Fix crash when constructing QThreadStorage after global destructors have run

In this particular case, the destructors vector used by
QThreadStorageData has already been destroyed, yet a new QThreadStorage
is being allocated. This can only happen during global destruction, at
which point we assume that there is only one thread. In order to keep
QThreadStorage working, we need somewhere to store the data, and the
best place we have in this situation is at the tail of the current
thread's tls vector. The destructor is ignored, since we have no where
to store it, and no way to actually call it.

Task-number: QTBUG-10084
Reviewed-by: thiago
Reviewed-by: olivier

6 files changed, 104 insertions, 6 deletions

diff --git a/src/corelib/thread/qthreadstorage.cpp b/src/corelib/thread/qthreadstorage.cpp
index 88d73cc..2fc04f5 100644
--- a/src/corelib/thread/qthreadstorage.cpp
+++ b/src/corelib/thread/qthreadstorage.cpp
@@ -79,6 +79,21 @@ QThreadStorageData::QThreadStorageData(void (*func)(void *))
 {
     QMutexLocker locker(mutex());
     DestructorMap *destr = destructors();
+    if (!destr) {
+        /*
+         the destructors vector has already been destroyed, yet a new
+         QThreadStorage is being allocated. this can only happen during global
+         destruction, at which point we assume that there is only one thread.
+         in order to keep QThreadStorage working, we need somewhere to store
+         the data, best place we have in this situation is at the tail of the
+         current thread's tls vector. the destructor is ignored, since we have
+         no where to store it, and no way to actually call it.
+         */
+        QThreadData *data = QThreadData::current();
+        id = data->tls.count();
+        DEBUG_MSG("QThreadStorageData: Allocated id %d, destructor %p cannot be stored", id, func);
+        return;
+    }
     for (id = 0; id < destr->count(); id++) {
         if (destr->at(id) == 0)
             break;
@@ -139,13 +154,15 @@ void **QThreadStorageData::set(void *p)
                 data->thread);
 
         QMutexLocker locker(mutex());
-        void (*destructor)(void *) = destructors()->value(id);
+        DestructorMap *destr = destructors();
+        void (*destructor)(void *) = destr ? destr->value(id) : 0;
         locker.unlock();
 
         void *q = value;
         value = 0;
 
-        destructor(q);
+        if (destructor)
+            destructor(q);
     }
 
     // store new data
diff --git a/tests/auto/qthreadstorage/crashOnExit.cpp b/tests/auto/qthreadstorage/crashOnExit.cpp
new file mode 100644
index 0000000..96515a0
--- /dev/null
+++ b/tests/auto/qthreadstorage/crashOnExit.cpp
@@ -0,0 +1,64 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the test suite of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <QtCore/QtCore>
+
+class Class
+{
+public:
+    ~Class()
+    {
+        // trigger creation of a new QThreadStorage, after the previous QThreadStorage from main() was destructed
+        static QThreadStorage<int *> threadstorage;
+        threadstorage.setLocalData(new int);
+        threadstorage.setLocalData(new int);
+    }
+};
+
+int main()
+{
+    // instantiate the class that will use QThreadStorage from its destructor, it's destructor will be run last
+    static Class instance;
+    // instantiate QThreadStorage, it's destructor (and the global destructors for QThreadStorages internals) will run first
+    static QThreadStorage<int *> threadstorage;
+    threadstorage.setLocalData(new int);
+    threadstorage.setLocalData(new int);
+}
diff --git a/tests/auto/qthreadstorage/crashOnExit.pro b/tests/auto/qthreadstorage/crashOnExit.pro
new file mode 100644
index 0000000..918ef39
--- /dev/null
+++ b/tests/auto/qthreadstorage/crashOnExit.pro
@@ -0,0 +1,4 @@
+SOURCES += crashOnExit.cpp
+QT = core
+CONFIG-=app_bundle
+CONFIG+=console
diff --git a/tests/auto/qthreadstorage/qthreadstorage.pro b/tests/auto/qthreadstorage/qthreadstorage.pro
index 3071098..a06f89c 100644
--- a/tests/auto/qthreadstorage/qthreadstorage.pro
+++ b/tests/auto/qthreadstorage/qthreadstorage.pro
@@ -1,4 +1,4 @@
-load(qttest_p4)
-SOURCES += tst_qthreadstorage.cpp
-QT = core
-symbian:LIBS += -llibpthread
+TEMPLATE = subdirs
+SUBDIRS = \
+    tst_qthreadstorage.pro \
+    crashOnExit.pro
diff --git a/tests/auto/qthreadstorage/tst_qthreadstorage.cpp b/tests/auto/qthreadstorage/tst_qthreadstorage.cpp
index d8b404f..097d729 100644
--- a/tests/auto/qthreadstorage/tst_qthreadstorage.cpp
+++ b/tests/auto/qthreadstorage/tst_qthreadstorage.cpp
@@ -76,6 +76,7 @@ private slots:
     void autoDelete();
     void adoptedThreads();
     void ensureCleanupOrder();
+    void QTBUG13877_crashOnExit();
 };
 
 class Pointer
@@ -293,5 +294,13 @@ void tst_QThreadStorage::ensureCleanupOrder()
     QVERIFY(First::order < Second::order);
 }
 
+void tst_QThreadStorage::QTBUG13877_crashOnExit()
+{
+    QProcess process;
+    process.start("./crashOnExit");
+    QVERIFY(process.waitForFinished());
+    QVERIFY(process.exitStatus() != QProcess::CrashExit);
+}
+
 QTEST_MAIN(tst_QThreadStorage)
 #include "tst_qthreadstorage.moc"
diff --git a/tests/auto/qthreadstorage/tst_qthreadstorage.pro b/tests/auto/qthreadstorage/tst_qthreadstorage.pro
new file mode 100644
index 0000000..3071098
--- /dev/null
+++ b/tests/auto/qthreadstorage/tst_qthreadstorage.pro
@@ -0,0 +1,4 @@
+load(qttest_p4)
+SOURCES += tst_qthreadstorage.cpp
+QT = core
+symbian:LIBS += -llibpthread