Crash on close again.

This one is caused by us deallocating the msg queue before we
stop all asynchronous I/O operations; consequently we can wind
up with a thread trying to access a msg queue after it has been
destroyed.

A lesson here is that nni_aio_fini() needs to be treated much like
nni_thr_fini() - you should do this *before* deallocating anything
that callback functions might be referencing.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/protocol/reqrep/rep.c b/src/protocol/reqrep/rep.c
index 1e4ee4ef..013b02fb 100644
--- a/src/protocol/reqrep/rep.c
+++ b/src/protocol/reqrep/rep.c
@@ -160,11 +160,11 @@ nni_rep_pipe_fini(void *arg)
 {
 	nni_rep_pipe *rp = arg;
 
-	nni_msgq_fini(rp->sendq);
 	nni_aio_fini(&rp->aio_getq);
 	nni_aio_fini(&rp->aio_send);
 	nni_aio_fini(&rp->aio_recv);
 	nni_aio_fini(&rp->aio_putq);
+	nni_msgq_fini(rp->sendq);
 	NNI_FREE_STRUCT(rp);
 }
 
@@ -191,11 +191,11 @@ nni_rep_pipe_stop(void *arg)
 	nni_rep_pipe *rp  = arg;
 	nni_rep_sock *rep = rp->rep;
 
+	nni_msgq_close(rp->sendq);
 	nni_aio_cancel(&rp->aio_getq, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_putq, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_send, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_recv, NNG_ECANCELED);
-	nni_msgq_close(rp->sendq);
 
 	nni_idhash_remove(rep->pipes, nni_pipe_id(rp->pipe));
 }