Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
bugfix: the "light thread" object created by ngx.on_abort() might be …
…prematurely collected by the Lua GC because we did not correctly register its coroutine object into the Lua regsitry table. this bug may crash the Lua VM and nginx workers under load. thanks Zhu Dejiang for reporting this issue.
  • Loading branch information
agentzh committed Dec 2, 2012
1 parent 2ecf5af commit 7b0d7da
Show file tree
Hide file tree
Showing 3 changed files with 32 additions and 5 deletions.
7 changes: 6 additions & 1 deletion src/ngx_http_lua_control.c
Expand Up @@ -386,13 +386,18 @@ ngx_http_lua_on_abort(lua_State *L)

lua_pushlightuserdata(L, &ngx_http_lua_coroutines_key);
lua_rawget(L, LUA_REGISTRYINDEX);
lua_pushvalue(L, -3);
lua_pushvalue(L, -2);

dd("on_wait thread 1: %p", lua_tothread(L, -1));

coctx->co_ref = luaL_ref(L, -2);
lua_pop(L, 1);

coctx->is_uthread = 1;
ctx->on_abort_co_ctx = coctx;

dd("on_wait thread 2: %p", coctx->co);

coctx->co_status = NGX_HTTP_LUA_CO_SUSPENDED;
coctx->parent_co_ctx = ctx->cur_co_ctx;

Expand Down
4 changes: 2 additions & 2 deletions t/023-rewrite/on-abort.t
Expand Up @@ -68,7 +68,7 @@ lua req cleanup
--- timeout: 0.2
--- abort
--- wait: 0.5
--- wait: 0.6
--- ignore_response
--- no_error_log
[error]
Expand Down Expand Up @@ -303,7 +303,7 @@ lua req cleanup
--- timeout: 0.2
--- abort
--- wait: 0.5
--- wait: 0.6
--- ignore_response
--- error_log
client prematurely closed connection
Expand Down
26 changes: 24 additions & 2 deletions t/101-on-abort.t
Expand Up @@ -20,7 +20,7 @@ our $StapScript = $t::StapThread::StapScript;

repeat_each(2);

plan tests => repeat_each() * (blocks() * 4 + 18);
plan tests => repeat_each() * (blocks() * 4 + 16);

$ENV{TEST_NGINX_RESOLVER} ||= '8.8.8.8';
$ENV{TEST_NGINX_MEMCACHED_PORT} ||= '11211';
Expand Down Expand Up @@ -293,7 +293,7 @@ lua req cleanup
--- timeout: 0.2
--- abort
--- wait: 0.5
--- wait: 0.6
--- ignore_response
--- error_log
client prematurely closed connection
Expand Down Expand Up @@ -531,6 +531,7 @@ delete thread 2
delete thread 3
--- timeout: 0.2
--- wait: 0.1
--- abort
--- ignore_response
--- no_error_log
Expand Down Expand Up @@ -766,3 +767,24 @@ main handler done
client prematurely closed connection
on abort called
=== TEST 17: GC issue with the on_abort thread object
--- config
location = /t {
lua_check_client_abort on;
content_by_lua '
ngx.on_abort(function () end)
collectgarbage()
ngx.sleep(60)
';
}
--- request
GET /t
--- abort
--- timeout: 0.2
--- ignore_response
--- no_error_log
[error]
[alert]

0 comments on commit 7b0d7da

Please sign in to comment.