#1604 closed defect (fixed)
Crash caused by double destructions of ICE stream transport
Reported by: | nanang | Owned by: | bennylp |
---|---|---|---|
Priority: | normal | Milestone: | release-2.1 |
Component: | pjnath | Version: | trunk |
Keywords: | Cc: | ||
Backport to 1.x milestone: | release-1.16 | Backported: | yes |
Description (last modified by nanang)
The double destructions can happen when two threads, executing pj_ice_strans_destroy() and ICE stream transport's sess_dec_ref(), at the same time.
Scenario:
- Thread 1 (worker thread) is entering sess_dec_ref() and successfully decreases the counter to zero, context switched to thread 2 before evaluating the destroy condition.
- Thread 2 is entering pj_ice_strans_destroy() and setting destroy_req flag to TRUE, context switched back to thread 1 again.
- Thread 1 sees destroy_req==TRUE, so ICE stream transport gets destroyed.
- Thread 2 destroy the ICE stream transport again.
Thanks Itay Bianco for the report.
Change History (4)
comment:1 Changed 12 years ago by nanang
- Resolution set to fixed
- Status changed from new to closed
comment:2 Changed 12 years ago by nanang
- Description modified (diff)
comment:3 Changed 12 years ago by riza
In 4409:
comment:4 Changed 12 years ago by riza
- Backported set
Note: See
TracTickets for help on using
tickets.
In 4314: