Skip to content

Fix Race Condition #4700

Open
Open
@HanetakaChou

Description

@HanetakaChou

when another thread resizes the table, it will perform the following two steps:

  • ANOTHER-1. allocate the new meomry block
  • ANOTHER-2. copy the existing data from the old memory block to the new meomry block

there can be such timeline:

  • ANOTHER-1. another thread has allocated the new meomry block
  • CURRENT. current thread is reading the uninitialized data from the new memory block
  • ANOTHER-2. another thread will copy the existing data from the old memory block to the new meomry block, but this will not affect the uninitialized data read by the current thread
		int uniqueId = body.getWorldArrayIndex();
		const int INVALID_SOLVER_BODY_ID = -1;
		m_kinematicBodyUniqueIdToSolverBodyTableMutex.lock();
		if (m_kinematicBodyUniqueIdToSolverBodyTable.size() <= uniqueId)
		{
			// ~~m_kinematicBodyUniqueIdToSolverBodyTableMutex.lock();~~
			// now that we have the lock, check again
			if (m_kinematicBodyUniqueIdToSolverBodyTable.size() <= uniqueId)
			{
				m_kinematicBodyUniqueIdToSolverBodyTable.resize(uniqueId + 1, INVALID_SOLVER_BODY_ID);
			}
			// ~~m_kinematicBodyUniqueIdToSolverBodyTableMutex.unlock();~~
		}
                // ** the following read may have **uninitialized** data without lock ** !!!
		solverBodyId = m_kinematicBodyUniqueIdToSolverBodyTable[uniqueId];
		m_kinematicBodyUniqueIdToSolverBodyTableMutex.unlock();

Pull Request

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions