title: VC++ 2010: Weird Critical Section error
body: <p>My program is randomly crashing in a small scenario I can reproduce, but it happens in mlock.c (which is a VC++ runtime file) from ntdll.dll, and I can't see the stack trace. I do know that it happens in one of my thread functions, though.</p>
  
  <p>This is the mlock.c code where the program crashes:</p>
  
  <pre><code>void __cdecl _unlock (
          int locknum
          )
  {
          /*
           * leave the critical section.
           */
          LeaveCriticalSection( _locktable[locknum].lock );
  }
  </code></pre>
  
  <p>The error is "invalid handle specified". If I look at locknum, it's a number larger than _locktable's size, so this makes some sense.</p>
  
  <p>This seems to be related to Critical Section usage. I do use CRITICAL_SECTIONS in my thread, via a CCriticalSection wrapper class and its associated RAII guard, CGuard. Definitions for both <a href="http://ideone.com/LX7R3" rel="nofollow">here</a> to avoid even more clutter.</p>
  
  <p>This is the thread function that's crashing:</p>
  
  <pre><code>unsigned int __stdcall CPlayBack::timerThread( void * pParams ) {
  #ifdef _DEBUG
      DRA::CommonCpp::SetThreadName( -1, "CPlayBack::timerThread" );
  #endif
      CPlayBack * pThis = static_cast&lt;CPlayBack*&gt;( pParams );
      bool bContinue = true;
      while( bContinue ) {
          float m_fActualFrameRate = pThis-&gt;m_fFrameRate * pThis-&gt;m_fFrameRateMultiplier;
          if( m_fActualFrameRate != 0 &amp;&amp; pThis-&gt;m_bIsPlaying ) {
              bContinue = ( ::WaitForSingleObject( pThis-&gt;m_hEndThreadEvent, static_cast&lt;DWORD&gt;( 1000.0f / m_fActualFrameRate ) ) == WAIT_TIMEOUT );
              CImage img;
              if( pThis-&gt;m_bIsPlaying &amp;&amp; pThis-&gt;nextFrame( img ) )
                  pThis-&gt;sendImage( img );
          }
          else
              bContinue = ( ::WaitForSingleObject( pThis-&gt;m_hEndThreadEvent, 10 ) == WAIT_TIMEOUT );
      }
      ::GetErrorLoggerInstance()-&gt;Log( LOG_TYPE_NOTE, "CPlayBack", "timerThread", "Exiting thread" );
      return 0;
  }
  </code></pre>
  
  <p>Where does <code>CCriticalSection</code> come in? Every <code>CImage</code> object contains a <code>CCriticalSection</code> object which it uses through a <code>CGuard</code> RAII lock. Moreover, every <code>CImage</code> contains a <code>CSharedMemory</code> object which implements reference counting. To that end, it contains two <code>CCriticalSection</code>'s as well, one for the data and one for the reference counter. A good example of these interactions is best seen in the destructors:</p>
  
  <pre><code>CImage::~CImage() {
      CGuard guard(m_csData);
      if( m_pSharedMemory != NULL ) {
          m_pSharedMemory-&gt;decrementUse();
          if( !m_pSharedMemory-&gt;isBeingUsed() ){
              delete m_pSharedMemory;
              m_pSharedMemory = NULL;
          }
      }
      m_cProperties.ClearMin();
      m_cProperties.ClearMax();
      m_cProperties.ClearMode();
  }
  
  CSharedMemory::~CSharedMemory() {
      CGuard guardUse( m_cs );
      if( m_pData &amp;&amp; m_bCanDelete ){
          delete []m_pData;
      }
      m_use = 0;
      m_pData = NULL;
  }
  </code></pre>
  
  <p>Anyone bumped into this kind of error? Any suggestion?</p>
  
  <p><strong>Edit</strong>: I got to see some call stack: the call comes from ~CSharedMemory. So there must be some race condition there</p>
  
  <p><strong>Edit</strong>: More CSharedMemory code <a href="http://ideone.com/6aCTe" rel="nofollow">here</a></p>