BewareMyPower
commented
9 months ago Use a single Boost application code to reproduce:
#include <stdio.h>
#include <boost/asio.hpp>
#include <future>
namespace asio = boost::asio;
using asio::io_context;
using asio::ip::tcp;
using boost::system::error_code;
constexpr int kPort = 11111;
static void server_task();
static void client_task();
int main() {
auto server = std::async(std::launch::async, &server_task);
auto client = std::async(std::launch::async, &client_task);
client.get();
server.get();
return 0;
}
static void server_task() {
io_context io;
auto loop = std::async(std::launch::async, [&io] {
io_context::work work{io};
error_code ec;
io.run(ec);
printf("event loop exits with %s\n", ec.message().c_str());
});
tcp::acceptor acceptor{io, tcp::endpoint{tcp::v4(), kPort}};
tcp::socket socket{io};
acceptor.accept(socket);
error_code ec;
size_t total_bytes = 0;
while (true) {
char buf[1024];
auto len = socket.read_some(asio::buffer(buf), ec);
if (ec) {
printf("read complete: %s\n", ec.message().c_str());
break;
}
buf[len] = '\0';
total_bytes += len;
}
printf("Received %zu bytes\n", total_bytes);
socket.close(ec);
acceptor.close(ec);
io.stop();
loop.get();
}
static void client_task() {
io_context io;
tcp::resolver resolver{io};
tcp::resolver::query query{"localhost", std::to_string(kPort)};
tcp::socket socket{io};
asio::connect(socket, resolver.resolve("localhost", std::to_string(kPort)));
std::vector<char> buffer(1048576, 'a');
std::atomic_bool done{false};
asio::write(socket, asio::const_buffer{buffer.data(), buffer.size()});
}Sometimes it crashed.
* thread #2, stop reason = EXC_BAD_ACCESS (code=1, address=0x88)
frame #0: 0x000000010001b134 tcp_e2e`boost::asio::detail::kqueue_reactor::deregister_descriptor(this=0x0000000000000000, descriptor=13, descriptor_data=0x000000016fe86db8, closing=false) at kqueue_reactor.ipp:350:16
347 EVFILT_READ, EV_DELETE, 0, 0, 0);
348 BOOST_ASIO_KQUEUE_EV_SET(&events[1], descriptor,
349 EVFILT_WRITE, EV_DELETE, 0, 0, 0);
-> 350 ::kevent(kqueue_fd_, events, descriptor_data->num_kevents_, 0, 0, 0);
351 }
352
353 op_queue<operation> ops;
Target 0: (tcp_e2e) stopped.
(lldb) p kqueue_fd_
error: Couldn't apply expression side effects : Couldn't dematerialize a result variable: couldn't read its memory
(lldb) p this
(boost::asio::detail::kqueue_reactor *) $1 = nullptr
(lldb) bt
* thread #2, stop reason = EXC_BAD_ACCESS (code=1, address=0x88)
frame #0: 0x000000010001b134 tcp_e2e`boost::asio::detail::kqueue_reactor::deregister_descriptor(this=0x0000000000000000, descriptor=13, descriptor_data=0x000000016fe86db8, closing=false) at kqueue_reactor.ipp:350:16
frame #1: 0x000000010001c624 tcp_e2e`boost::asio::detail::reactive_socket_service_base::close(this=0x0000600002100c28, impl=0x000000016fe86db0, ec=0x000000016fe86940) at reactive_socket_service_base.ipp:110:14
* frame #2: 0x00000001000065d0 tcp_e2e`boost::asio::basic_socket<boost::asio::ip::tcp, boost::asio::any_io_executor>::close(this=0x000000016fe86da8, ec=0x000000016fe86940) at basic_socket.hpp:547:25
frame #3: 0x0000000100004be4 tcp_e2e`server_task() at tcp_e2e.cc:51:10
frame #4: 0x0000000100024b2c tcp_e2e`decltype(__f=0x0000600003304090)()>()()) std::__1::__invoke[abi:v15006]<void (*)()>(void (*&&)()) at invoke.h:394:23
frame #5: 0x0000000100024b04 tcp_e2e`void std::__1::__async_func<void (*)()>::__execute<>(this=0x0000600003304090, (null)=__tuple_indices<> @ 0x000000016fe86eaf) at future:2169:16
frame #6: 0x0000000100024adc tcp_e2e`std::__1::__async_func<void (*)()>::operator(this=0x0000600003304090)() at future:2162:16
frame #7: 0x00000001000249e4 tcp_e2e`std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >::__execute(this=0x0000600003304000) at future:1008:9
frame #8: 0x000000010002527c tcp_e2e`decltype(__f=0x0000600000204108, __a0=0x0000600000204118)()> >*>().*std::declval<void (std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >::*)()>()()) std::__1::__invoke[abi:v15006]<void (std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >::*)(), std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >*, void>(void (std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >::*&&)(), std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >*&&) at invoke.h:359:23
frame #9: 0x00000001000251fc tcp_e2e`void std::__1::__thread_execute[abi:v15006]<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void (std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >::*)(), std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >*, 2ul>(__t=size=3, (null)=__tuple_indices<2UL> @ 0x000000016fe86f7f)()> >::*)(), std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >*>&, std::__1::__tuple_indices<2ul>) at thread:290:5
frame #10: 0x0000000100024ea8 tcp_e2e`void* std::__1::__thread_proxy[abi:v15006]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void (std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >::*)(), std::__1::__async_assoc_state<void, std::__1::__async_func<void (*)()> >*> >(__vp=0x0000600000204100) at thread:301:5
frame #11: 0x00000001a3983fa8 libsystem_pthread.dylib`_pthread_start + 148
I'm using Boost asio on macOS m1.
Here is the server side that reads the data synchronously and then breaks the loop if the remote side closes the connection.
I wrote the following Python script to test.
It sends many bytes, otherwise the issue won't be triggered.
There is a little chance (but it's easy to reproduce) that the server side might crash.
As you can see, the cause is that
reactor_points to a destroyed object indetail/impl/reactive_socket_service_base.ipp.If I removed the
socket.close()andacceptor.close(), there will be a more race case inreactive_socket_service_base::destroy.