Mantis Bugtracker
  

Viewing Issue Advanced Details Jump to Notes ] View Simple ] Issue History ] Print ]
ID Category Severity Reproducibility Date Submitted Last Update
0001719 [Quercus] crash always 04-27-07 08:44 04-29-07 02:53
Reporter salishev View Status public  
Assigned To nam
Priority normal Resolution fixed Platform
Status closed   OS
Projection none   OS Version
ETA none Fixed in Version 3.1.1 Product Version 3.1.1
  Product Build
Summary 0001719: Thread race when com.caucho.quercus.env.DefinitionState
Description I've checked with latest resin-3.1.s070425 snapshot

The following exception is always thrown when requesting 64K pages from 2 or more threads simultanously

[19:31:33.820] java.util.ConcurrentModificationException
[19:31:33.820] at java.util.HashMap$HashIterator.nextEntry(HashMap.java:793)
[19:31:33.820] at java.util.HashMap$EntryIterator.next(HashMap.java:833)
[19:31:33.820] at java.util.HashMap$EntryIterator.next(HashMap.java:831)
[19:31:33.820] at java.util.HashMap.putAll(HashMap.java:523)
[19:31:33.820] at com.caucho.quercus.env.DefinitionState.<init>(DefinitionState.java:98)
[19:31:33.820] at com.caucho.quercus.env.DefinitionState.copy(DefinitionState.java:357)
[19:31:33.820] at com.caucho.quercus.Quercus.putDefinitionCache(Quercus.java:673)
[19:31:33.820] at com.caucho.quercus.env.Env.importPage(Env.java:3317)
[19:31:33.820] at com.caucho.quercus.env.Env.include(Env.java:3295)
[19:31:33.820] at com.caucho.quercus.expr.IncludeExpr.eval(IncludeExpr.java:86)
[19:31:33.820] at com.caucho.quercus.program.ExprStatement.execute(ExprStatement.java:64)
[19:31:33.820] at com.caucho.quercus.program.BlockStatement.execute(BlockStatement.java:99)
[19:31:33.820] at com.caucho.quercus.program.Function.callImpl(Function.java:316)
[19:31:33.820] at com.caucho.quercus.program.Function.call(Function.java:264)
[19:31:33.820] at com.caucho.quercus.expr.FunctionExpr.evalImpl(FunctionExpr.java:180)
[19:31:33.820] at com.caucho.quercus.expr.FunctionExpr.eval(FunctionExpr.java:125)
[19:31:33.820] at com.caucho.quercus.program.ExprStatement.execute(ExprStatement.java:64)
[19:31:33.820] at com.caucho.quercus.program.BlockStatement.execute(BlockStatement.java:99)
[19:31:33.820] at com.caucho.quercus.program.QuercusProgram.execute(QuercusProgram.java:239)
[19:31:33.820] at com.caucho.quercus.page.InterpretedPage.execute(InterpretedPage.java:61)
[19:31:33.820] at com.caucho.quercus.page.QuercusPage.executeTop(QuercusPage.java:115)
[19:31:33.820] at com.caucho.quercus.servlet.ResinQuercusServlet.service(ResinQuercusServlet.java:125)
[19:31:33.820] at com.caucho.quercus.servlet.QuercusServlet.service(QuercusServlet.java:341)
[19:31:33.820] at javax.servlet.http.HttpServlet.service(HttpServlet.java:92)
[19:31:33.820] at com.caucho.server.dispatch.ServletFilterChain.doFilter(ServletFilterChain.java:103)
[19:31:33.820] at com.caucho.server.webapp.WebAppFilterChain.doFilter(WebAppFilterChain.java:175)
[19:31:33.820] at com.caucho.server.dispatch.ServletInvocation.service(ServletInvocation.java:240)
[19:31:33.820] at com.caucho.server.http.HttpRequest.handleRequest(HttpRequest.java:263)
[19:31:33.820] at com.caucho.server.port.TcpConnection.run(TcpConnection.java:477)
[19:31:33.820] at com.caucho.util.ThreadPool$Item.runTasks(ThreadPool.java:600)
[19:31:33.820] at com.caucho.util.ThreadPool$Item.run(ThreadPool.java:522)
[19:31:33.820] at java.lang.Thread.run(Thread.java:619)
Steps To Reproduce
Additional Information Can't provide the test case as it's proprietary software.

It uses DokuWiki as a backend and creates an exhaustive multi-threaded request stream through http with page size of 64K.

Synchronizing access to com.caucho.quercus.env.DefinitionState solves the problem.
Attached Files

- Relationships

- Notes
(0001873)
salishev
04-28-07 04:10

The root cause is incorrect implementation of copyLazy. It supposes the original is immutable which is not true. So it's possible to concurrently mutate the original while creating non lazy copy in copy/copyOnWrite method.

So copyLazy should ensure the original is lazy.
 
(0001874)
salishev
04-28-07 04:13

Also Method findFunction mutates the object without creating the lazy copy.
 
(0001877)
nam
04-29-07 02:53

Thanks for the detailed report. DefinitionState.findFunction() was missing the copyOnWrite()'s, thus allowing a lazy copy to modify the original's HashMap.
 

- Issue History
Date Modified Username Field Change
04-27-07 08:44 salishev New Issue
04-28-07 04:10 salishev Note Added: 0001873
04-28-07 04:13 salishev Note Added: 0001874
04-29-07 02:49 nam Status new => assigned
04-29-07 02:49 nam Assigned To  => nam
04-29-07 02:53 nam Status assigned => closed
04-29-07 02:53 nam Note Added: 0001877
04-29-07 02:53 nam Resolution open => fixed
04-29-07 02:53 nam Fixed in Version  => 3.1.1


Mantis 1.0.0rc3[^]
Copyright © 2000 - 2005 Mantis Group
33 total queries executed.
28 unique queries executed.
Powered by Mantis Bugtracker