bugfix: posted event handler was called after event memory was freed. (#1982)

Author: zhuizhuhaomeng

src/ngx_http_lua_semaphore.c

@@ -466,8 +466,11 @@ ngx_http_lua_sema_handler(ngx_event_t *ev)
 
     sem = ev->data;
 
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
+                   "semaphore handler: wait queue: %sempty, resource count: %d",
+                   ngx_queue_empty(&sem->wait_queue) ? "" : "not ",
+                   sem->resource_count);
     while (!ngx_queue_empty(&sem->wait_queue) && sem->resource_count > 0) {
-
         q = ngx_queue_head(&sem->wait_queue);
         ngx_queue_remove(q);
 
@@ -566,6 +569,10 @@ ngx_http_lua_ffi_sema_gc(ngx_http_lua_sema_t *sem)
                       "destroyed", sem);
     }
 
+    if (sem->sem_event.posted) {
+        ngx_delete_posted_event(&sem->sem_event);
+    }
+
     ngx_http_lua_free_sema(sem);
 }
 

t/154-semaphore.t

@@ -118,3 +118,53 @@ hello, world
 --- no_shutdown_error_log
 semaphore gc wait queue is not empty
 --- SKIP
+
+
+
+=== TEST 3: exit before post_handler was called
+If gc is called before the ngx_http_lua_sema_handler and free the sema memory
+ngx_http_lua_sema_handler would use the freed memory.
+--- config
+    location /up {
+        content_by_lua_block {
+            local semaphore = require "ngx.semaphore"
+            local sem = semaphore.new()
+
+            local function sem_wait()
+                ngx.log(ngx.ERR, "ngx.sem wait start")
+                local ok, err = sem:wait(10)
+                if not ok then
+                    ngx.log(ngx.ERR, "ngx.sem wait err: ", err)
+                else
+                    ngx.log(ngx.ERR, "ngx.sem wait success")
+                end
+            end
+            local co = ngx.thread.spawn(sem_wait)
+            ngx.log(ngx.ERR, "ngx.sem post start")
+            sem:post()
+            ngx.log(ngx.ERR, "ngx.sem post end")
+            ngx.say("hello")
+            ngx.exit(200)
+            ngx.say("not reach here")
+        }
+    }
+
+    location /t {
+        content_by_lua_block {
+            local res = ngx.location.capture("/up")
+            collectgarbage()
+            ngx.print(res.body)
+        }
+    }
+
+--- request
+GET /t
+--- response_body
+hello
+--- grep_error_log eval: qr/(ngx.sem .*?,|http close request|semaphore handler: wait queue: empty, resource count: 1|in lua gc, semaphore)/
+--- grep_error_log_out
+ngx.sem wait start,
+ngx.sem post start,
+ngx.sem post end,
+in lua gc, semaphore
+http close request