Bug 89855 - Data race in cppu_detail_getUnoType
Summary: Data race in cppu_detail_getUnoType
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: sdk (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: x86-64 (AMD64) Linux (All)
: medium major
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: Dev-related
  Show dependency treegraph
 
Reported: 2015-03-06 08:30 UTC by Marc-Oliver Straub
Modified: 2023-05-10 09:06 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marc-Oliver Straub 2015-03-06 08:30:49 UTC
Header files generated by cppumaker contain this code (example from XPropValue.hpp):

inline ::com::sun::star::uno::Type const & cppu_detail_getUnoType(SAL_UNUSED_PARAMETER ::ooo::vba::XPropValue const *) {
    static typelib_TypeDescriptionReference * the_type = 0;
    if ( !the_type )
    {
        typelib_static_type_init( &the_type, typelib_TypeClass_INTERFACE, "ooo.vba.XPropValue" );
    }
    return * reinterpret_cast< ::com::sun::star::uno::Type * >( &the_type );
}


Access to the the_type static variable is not threadsafe and can produce a data race.

Interestingly, cppu_detail_getUnoType is implemented differently in XAdapter.hpp (and possibly others):
nline ::com::sun::star::uno::Type const & cppu_detail_getUnoType(SAL_UNUSED_PARAMETER css::uno::XAdapter const *) {
    const ::com::sun::star::uno::Type &rRet = *detail::theXAdapterType::get();
    // End inline typedescription generation
    static bool bInitStarted = false;
    if (!bInitStarted)
    {
        ::osl::MutexGuard aGuard( ::osl::Mutex::getGlobalMutex() );
...

I'd suggest to either adapt cppumaker to generate similar code than in XAdapter.hpp, or use the (gcc only?) feature of threadsafe static variable init:
{
    static typelib_TypeDescriptionReference * the_type = typelib_static_type_init_( typelib_TypeClass_INTERFACE, "ooo.vba.XPropValue" );
    return * reinterpret_cast< ::com::sun::star::uno::Type * >( &the_type );
}

And of course adding a typelib_static_type_init method with a return value.
Comment 1 Stephan Bergmann 2015-03-13 13:52:10 UTC
The difference in cppu_detail_getUnoType implementations is due to css.uno.XAdapter being one of the "bootstrap" types for which type info is always emitted "comprehensively" (cf. isBootstrapType in codemaker/source/cppumaker/cpputype.cxx).

The code is racy and should eventually be fixed, but the race has always been considered harmless at least on average contemporary platforms (where reads and writes of pointer values are atomic and writes happen in order, so the worst that can happen is that multiple threads call into typelib_static_type_init in parallel, where they are then properly scheduled via a mutex, cf. cppu/source/typelib/static_types.cxx).

Did you observe any actual problems caused by the current code?
Comment 2 Marc-Oliver Straub 2015-03-13 14:21:14 UTC
No, but the race was reported by helgrind, and we try to become as helgrind-free as possible.
Comment 3 tommy27 2016-04-16 07:25:50 UTC Comment hidden (obsolete)
Comment 4 straub 2016-04-18 13:28:00 UTC
Inherited form OOo.
Bug still present in 5.1.2 header files.
Comment 5 QA Administrators 2017-05-22 13:27:47 UTC Comment hidden (obsolete)
Comment 6 QA Administrators 2019-12-03 14:33:47 UTC Comment hidden (obsolete)
Comment 7 straub 2019-12-03 14:38:31 UTC
Still present in master
Comment 8 QA Administrators 2021-12-03 04:35:49 UTC
Dear Marc-Oliver Straub,

To make sure we're focusing on the bugs that affect our users today, LibreOffice QA is asking bug reporters and confirmers to retest open, confirmed bugs which have not been touched for over a year.

There have been thousands of bug fixes and commits since anyone checked on this bug report. During that time, it's possible that the bug has been fixed, or the details of the problem have changed. We'd really appreciate your help in getting confirmation that the bug is still present.

If you have time, please do the following:

Test to see if the bug is still present with the latest version of LibreOffice from https://www.libreoffice.org/download/

If the bug is present, please leave a comment that includes the information from Help - About LibreOffice.
 
If the bug is NOT present, please set the bug's Status field to RESOLVED-WORKSFORME and leave a comment that includes the information from Help - About LibreOffice.

Please DO NOT

Update the version field
Reply via email (please reply directly on the bug tracker)
Set the bug's Status field to RESOLVED - FIXED (this status has a particular meaning that is not 
appropriate in this case)


If you want to do more to help you can test to see if your issue is a REGRESSION. To do so:
1. Download and install oldest version of LibreOffice (usually 3.3 unless your bug pertains to a feature added after 3.3) from https://downloadarchive.documentfoundation.org/libreoffice/old/

2. Test your bug
3. Leave a comment with your results.
4a. If the bug was present with 3.3 - set version to 'inherited from OOo';
4b. If the bug was not present in 3.3 - add 'regression' to keyword


Feel free to come ask questions or to say hello in our QA chat: https://web.libera.chat/?settings=#libreoffice-qa

Thank you for helping us make LibreOffice even better for everyone!

Warm Regards,
QA Team

MassPing-UntouchedBug