[boost] [thread|shared_ptr|atomic] segmentation fault in exception_ptr assignment

Subject: [boost] [thread|shared_ptr|atomic] segmentation fault in exception_ptr assignment
From: Oliver Kowalke (oliver.kowalke_at_[hidden])
Date: 2013-02-24 11:17:07

I've replaced shared_ptr<> by intrusive_ptr<> + atomic< std::size_t > in
boost.thread's future implementation.

atomic< std::size_t > use_count; // initialized with '0' in ctor

friend inline void intrusive_ptr_add_ref( future_continuation_base * p)
BOOST_NOEXCEPT
{
         ++p->use_count; // should be seq_cst
}

friend inline void intrusive_ptr_release( future_continuation_base *
p)
{
        if ( 0 == --p->use_count) // should be seq_cst

            delete p;
}

I get an error if I compile the code with gcc-4.7.2 on x86_64:
segmentation fault

backtrace:
0x0000000000426a96 in boost::detail::atomic_exchange_and_add (pw=0x436a40,
dv=-1) at ../../../boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:50
50        );
(gdb) bt
#0  0x0000000000426a96 in boost::detail::atomic_exchange_and_add
(pw=0x436a40, dv=-1) at
../../../boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:50
#1  0x0000000000426ba7 in boost::detail::sp_counted_base::release
(this=0x436a38) at
../../../boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:143
#2  0x0000000000426c57 in boost::detail::shared_count::~shared_count
(this=0x7fffffffc868, __in_chrg=<optimized out>) at
../../../boost/smart_ptr/detail/shared_count.hpp:368
#3  0x0000000000427c3e in
boost::shared_ptr<boost::exception_detail::clone_base const>::~shared_ptr
(this=0x7fffffffc860, __in_chrg=<optimized out>) at
../../../boost/smart_ptr/shared_ptr.hpp:316
#4  0x000000000042b2cd in
boost::shared_ptr<boost::exception_detail::clone_base const>::operator=
(this=0x75df00, r=...) at ../../../boost/smart_ptr/shared_ptr.hpp:485
#5  0x0000000000427d6f in boost::exception_ptr::operator= (this=0x75df00,
other=...) at ../../../boost/exception/detail/exception_ptr.hpp:73
#6  0x0000000000429a2f in
boost::fibers::detail::future_object_base::mark_exceptional_finish_internal
(this=0x75def0, e=..., lock=...) at ../../../boost/fiber/future.hpp:278
#7  0x000000000043749a in
boost::fibers::detail::task_base<int>::owner_destroyed (this=0x75def0) at
../../../boost/fiber/future.hpp:1241
#8  0x000000000042e768 in boost::fibers::packaged_task<int>::~packaged_task
(this=0x7fffffffc9b0, __in_chrg=<optimized out>) at
../../../boost/fiber/future.hpp:1341

called funtions: ~packaged_task() -> task_base::owner_destroyed() ->
future_object_base::mark_exceptional_finish_internal() ->
exception_ptr::operator=(excepton_ptr const&) -> shared_ptr -> shared_count
-> sp_counted_base_gcc_x86 -> boost::detail::atomic_exchange_and_add()

I'm wondering why a simple assignement of excpetion_ptr causes a
segmentation fault if future's implementation uses intrusive_ptr + atomic +
sequential - consistent ops instead of shared_ptr.

Does someone have an explanation?