bugfix: the "light thread" object created by ngx.thread.spawn() might…

… be prematurely collected by the Lua GC because we did not correctly register its coroutine object into the Lua regsitry table. this bug may crash the Lua VM and nginx workers under load. thanks Zhu Dejiang for reporting this issue.

src/ngx_http_lua_uthread.c

@@ -66,7 +66,7 @@ ngx_http_lua_uthread_spawn(lua_State *L)
 
     lua_pushlightuserdata(L, &ngx_http_lua_coroutines_key);
     lua_rawget(L, LUA_REGISTRYINDEX);
-    lua_pushvalue(L, -3);
+    lua_pushvalue(L, -2);
     coctx->co_ref = luaL_ref(L, -2);
     lua_pop(L, 1);
 

t/093-uthread-spawn.t

@@ -1640,3 +1640,35 @@ ok
 [alert]
 --- timeout: 3
 
+
+
+=== TEST 31: simple user thread without I/O
+--- config
+    location /lua {
+        content_by_lua '
+            function f()
+                ngx.sleep(0.1)
+                ngx.say("f")
+            end
+
+            ngx.thread.spawn(f)
+            collectgarbage()
+        ';
+    }
+--- request
+GET /lua
+--- stap2 eval: $::StapScript
+--- stap eval: $::GCScript
+--- stap_out
+create 2 in 1
+spawn user thread 2 in 1
+terminate 1: ok
+delete thread 1
+terminate 2: ok
+delete thread 2
+
+--- response_body
+f
+--- no_error_log
+[error]
+