From 6ef80d68f092caf3b3802a73b8d716057b41864c Mon Sep 17 00:00:00 2001
From: Jason Evans <jasone@canonware.com>
Date: Wed, 24 Sep 2014 22:14:21 -0700
Subject: [PATCH] Fix profile dumping race.

Fix a race that caused a non-critical assertion failure.  To trigger the
race, a thread had to be part way through initializing a new sample,
such that it was discoverable by the dumping thread, but not yet linked
into its gctx by the time a later dump phase would normally have reset
its state to 'nominal'.

Additionally, lock access to the state field during modification to
transition to the dumping state.  It's not apparent that this oversight
could have caused an actual problem due to outer locking that protects
the dumping machinery, but the added locking pedantically follows the
stated locking protocol for the state field.
---
 include/jemalloc/internal/prof.h |  1 +
 src/prof.c                       | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/jemalloc/internal/prof.h b/include/jemalloc/internal/prof.h
index b8a8b419..3872c7ae 100644
--- a/include/jemalloc/internal/prof.h
+++ b/include/jemalloc/internal/prof.h
@@ -79,6 +79,7 @@ struct prof_cnt_s {
 };
 
 typedef enum {
+	prof_tctx_state_initializing,
 	prof_tctx_state_nominal,
 	prof_tctx_state_dumping,
 	prof_tctx_state_purgatory /* Dumper must finish destroying. */
diff --git a/src/prof.c b/src/prof.c
index dd84f533..9f10b533 100644
--- a/src/prof.c
+++ b/src/prof.c
@@ -717,7 +717,7 @@ prof_lookup(tsd_t *tsd, prof_bt_t *bt)
 		memset(&ret.p->cnts, 0, sizeof(prof_cnt_t));
 		ret.p->gctx = gctx;
 		ret.p->prepared = true;
-		ret.p->state = prof_tctx_state_nominal;
+		ret.p->state = prof_tctx_state_initializing;
 		malloc_mutex_lock(tdata->lock);
 		error = ckh_insert(tsd, &tdata->bt2tctx, btkey, ret.v);
 		malloc_mutex_unlock(tdata->lock);
@@ -728,6 +728,7 @@ prof_lookup(tsd_t *tsd, prof_bt_t *bt)
 			return (NULL);
 		}
 		malloc_mutex_lock(gctx->lock);
+		ret.p->state = prof_tctx_state_nominal;
 		tctx_tree_insert(&gctx->tctxs, ret.p);
 		gctx->nlimbo--;
 		malloc_mutex_unlock(gctx->lock);
@@ -925,8 +926,15 @@ static void
 prof_tctx_merge_tdata(prof_tctx_t *tctx, prof_tdata_t *tdata)
 {
 
+	malloc_mutex_lock(tctx->gctx->lock);
+	if (tctx->state == prof_tctx_state_initializing) {
+		malloc_mutex_unlock(tctx->gctx->lock);
+		return;
+	}
 	assert(tctx->state == prof_tctx_state_nominal);
 	tctx->state = prof_tctx_state_dumping;
+	malloc_mutex_unlock(tctx->gctx->lock);
+
 	memcpy(&tctx->dump_cnts, &tctx->cnts, sizeof(prof_cnt_t));
 
 	tdata->cnt_summed.curobjs += tctx->dump_cnts.curobjs;