Crash on close again.

This one is caused by us deallocating the msg queue before we
stop all asynchronous I/O operations; consequently we can wind
up with a thread trying to access a msg queue after it has been
destroyed.

A lesson here is that nni_aio_fini() needs to be treated much like
nni_thr_fini() - you should do this *before* deallocating anything
that callback functions might be referencing.

4 files changed, 5 insertions, 5 deletions

diff --git a/src/protocol/bus/bus.c b/src/protocol/bus/bus.c
index 167c342d..17ef03bb 100644
--- a/src/protocol/bus/bus.c
+++ b/src/protocol/bus/bus.c
@@ -108,12 +108,12 @@ nni_bus_pipe_fini(void *arg)
 	nni_bus_pipe *ppipe = arg;
 
 	if (ppipe != NULL) {
-		nni_msgq_fini(ppipe->sendq);
 		nni_mtx_fini(&ppipe->mtx);
 		nni_aio_fini(&ppipe->aio_getq);
 		nni_aio_fini(&ppipe->aio_send);
 		nni_aio_fini(&ppipe->aio_recv);
 		nni_aio_fini(&ppipe->aio_putq);
+		nni_msgq_fini(ppipe->sendq);
 		NNI_FREE_STRUCT(ppipe);
 	}
 }
diff --git a/src/protocol/pubsub/pub.c b/src/protocol/pubsub/pub.c
index 508ab7ce..316cbf50 100644
--- a/src/protocol/pubsub/pub.c
+++ b/src/protocol/pubsub/pub.c
@@ -101,10 +101,10 @@ nni_pub_pipe_fini(void *arg)
 {
 	nni_pub_pipe *pp = arg;
 
-	nni_msgq_fini(pp->sendq);
 	nni_aio_fini(&pp->aio_getq);
 	nni_aio_fini(&pp->aio_send);
 	nni_aio_fini(&pp->aio_recv);
+	nni_msgq_fini(pp->sendq);
 	NNI_FREE_STRUCT(pp);
 }
 
diff --git a/src/protocol/reqrep/rep.c b/src/protocol/reqrep/rep.c
index 1e4ee4ef..013b02fb 100644
--- a/src/protocol/reqrep/rep.c
+++ b/src/protocol/reqrep/rep.c
@@ -160,11 +160,11 @@ nni_rep_pipe_fini(void *arg)
 {
 	nni_rep_pipe *rp = arg;
 
-	nni_msgq_fini(rp->sendq);
 	nni_aio_fini(&rp->aio_getq);
 	nni_aio_fini(&rp->aio_send);
 	nni_aio_fini(&rp->aio_recv);
 	nni_aio_fini(&rp->aio_putq);
+	nni_msgq_fini(rp->sendq);
 	NNI_FREE_STRUCT(rp);
 }
 
@@ -191,11 +191,11 @@ nni_rep_pipe_stop(void *arg)
 	nni_rep_pipe *rp  = arg;
 	nni_rep_sock *rep = rp->rep;
 
+	nni_msgq_close(rp->sendq);
 	nni_aio_cancel(&rp->aio_getq, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_putq, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_send, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_recv, NNG_ECANCELED);
-	nni_msgq_close(rp->sendq);
 
 	nni_idhash_remove(rep->pipes, nni_pipe_id(rp->pipe));
 }
diff --git a/src/protocol/survey/respond.c b/src/protocol/survey/respond.c
index 685f39fd..4a4c8741 100644
--- a/src/protocol/survey/respond.c
+++ b/src/protocol/survey/respond.c
@@ -160,11 +160,11 @@ nni_resp_pipe_fini(void *arg)
 {
 	nni_resp_pipe *ppipe = arg;
 
-	nni_msgq_fini(ppipe->sendq);
 	nni_aio_fini(&ppipe->aio_putq);
 	nni_aio_fini(&ppipe->aio_getq);
 	nni_aio_fini(&ppipe->aio_send);
 	nni_aio_fini(&ppipe->aio_recv);
+	nni_msgq_fini(ppipe->sendq);
 	NNI_FREE_STRUCT(ppipe);
 }