached
$ ./perl -Ilib ../p5p/119507-threads.pl 10
Signal INT received in thread 1, but no signal handler set. at
../p5p/119507-threads.pl line 20.
Perl exited with active threads​:
  1 running and unjoined
  0 finished and unjoined
  0 running and detached
$ ./perl -Ilib ../p5p/119507-threads.pl 100
Signal INT received in thread 1, but no signal handler set. at
../p5p/119507-threads.pl line 20.
Perl exited with active threads​:
  1 running and unjoined
  0 finished and unjoined
  0 running and detached
Thread 1 started, now exiting
$ ./perl -Ilib ../p5p/119507-threads.pl 200
Thread 1 started, now exiting
Thread caught signal
$ ./perl -Ilib ../p5p/119507-threads.pl 300
Thread 1 started, now exiting

... and same results for 400, 500 and 1000 as for 300
#####

Thank you very much.
Jim Keenan

[p5pRT]

From @jkeenan

Summary of my perl5 (revision 5 version 19 subversion 4) configuration​:
  Commit id​: 5b90322
  Platform​:
  osname=linux, osvers=2.6.32-358.el6.x86_64, archname=x86_64-linux-thread-multi
  uname='linux dromedary-001.ams6.corp.booking.com 2.6.32-358.el6.x86_64 #1 smp fri feb 22 00​:31​:26 utc 2013 x86_64 x86_64 x86_64 gnulinux '
  config_args='-des -Dusedevel -Dusethreads'
  hint=recommended, useposix=true, d_sigaction=define
  useithreads=define, usemultiplicity=define
  useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
  use64bitint=define, use64bitall=define, uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
  optimize='-O2',
  cppflags='-D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include'
  ccversion='', gccversion='4.4.7 20120313 (Red Hat 4.4.7-3)', gccosandvers=''
  intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
  ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
  alignbytes=8, prototype=define
  Linker and Libraries​:
  ld='cc', ldflags =' -fstack-protector -L/usr/local/lib'
  libpth=/usr/local/lib /lib/../lib64 /usr/lib/../lib64 /lib /usr/lib /lib64 /usr/lib64 /usr/local/lib64
  libs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
  perllibs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
  libc=/lib/libc-2.12.so, so=so, useshrplib=false, libperl=libperl.a
  gnulibc_version='2.12'
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
  cccdlflags='-fPIC', lddlflags='-shared -O2 -L/usr/local/lib -fstack-protector'

Characteristics of this binary (from libperl)​:
  Compile-time options​: HAS_TIMES MULTIPLICITY PERLIO_LAYERS
  PERL_DONT_CREATE_GVSV
  PERL_HASH_FUNC_ONE_AT_A_TIME_HARD
  PERL_IMPLICIT_CONTEXT PERL_MALLOC_WRAP
  PERL_NEW_COPY_ON_WRITE PERL_PRESERVE_IVUV
  PERL_USE_DEVEL USE_64_BIT_ALL USE_64_BIT_INT
  USE_ITHREADS USE_LARGE_FILES USE_LOCALE
  USE_LOCALE_COLLATE USE_LOCALE_CTYPE
  USE_LOCALE_NUMERIC USE_PERLIO USE_PERL_ATOF
  USE_REENTRANT_API
  Built under linux
  Compiled at Aug 29 2013 01​:24​:57
  %ENV​:
  PERLBREW_BASHRC_VERSION="0.63"
  PERLBREW_HOME="/home/jkeenan/.perlbrew"
  PERLBREW_ROOT="/home/jkeenan/perl5/perlbrew"
  @​INC​:
  lib
  /usr/local/lib/perl5/site_perl/5.19.4/x86_64-linux-thread-multi
  /usr/local/lib/perl5/site_perl/5.19.4
  /usr/local/lib/perl5/5.19.4/x86_64-linux-thread-multi
  /usr/local/lib/perl5/5.19.4
  /usr/local/lib/perl5/site_perl
  .

