channel: unbounded: minimal testcase for null pointer dereference

Signed-off-by: Petros Angelatos <petrosagg@gmail.com>

Author: petrosagg

crossbeam-channel/src/flavors/list.rs

@@ -236,6 +236,7 @@ impl<T> Channel<T> {
                     .compare_exchange(block, new, Ordering::Release, Ordering::Relaxed)
                     .is_ok()
                 {
+                    std::thread::sleep(std::time::Duration::from_secs(2));
                     self.head.block.store(new, Ordering::Release);
                     block = new;
                 } else {

crossbeam-channel/tests/list.rs

@@ -16,6 +16,28 @@ fn ms(ms: u64) -> Duration {
     Duration::from_millis(ms)
 }
 
+#[test]
+fn gh_971() {
+    let (s1, r) = unbounded::<u64>();
+    let s2 = s1.clone();
+
+    // This thread will sleep for 2000ms at the critical moment
+    let t1 = thread::spawn(move || assert!(s1.send(42).is_err()));
+
+    // Give some time for thread 1 to reach the critical state
+    thread::sleep(Duration::from_millis(100));
+    // Send another value which see the tail is not null and will just advance the tail offset to 1
+    // and write the value.
+    s2.send(42).unwrap();
+
+    // Now drop the receiver which will attempt to drop a message by reading it since head != tail
+    // but head is still a null pointer because the thread t1 is still preempted leading to a
+    // segfault.
+    drop(r);
+
+    t1.join().unwrap();
+}
+
 #[test]
 fn smoke() {
     let (s, r) = unbounded();