From be142916e6cad815c011f833417884e719a9e1f8 Mon Sep 17 00:00:00 2001
From: Jeff Tao <jhtao@taosdata.com>
Date: Thu, 22 Oct 2020 09:57:44 +0000
Subject: [PATCH] TD-1772 pThreadObj is freed when thread exits

---
 src/dnode/src/dnodeVWrite.c | 1 +
 src/rpc/src/rpcTcp.c        | 9 +++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/dnode/src/dnodeVWrite.c b/src/dnode/src/dnodeVWrite.c
index e56bae0d7e..f2740bf6b8 100644
--- a/src/dnode/src/dnodeVWrite.c
+++ b/src/dnode/src/dnodeVWrite.c
@@ -190,6 +190,7 @@ void dnodeFreeVnodeWqueue(void *wqueue) {
 
 void dnodeSendRpcVnodeWriteRsp(void *pVnode, void *param, int32_t code) {
   SWriteMsg *pWrite = (SWriteMsg *)param;
+  if (pWrite == NULL) return;
 
   if (code < 0) pWrite->code = code;
   int32_t count = atomic_add_fetch_32(&pWrite->processedCount, 1);
diff --git a/src/rpc/src/rpcTcp.c b/src/rpc/src/rpcTcp.c
index 0b9bbae92e..1040877057 100644
--- a/src/rpc/src/rpcTcp.c
+++ b/src/rpc/src/rpcTcp.c
@@ -174,6 +174,10 @@ static void taosStopTcpThread(SThreadObj* pThreadObj) {
   pThreadObj->stop = true;
   eventfd_t fd = -1;
 
+  // save thread and pollFd into local variable since pThreadObj will be freed when thread exits
+  pthread_t thread = pThreadObj->thread; 
+  int       pollFd = pThreadObj->pollFd;
+
   if (taosComparePthread(pThreadObj->thread, pthread_self())) {
     pthread_detach(pthread_self());
     return;
@@ -196,8 +200,9 @@ static void taosStopTcpThread(SThreadObj* pThreadObj) {
     }
   }
 
-  if (taosCheckPthreadValid(pThreadObj->thread) && pThreadObj->pollFd >= 0) {
-     pthread_join(pThreadObj->thread, NULL);
+  // at this step, pThreadObj may have been released
+  if (taosCheckPthreadValid(thread) && pollFd >= 0) {
+     pthread_join(thread, NULL);
   }
 
   if (fd != -1) taosCloseSocket(fd);
-- 
GitLab