On 12/29/2011 06:29 PM, Bogdan Harjoc wrote:
Git commit 8d3bc51 crashes on win32 on startup because
qemu_tcg_init_vcpu calls:

qemu_thread_create(th, qemu_tcg_cpu_thread_fn, ...
...
qemu_thread_get_handle(th)

which locks th->data->cs, a CRITICAL_SECTION which is initialized only
in the thread_fn, so it finds garbage.

Attached patch initializes it before calling _beginthreadex. GDB/windbg
probably start newly created threads sooner, because this doesn't happen
under a debugger.

With the patch below it boots until it crashes somewhere while attaching
disks (-hda raw_img).

"bt" in gdb only returns "#0  0x00000000 in ??" and generate-core-file
didn't work.

Cheers,

diff -du qemu-8d3bc51\qemu-thread-win32.c
qemu-8d3bc51-new\qemu-thread-win32.c
--- qemu-8d3bc51\qemu-thread-win32.c    Tue Dec 27 17:28:58 2011
+++ qemu-8d3bc51-new\qemu-thread-win32.c    Thu Dec 29 18:59:50 2011
@@ -215,8 +215,6 @@
      if (data->mode == QEMU_THREAD_DETACHED) {
          g_free(data);
          data = NULL;
-    } else {
-        InitializeCriticalSection(&data->cs);
      }
      TlsSetValue(qemu_thread_tls_index, data);
      qemu_thread_exit(start_routine(thread_arg));
@@ -287,6 +285,10 @@
      data->arg = arg;
      data->mode = mode;
      data->exited = false;
+
+    if (data->mode != QEMU_THREAD_DETACHED) {
+        InitializeCriticalSection(&data->cs);
+    }

      hThread = (HANDLE) _beginthreadex(NULL, 0, win32_start_routine,
                                        data, 0, &thread->tid);


Reviewed-by: Paolo Bonzini <pbonz...@redhat.com>

Reply via email to