Downcast from Thread to EThread in Thread::Thread is undefined behavior

[kenballus]

EThread derives from Thread, but the Thread constructor does a static_cast of this to EThread *:

Thread::Thread()
{
  mutex = new_ProxyMutex();
  MUTEX_TAKE_LOCK(mutex, static_cast<EThread *>(this));
  mutex->nthread_holding += THREAD_MUTEX_THREAD_HOLDING;
}

Dereferencing a pointer cast from Thread * to EThread * is UB when the underlying object was instantiated as a Thread. Since the above cast happens in the Thread constructor, it is UB.

Here's the UBSan error I get during ATS startup that alerted me to this problem:

/app/trafficserver/src/iocore/eventsystem/Thread.cc:42:3: runtime error: downcast of address 0x7fbd81376800 which does not point to an object of type 'EThread'
0x7fbd81376800: note: object is of type 'Thread'
 00 00 00 00  90 89 43 21 3b 56 00 00  00 00 00 00 00 00 00 00  80 8f 00 00 90 62 00 00  00 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'Thread'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /app/trafficserver/src/iocore/eventsystem/Thread.cc:42:3 in

[ywkaras]

Thread::Thread() is a protected member, and is the only constructor. Looking at this:

wkaras ~/REPOS/TS
O$ grep '^ *class.*\WThread' $(findsrc)
./include/iocore/eventsystem/EventProcessor.h:  class ThreadInit : public Continuation
./include/iocore/eventsystem/Processor.h:class Thread;
./include/iocore/eventsystem/Thread.h:  class called EThread, derived from Thread. It is the responsibility of
./include/iocore/eventsystem/Thread.h:class Thread
./include/iocore/eventsystem/EThread.h:class EThread : public Thread
./src/iocore/eventsystem/UnixEventProcessor.cc:class ThreadAffinityInitializer : public Continuation
./src/iocore/eventsystem/UnixEventProcessor.cc:class ThreadInitByFunc : public Continuation
./src/proxy/logging/LogObject.cc:class ThreadLocalLogBufferManager : public Continuation
./tools/benchmark/benchmark_ProxyAllocator.cc:class BThread : public Thread
wkaras ~/REPOS/TS
O$ 

It looks like the issue is only a problem in the proxy allocator benchmark tool. Otherwise, Thread instances only exist as subinstances of EThread. But, still krufy and fragile, best removed.