Branko Čibej <br...@apache.org> writes: >> ... I think I may have identified the problem. The patch below checks >> that the error struct is allocated and released by the same thread. >> With the worker MPM the assertion always passes but with the event MPM I >> get assertion failures. I don't fully understand the effect this would >> have but I suspect it explains the problem. > > I think this pretty much explains what you're seeing.
Yes. Thread A allocates the memory, stores the address in the thread-specific data, sets the refcount to one and sets up the pool cleanup handler. Thread A finishes with the request. Thread B runs the pool cleanup handler, sets the refcount to zero, frees the memory and sets the *wrong* thread-specific data to NULL. Thread A then gets the free'd address from the thread-specific data and continues to use it--all sorts of horrible things follow. I've raised issue 4157 to track this problem. -- uberSVN: Apache Subversion Made Easy http://www.uberSVN.com
