[llvm-bugs] [Bug 27724] New: atomic_compare_exchange_strong on shared_ptrs can deadlock

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=27724

            Bug ID: 27724
           Summary: atomic_compare_exchange_strong on shared_ptrs can
                    deadlock
           Product: libc++
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: All Bugs
          Assignee: unassignedclangbugs at nondot.org
          Reporter: hboehm at google.com
                CC: llvm-bugs at lists.llvm.org, mclow.lists at gmail.com
    Classification: Unclassified

This came out of a WG21 discussion a while ago that basically concluded that
all existing CAS implementations on shared_ptr are broken, though in different
ways.

The libc++ implementation in <memory> reads

template <class _Tp>
bool
atomic_compare_exchange_strong(shared_ptr<_Tp>* __p, shared_ptr<_Tp>* __v,
shared_ptr<_Tp> __w)
{
    __sp_mut& __m = __get_sp_mut(__p);
    __m.lock();
    if (__p->__owner_equivalent(*__v))
    {
        *__p = __w;
        __m.unlock();
        return true;
    }
    *__v = *__p;
    __m.unlock();
    return false;
}

Both of the assignments are performed while holding a lock on __p.  But the
assignments may involve arbitrary destructor invocations, which may perform
atomic assignments hashing to the same location. Thus it could try to reacquire
the same lock, deadlocking with itself. Or it could participate in more
complicated deadlocks involving multiple threads.

Presumably the assignments need to be replaced by swaps to a local, which can
then be destroyed outside the critical section.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20160512/1d8b7dfa/attachment.html>