Permalink
Browse files

bugfix: the "light thread" object created by ngx.thread.spawn() might…

… be prematurely collected by the Lua GC because we did not correctly register its coroutine object into the Lua regsitry table. this bug may crash the Lua VM and nginx workers under load. thanks Zhu Dejiang for reporting this issue.
  • Loading branch information...
1 parent 7b0d7da commit ff1949b075fb4a971f62dd5f16699e8311c3b645 @agentzh agentzh committed Dec 2, 2012
Showing with 33 additions and 1 deletion.
  1. +1 −1 src/ngx_http_lua_uthread.c
  2. +32 −0 t/093-uthread-spawn.t
@@ -66,7 +66,7 @@ ngx_http_lua_uthread_spawn(lua_State *L)
lua_pushlightuserdata(L, &ngx_http_lua_coroutines_key);
lua_rawget(L, LUA_REGISTRYINDEX);
- lua_pushvalue(L, -3);
+ lua_pushvalue(L, -2);
coctx->co_ref = luaL_ref(L, -2);
lua_pop(L, 1);
View
@@ -1640,3 +1640,35 @@ ok
[alert]
--- timeout: 3
+
+
+=== TEST 31: simple user thread without I/O
+--- config
+ location /lua {
+ content_by_lua '
+ function f()
+ ngx.sleep(0.1)
+ ngx.say("f")
+ end
+
+ ngx.thread.spawn(f)
+ collectgarbage()
+ ';
+ }
+--- request
+GET /lua
+--- stap2 eval: $::StapScript
+--- stap eval: $::GCScript
+--- stap_out
+create 2 in 1
+spawn user thread 2 in 1
+terminate 1: ok
+delete thread 1
+terminate 2: ok
+delete thread 2
+
+--- response_body
+f
+--- no_error_log
+[error]
+

0 comments on commit ff1949b

Please sign in to comment.