Revision 11ec15419c45d269af5cb46355a534dc4173762c authored by Philippe Canal on 14 December 2022, 21:11:12 UTC, committed by Philippe Canal on 27 January 2023, 21:15:57 UTC
Description of the race conditions:

(1) thread one create TFile, gDirectory now points to that file.
(2) thread two delete TFile, the destructor calls CleanTargets which has 4 distinct phase
(a) take the TFile spin lock and update all the TContext that points to the file
(b) still hold the spin lock, clean the other thread's directory.
(c) deal with the TContext that were being destructed at the same time
(d) update the local gDirectory

If between (2)(a) and (2)(b), thread (1) starts the creation of a TContext, and
is held at the start of RegisterContext after thread 2 release the spin lock,
thread 1 might awaken only after the TFile object has been deleted and thus
RegisterContext would access delete memory.

If during the destruction of the TFile by thread 2, thread (1) starts the
creation of a TContext, but is suspended right before the start of RegisterContext,
when it comes back it will use deleted memory to try to acquire the spin lock.
1 parent 145d8a4
History

README.md

back to top