apache/trafficserver — pull request #147 by hopkings2008 (2014-11-14 06:26:46+00:00)
Title: TS-3196: Core dump when handle event check_inactivity

From the core dump, if we use ssl and spdy, so in the function
'ProtocolProbeTrampoline::ioCompletionEvent', it will first disable the read io
adn handover the continuation of read.vio._cont from 'ProtocolProbeTrampoline'
to 'SpdyClientSession' by below two steps:
1. first disable current io by using 'netvc->do_io_read(this, 0, NULL)'.
2. change the read.vio._cont by using
'probeParent->endpoint[key]>accept(netvc, this>iobuf, reader);' which will be
'SpdySessionAccept::accept' in our case. and in the end, it will call
'SpdyClientSession::state_session_start' which will call 'this->vc->do_io_read'
to set read.vio._cont to SpdyClientSession.
the main point is that the function 'SpdySessionAccept::accept' function will
put an SpdyClientSession event into eventProcessor for net
'eventProcessor.schedule_imm(sm, ET_NET);'
and because each 'net' thread will put a check_inactivity event into the queue
So, in the end, between 'netvc->do_io_read(this, 0, NULL)' and
spdy handler is set, the
check_inactivity may be executed, and if so, the crash will occur.