Wednesday, March 14, 2012, 10:57:17 AM, you wrote: > according to your example timeline, can we tell that there is a path > that httpSM dereference vc after it call vc->do_io_close?
For thread B, the mutex->acquire() dereferences the VC pointer to get the mutex object. If you want a fuller chain, look at the diagram and trace the path from the upper left. But to be clear, there is an A HttpSM which calls do_io_close, and another B HttpSM which does the crashing dereference of the VC. It does not happen in a single HttpSM. The dereference of a dangling VC pointer only occurs when the HttpServerSession VC pointers are owned by different threads.
