pthread_create 内存泄漏

近日，听说pthread_create会造成内存泄漏，觉得不可思议，因此对posix(nptl)的线程创建和销毁进行了分析。

分析结果： 如果使用不当，确实会造成内存泄漏。

产生根源 ：pthread_create默认创建的线程是非detached的。

预防方式： 要么创建detached的线程，要么线程线程的start_routine结束之前detached，要么join

分析过程如下：

  1.查看pthread_create源代码，核心代码如下（nptl/pthread_create.c）：

点击(此处)折叠或打开

1. int
   
2. __pthread_create_2_1 (newthread, attr, start_routine, arg)
   
3.      pthread_t *newthread;
   
4.      const pthread_attr_t *attr;
   
5.      void *(*start_routine) (void *); 
   
6.      void *arg;
   
7. {
   
8.   STACK_VARIABLES;
   
9. 
   
10.   const struct pthread_attr *iattr = (struct pthread_attr *) attr;
    
11.   if (iattr == NULL)
    
12.     /* Is this the best idea? On NUMA machines this could mean
    
13.        accessing far-away memory. */
    
14.     iattr = &default_attr;
    
15. 
    
16.   struct pthread *pd = NULL;
    
17.   int err = ALLOCATE_STACK (iattr, &pd);//为tcb分配内存
    
18.   if (__builtin_expect (err != 0, 0)) 
    
19.     /* Something went wrong. Maybe a parameter of the attributes is
    
20.        invalid or we could not allocate memory. */
    
21.     return err;
22. //……
23. err = create_thread (pd, iattr, STACK_VARIABLES_ARGS);//正式创建线程
24. 
    

2.查看createthread.c(nptl/sysdeps/pthread/createthread.c)

点击(此处)折叠或打开

1. static int 
   
2. create_thread (struct pthread *pd, const struct pthread_attr *attr,
   
3.            STACK_VARIABLES_PARMS)
   
4. {
   
5. #ifdef TLS_TCB_AT_TP
   
6.   assert (pd->header.tcb != NULL);
   
7. #endif
8. //……
9. 
   
10. 
    
11. int res = do_clone (pd, attr, clone_flags, start_thread,
12.                   STACK_VARIABLES_ARGS, 1);//clone一个进程
13. 
    

3.接着看start_thread（nptl/pthread_create.c）做了什么

点击(此处)折叠或打开

1. static int
   
2. start_thread (void *arg)
   
3. {
   
4.   struct pthread *pd = (struct pthread *) arg;
   
5. //……
   
6. 
   
7.       /* Run the code the user provided. */
   
8. #ifdef CALL_THREAD_FCT
   
9.       THREAD_SETMEM (pd, result, CALL_THREAD_FCT (pd)); 
   
10. #else
    
11.       THREAD_SETMEM (pd, result, pd->start_routine (pd->arg)); //正式启动线程的执行，并等待执行完成
    
12. #endif
13. //……
14. 
    
15. if (IS_DETACHED (pd))
16.     /* Free the TCB.  */
17.     __free_tcb (pd);//如果设置detached标志，则释放tcb占用的内容，否则直接返回
18.   else if (__builtin_expect (pd->cancelhandling & SETXID_BITMASK, 0))
19.     {
20.       /* Some other thread might call any of the setXid functions and expect
21.      us to reply.  In this case wait until we did that.  */
22.       do
23.     lll_futex_wait (&pd->setxid_futex, 0, LLL_PRIVATE);
24.       while (pd->cancelhandling & SETXID_BITMASK);
25. 
    
26.       /* Reset the value so that the stack can be reused.  */
27.       pd->setxid_futex = 0;
28.     }
29. 
    

从上面的过程，我们可以看到，如果在创建线程的时候，如果没有设置detached标志，则tcb内存永远不会释放

接下来，我们看看pthread_detach(npth/pthread_detach.c)做了什么

点击(此处)折叠或打开

1. int
   
2. pthread_detach (th)
   
3.      pthread_t th; 
   
4. {
   
5.   struct pthread *pd = (struct pthread *) th; 
   
6. 
   
7.   /* Make sure the descriptor is valid. */
   
8.   if (INVALID_NOT_TERMINATED_TD_P (pd))
   
9.     /* Not a valid thread handle. */
   
10.     return ESRCH;
    
11. 
    
12.   int result = 0;
    
13. 
    
14.   /* Mark the thread as detached. */
    
15.   if (atomic_compare_and_exchange_bool_acq (&pd->joinid, pd, NULL))
    
16.     { 
    
17.       /* There are two possibilities here. First, the thread might
    
18.      already be detached. In this case we return EINVAL.
    
19.      Otherwise there might already be a waiter. The standard does
    
20.      not mention what happens in this case. */
    
21.       if (IS_DETACHED (pd))
    
22.     result = EINVAL;
    
23.     } 
    
24.   else
    
25.     /* Check whether the thread terminated meanwhile. In this case we
    
26.        will just free the TCB. */
    
27.     if ((pd->cancelhandling & EXITING_BITMASK) != 0)
    
28.       /* Note that the code in __free_tcb makes sure each thread
    
29.      control block is freed only once. */
    
30.       __free_tcb (pd);//经过一系列的容错判断，直接释放tcb占用的内存
    
31. 
    
