BUG-2: Blackboard::set() existing-entry path takes a raw reference to the Entry, then unlocks storage_mutex_. If another thread calls unset() on the same key in that window, the shared_ptr in the map is erased and the Entry may be destroyed, leaving a dangling reference. This test hammers concurrent set() + unset() on the same key. Under TSan it will report a data race / use-after-free before the
| 25 | // This test hammers concurrent set() + unset() on the same key. |
| 26 | // Under TSan it will report a data race / use-after-free before the fix. |
| 27 | TEST(BlackboardThreadSafety, SetAndUnsetRace_Bug2) |
| 28 | { |
| 29 | auto bb = Blackboard::create(); |
| 30 | |
| 31 | // Pre-create the entry so set() takes the existing-entry branch |
| 32 | bb->set("key", 0); |
| 33 | |
| 34 | std::atomic<bool> stop{ false }; |
| 35 | constexpr int kIterations = 5000; |
| 36 | |
| 37 | auto setter = [&]() { |
| 38 | for(int i = 0; i < kIterations && !stop; i++) |
| 39 | { |
| 40 | // This creates the entry if it was unset, or updates it |
| 41 | bb->set("key", i); |
| 42 | } |
| 43 | }; |
| 44 | |
| 45 | auto unsetter = [&]() { |
| 46 | for(int i = 0; i < kIterations && !stop; i++) |
| 47 | { |
| 48 | bb->unset("key"); |
| 49 | } |
| 50 | }; |
| 51 | |
| 52 | std::thread t1(setter); |
| 53 | std::thread t2(unsetter); |
| 54 | |
| 55 | t1.join(); |
| 56 | t2.join(); |
| 57 | |
| 58 | // If we get here without crashing/TSan error, the test passes |
| 59 | SUCCEED(); |
| 60 | } |
| 61 | |
| 62 | // BUG-1 + BUG-8: Blackboard::set() new-entry path. |
| 63 | // After createEntryImpl() inserts the entry into storage_, the code writes |
nothing calls this directly
no test coverage detected