(ITS#6783) back-monitor cache/mutex problem

[h.b.furuseth@usit.uio.no]

Full_Name: Hallvard B Furuseth
Version: HEAD
OS: Linux x86_64
URL: 
Submission from: (NULL) (193.157.198.89)
Submitted by: hallvard


Core dump in back-monitor with LDAP_THREAD_DEBUG when I hit ^C:

	ASSERT_OWNER( mutex, "ldap_pvt_thread_mutex_unlock" );

#2 ldap_pvt_thread_mutex_unlock (mutex=0x1a526c0) at thr_debug.c:1031
#3 monitor_cache_release (mi=0x92c8c0, e=0x19ec7f8) at cache.c:389
#4 monitor_send_children (op=0x236bcb0, rs=0x7f54ce4eea40,
                          e_parent=0x19ec758, sub=1) at search.c:97
#5 monitor_back_search (op=0x236bcb0, rs=0x7f54ce4eea40) at search.c:245
#6 fe_op_search (op=0x236bcb0, rs=0x7f54ce4eea40) at search.c:372

That's the o_abandon branch in monitor_send_children().

I copied the loop out of the o_abandon branch.  test036 crashed with
what I assume is the same problem.  No need to hit ^C at the right time:

Index: back-monitor/search.c
@@ -89,2 +89,9 @@ monitor_send_children(
 
+		if ( nonvolatile == 0 && (e_tmp = e) != NULL ) {
+			do {
+				mp = e_tmp->e_private;
+				LDAP_PVT_THREAD_ASSERT_MUTEX_OWNER( &mp->mp_mutex );
+			} while ( (e_tmp = mp->mp_next) && e_tmp != e_nonvolatile );
+		}
+
 		if ( op->o_abandon ) {

There is a similar loop further down, I didn't look at that one.

Variables at the crash:

e     == e_nonvolatile
e_tmp == ((monitor_entry_t *) e->e_private)->mp_next

*(monitor_entry_t *) e->e_private == {
    mp_mutex = {...}, mp_next = 0x261b2a8, mp_children = 0x261b668,
    mp_info = 0x8f21c0, mp_flags = 32, mp_cb = 0x0
}

*(monitor_entry_t *) e_tmp->e_private == {
    mp_mutex = {...}, mp_next = 0x261b2f8, mp_children = 0x261ba28,
    mp_info = 0x8f2258, mp_flags = 128, mp_cb = 0x0
}