RegexURLResolver.reverse() is not threadsafe
|Reported by:||tdterry||Owned by:||tdterry|
|Severity:||Keywords:||urlresolvers, reverse, threading|
|Has patch:||yes||Needs documentation:||no|
|Needs tests:||no||Patch needs improvement:||no|
I have found an incomplete-initialization bug in RegexURLResolver.reverse() when running under Apache mpm_worker with mod_wsgi.
RegexURLResolver objects are stored in process local memory using @memoize. The _reverse_dict is built on demand, so two threads trying to build it for the first time can run into an incomplete initialization. The attached patch changes RegexURLResolver._get_reverse_dict() to do an atomic set of self._reverse_dict, preventing multiple threads from seeing an inconsistent _reverse_dict.
Testing requires a multi-threaded setup and a good load test. These are not available in the framework, so I have not included a specific test with the patch.
Change History (8)
Changed 6 years ago by tdterry
comment:1 Changed 6 years ago by tdterry
- Needs documentation unset
- Needs tests unset
- Owner changed from nobody to tdterry
- Patch needs improvement unset
- Status changed from new to assigned
comment:2 Changed 6 years ago by mrts
- Component changed from Uncategorized to Core framework
- Keywords threading added; threadsafe removed
- Triage Stage changed from Unreviewed to Accepted
comment:5 Changed 6 years ago by mtredinnick
- Resolution set to fixed
- Status changed from assigned to closed