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @jdhedden

The OP did not state the version of threads being used. This bug was
fixed with v1.78 as per the Changes file​:

1.78 Wed Sep 22 17​:21​:22 2010
  - Handle missing signal handler in thread (threads bug #60460)

Here's the link to the bug report​:

https://rt.cpan.org/Public/Bug/Display.html?id=60460

[p5pRT]

From @cpansprout

On Wed Aug 28 17​:42​:25 2013, jdhedden@​gmail.com wrote​:

The OP did not state the version of threads being used. This bug was
fixed with v1.78 as per the Changes file​:

1.78 Wed Sep 22 17​:21​:22 2010
- Handle missing signal handler in thread (threads bug #60460)

Here's the link to the bug report​:

https://rt.cpan.org/Public/Bug/Display.html?id=60460

Well, that’s odd, because the original poster is using 5.14.2, which
included threads 1.83. I can’t imagine he downgraded it!

Has someone misdiagnosed the problem?

--

Father Chrysostomos

[p5pRT]

From @jdhedden

On Wed Aug 28 18​:17​:51 2013, sprout wrote​:

On Wed Aug 28 17​:42​:25 2013, jdhedden@​gmail.com wrote​:

The OP did not state the version of threads being used. This bug
was
fixed with v1.78 as per the Changes file​:

1.78 Wed Sep 22 17​:21​:22 2010
- Handle missing signal handler in thread (threads bug #60460)

Here's the link to the bug report​:

https://rt.cpan.org/Public/Bug/Display.html?id=60460

Well, that’s odd, because the original poster is using 5.14.2, which
included threads 1.83. I can’t imagine he downgraded it!

Has someone misdiagnosed the problem?

I ran a test on with 5.14.2 similar to what Jim did, and got similar
results, but no core dump.

James, which version of threads you using?

[p5pRT]

From @jkeenan

On Wed Aug 28 18​:42​:38 2013, jdhedden@​gmail.com wrote​:

James, which version of threads you using?

Whatever is in blead, which I presume means 1.87.

[p5pRT]

From @iabyn

On Wed, Aug 28, 2013 at 07​:01​:02PM -0700, James E Keenan via RT wrote​:

On Wed Aug 28 18​:42​:38 2013, jdhedden@​gmail.com wrote​:

James, which version of threads you using?

Whatever is in blead, which I presume means 1.87.

A bisect shows it was fixed in v5.18.0-RC1 by​:

commit 47c9d59
Author​: Nicholas Clark <nick@​ccl4.org>
Date​: Sat Apr 14 15​:51​:33 2012 +0200

  Remove PERL_ASYNC_CHECK() from Perl_leave_scope().
 
  PERL_ASYNC_CHECK() was added to Perl_leave_scope() as part of commit
  f410a21, which moved signal dispatch from the runloop to
  control flow ops, to mitigate nearly all of the speed cost of safe
  signals.
 
  The assumption was that scope exit was a safe place to dispatch signals.
  However, this is not true, as parts of the regex engine call
  leave_scope(), the regex engine stores some state in per-interpreter
  variables, and code called within signal handlers can change these
  values.
 
  Hence remove the call to PERL_ASYNC_CHECK() from Perl_leave_scope(), and
  add it explicitly in the various OPs which were relying on their call to
  leave_scope() to dispatch any pending signals. Also add a
  PERL_ASYNC_CHECK() to the exit of the runloop, which ensures signals
  still dispatch from S_sortcv() and S_sortcv_stacked(), as well as
  addressing one of the concerns in the commit message of
  f410a21​:
 
  Subtle bugs might remain - there might be constructions that enter
  the runloop (where signals used to be dispatched) but don't contain
  any PERL_ASYNC_CHECK() calls themselves.
 
  Finally, move the PERL_ASYNC_CHECK(); added by that commit to pp_goto to
  the end of the function, to be consistent with the positioning of all
  other PERL_ASYNC_CHECK() calls - at the beginning or end of OP
  functions, hence just before the return to or just after the call from
  the runloop, and hence effectively at the same point as the previous
  location of PERL_ASYNC_CHECK() in the runloop.

--
"You're so sadly neglected, and often ignored.
A poor second to Belgium, When going abroad."
  -- Monty Python, "Finland"

[p5pRT]

@cpansprout - Status changed from 'open' to 'resolved'

[p5pRT]

From @jimav

On 08/28/2013 07​:01 PM, James E Keenan via RT wrote​:
| James, which version of threads you using?

For the record, I have threads​::VERSION=1.83
It sounds like the bug has been fixed already upstream.