32.   return result;
    
33. }

最后，我们看一下pthread_join(nptl/pthread_join.c)做了什么

点击(此处)折叠或打开

1. int
   
2. pthread_join (threadid, thread_return)
   
3.      pthread_t threadid;
   
4.      void **thread_return;
   
5. {
   
6.   struct pthread *pd = (struct pthread *) threadid;
   
7. 
   
8.   /* Make sure the descriptor is valid. */
   
9.   if (INVALID_NOT_TERMINATED_TD_P (pd))
   
10.     /* Not a valid thread handle. */
    
11.     return ESRCH;
    
12. 
    
13.   /* Is the thread joinable?. */
    
14.   if (IS_DETACHED (pd))
    
15.     /* We cannot wait for the thread. */
    
16.     return EINVAL;
    
17. 
    
18.   struct pthread *self = THREAD_SELF;
    
19.   int result = 0;
    
20. 
    
21.   /* During the wait we change to asynchronous cancellation. If we
    
22.      are canceled the thread we are waiting for must be marked as
    
23.      un-wait-ed for again. */
    
24.   pthread_cleanup_push (cleanup, &pd->joinid);
    
25. 
    
26.   /* Switch to asynchronous cancellation. */
    
27.   int oldtype = CANCEL_ASYNC ();
    
28. 
    
29.   if ((pd == self
    
30.        || (self->joinid == pd
    
31.      && (pd->cancelhandling
    
32.      & (CANCELING_BITMASK | CANCELED_BITMASK | EXITING_BITMASK
    
33.          | TERMINATED_BITMASK)) == 0))
    
34.       && !CANCEL_ENABLED_AND_CANCELED (self->cancelhandling))
    
35.     /* This is a deadlock situation. The threads are waiting for each
    
36.        other to finish. Note that this is a "may" error. To be 100%
    
37.        sure we catch this error we would have to lock the data
    
38.        structures but it is not necessary. In the unlikely case that
    
39.        two threads are really caught in this situation they will
    
40.        deadlock. It is the programmer's problem to figure this
    
41.        out. */
    
42.     result = EDEADLK;
    
43.   /* Wait for the thread to finish. If it is already locked something
    
44.      is wrong. There can only be one waiter. */
    
45.   else if (__builtin_expect (atomic_compare_and_exchange_bool_acq (&pd->joinid,
    
46.                                  self,
    
47.                                  NULL), 0))
    
48.     /* There is already somebody waiting for the thread. */
    
49.     result = EINVAL;
    
50.   else
    
51.     /* Wait for the child. */
    
52.     lll_wait_tid (pd->tid);
    
53. 
    
54. 
    
55.   /* Restore cancellation mode. */
    
56.   CANCEL_RESET (oldtype);
    
57. 
    
58.   /* Remove the handler. */
    
59.   pthread_cleanup_pop (0);
    
60. 
    
61. 
    
62.   if (__builtin_expect (result == 0, 1))
    
63.     {
    
64.       /* We mark the thread as terminated and as joined. */
    
65.       pd->tid = -1;
    
66. 
    
67.       /* Store the return value if the caller is interested. */
    
68.       if (thread_return != NULL)
    
69.     *thread_return = pd->result;//设置返回值
    
70. 
    
71. 
    
72.       /* Free the TCB. */
    
73.       __free_tcb (pd);/释放TCB占用内存
    
74.     }
    
75. 
    
76.   return result;
    
77. }

综上，如果要保证创建线程之后，确保无内存泄漏，必须采用如下方法来规范pthread_create的使用：

方法一、创建detached的线程

点击(此处)折叠或打开

1. void run() { 
   
2.     return;
   
3. } 
   
4.                                                                                                        
   
5. int main(){ 
   
6.     pthread_t thread; 
   
7.     pthread_attr_t attr; 
   
8.     pthread_attr_init( &attr ); 
   
9.     pthread_attr_setdetachstate(&attr,1); 
   
10.     pthread_create(&thread, &attr, run, 0); 
    
11.           
    
12.     //...... 
13.     return 0; 
    
14. }

补充：

void* start_run(void* arg)
{
    //dosomework
}
 
int main()
{
    pthread_tthread_id;
    pthread_attr_tattr;
    pthread_attr_init(&attr);
    pthread_attr_setdetachstate(&attr,PTHREAD_CREATE_DETACHED);
    pthread_create(&thread_id,&attr,start_run,NULL);
    pthread_attr_destroy(&attr);
    sleep(5);
     
    exit(0);
}

方法二、要么线程线程的start_routine结束之前detached

点击(此处)折叠或打开

1. void run() { 
   
2.     pthread_detach(pthread_self()); 
   
3. } 
   
4.                                                                                                        
   
5. int main(){ 
   
6.     pthread_t thread;  
7.     pthread_create(&thread, NULL, run, 0); 
   
8.               
   
9.     //...... 
10.     return 0; 
    
11. }

方法三、主线程使用pthread_join

点击(此处)折叠或打开

1. void run() { 
   
2.     return;
   
3. } 
   
4.                                                                                                        
   
5. int main(){ 
   
6.     pthread_t thread; 
7.     pthread_create(&thread, NULL, run, 0);  
8.                                        
9.     //...... 
10.     pthread_join(thread,NULL);
11.     return 0; 
    
12. }
13. 
    

原文地址：http://blog.chinaunix.net/uid-7931217-id-3408366.html