title: Boost threads: in IOS, thread_info object is being destructed before the thread finishes executing
body: <p>Our project uses a few boost 1.48 libraries on several platforms, including Windows, Mac, Android, and IOS.
  We are able to consistently get the IOS version of the project to crash (nontrivially but reliably) when using IOS, and
  from our investigation we see that ~thread_data_base is being called on the thread's thread_info while its thread is still running.</p>
  
  <p>This seems to happen as a result of the smart pointer reaching a zero count, even though it is obviously still
  in scope in the thread_proxy function which creates it and runs the requested function in the thread.
  This seems to happen in various cases - the call stack is not identical between crashes, though there are a few
  variations which are common.</p>
  
  <p>Just to be clear - this often requires running code which is creating hundreds of threads, though there are 
  never more than about 30 running simultaneously. I have "been lucky" and got it very very early in the
  run also, but that's rare.
  I created a version of the destructor which actually catches the code red-handed:</p>
  
  <p>in libs/thread/src/pthread/thread.cpp:</p>
  
  <pre><code>thread_data_base::~thread_data_base()
   {
     boost::detail::thread_data_base* const thread_info=detail::get_current_thread_data();
     void *void_thread_info = (void *) thread_info;
     void *void_this = (void *) this;
     // is somebody destructing the thread_data other than its own thread?
     // (remember that its own which should no longer point to it anyway,
     // because of the call to detail::set_current_thread_data(0) in thread_proxy)
     if (void_thread_info) { //  == void_this) {
       __builtin_trap();
     }
   }
  </code></pre>
  
  <p>I should note that (as seen from the commented-out code)  I had previously checked to see that void_thread_info == void_this because I
  was only checking for the case where the thread's current thread_info was killing itself.
  I have also seen cases where the value returned by get_current_thread_data is non-zero and
  different from "this", which is really weird.</p>
  
  <p>Also when I first wrote that version of the code, I wrote:</p>
  
  <pre><code>if (((void*)thread_info) == ((void*)this)) 
  </code></pre>
  
  <p>and at run-time I got some very weird exception that said I something about a virtual function table
  or something like that - I don't remember. I decided that it was trying to call "==" for this object type
  and was unhappy with that, so I rewrote as above, putting the conversions to void * as separate
  lines of code. That in itself is quite suspicious to me. I am not one to run to rush to blame compilers, but...</p>
  
  <p>I should also note that when we did catch this happening the trap, we saw the destructor for
  ~shared_count appear twice consecutively on the stack in Xcode source. Very doubleweird.
  We tried to look at the disassembly, but couldn't make much out of it.</p>
  
  <p>Again - it looks like this is always a result of the shared_count which seems to be owned by
  the shared_ptr which owns the thread_info reaching zero too early.</p>
  
  <p>Update: it seems that it is possible to get into situations which reach the above trap without the situation doing any harm. Since fixing the issue (see answer) I have seen it happen, but always after thread_info->run() has finished executing. Don't yet understand how...but it's working.</p>
  
  <p>Some additional info:</p>
  
  <p>I should note that the boost.sh from Pete Goodliffe (and modified by others) that is commonly used to compile boost for IOS
  has the following note in the header:  </p>
  
  <pre><code>: ${EXTRA_CPPFLAGS:="-DBOOST_AC_USE_PTHREADS -DBOOST_SP_USE_PTHREADS"}
  # The EXTRA_CPPFLAGS definition works around a thread race issue in
  # shared_ptr. I encountered this historically and have not verified that
  # the fix is no longer required. Without using the posix thread primitives
  # an invalid compare-and-swap ARM instruction (non-thread-safe) was used for the
  # shared_ptr use count causing nasty and subtle bugs.
  #
  # Should perhaps also consider/use instead: -BOOST_SP_USE_PTHREADS
  </code></pre>
  
  <p>I use those flags, but to no avail.</p>
  
  <p>I found the following which is very tantalizing - it looks like they had the same issue in <code>std::thread:</code>  </p>
  
  <p><a href="http://llvm.org/bugs/show_bug.cgi?format=multiple&amp;id=12730" rel="nofollow">http://llvm.org/bugs/show_bug.cgi?format=multiple&amp;id=12730</a></p>
  
  <p>That was suggestive of using an alternate implementation inside boost for arm processors which seems also to directly address this issue:
  <code>spinlock_gcc_arm.hpp</code></p>
  
  <p>The version included with boost 1.48 uses outdated arm assembly.
  I took the updated version from boost 1.52, but I'm having trouble compiling it.
  I get the following error:
  predicated instructions must be in IT block</p>
  
  <p>I found a reference to what looks to be a similar use of this instruction here:
  <a href="https://zeromq.jira.com/browse/LIBZMQ-414" rel="nofollow">https://zeromq.jira.com/browse/LIBZMQ-414</a></p>
  
  <p>I was able to use the same idea to get the 1.52 code to compile by modifying 
  the code as follows (I inserted an appropriate IT instruction)</p>
  
  <pre><code>__asm__ __volatile__(
   "ldrex %0, [%2]; \n"
   "cmp %0, %1; \n"
   "it ne; \n"
   "strexne %0, %1, [%2]; \n"
   BOOST_SP_ARM_BARRIER :
   "=&amp;r"( r ): // outputs
   "r"( 1 ), "r"( &amp;v_ ): // inputs
   "memory", "cc" );
  </code></pre>
  
  <p>But in any case, there are ifdefs in this file which look for the arm architecture, which is not defined that way in my environment. After I simply edited the file so that only ARM 7 code
  was left, the compiler complains about the definition of BOOST_SP_ARM_BARRIER:</p>
  
  <p>In file included from ./boost/smart_ptr/detail/spinlock.hpp:35:
  ./boost/smart_ptr/detail/spinlock_gcc_arm.hpp:39:13: error: instruction requires a CPU feature not currently enabled
              BOOST_SP_ARM_BARRIER :
              ^
   ./boost/smart_ptr/detail/spinlock_gcc_arm.hpp:13:32: note: expanded from macro  'BOOST_SP_ARM_BARRIER'</p>
  
  <pre><code># define BOOST_SP_ARM_BARRIER "dmb"
  </code></pre>
  
  <p>Any ideas??</p>