bugfix: nginx does not guarentee the parent pointer of the rbtree root is meaningful, which could lead to inifinite loops when ngx_lua tried to abort pending timers prematurely (upon worker exit). thanks pengqi for the patch in #362.

Author: agentzh

src/ngx_http_lua_timer.c

@@ -419,7 +419,7 @@ ngx_http_lua_abort_pending_timers(ngx_event_t *ev)
     ngx_int_t                    i, n;
     ngx_event_t                **events;
     ngx_connection_t            *c, *saved_c = NULL;
-    ngx_rbtree_node_t           *cur, *prev, *next, *sentinel;
+    ngx_rbtree_node_t           *cur, *prev, *next, *sentinel, *temp;
     ngx_http_lua_timer_ctx_t    *tctx;
     ngx_http_lua_main_conf_t    *lmcf;
 
@@ -463,7 +463,13 @@ ngx_http_lua_abort_pending_timers(ngx_event_t *ev)
     sentinel = ngx_event_timer_rbtree.sentinel;
 
     cur = ngx_event_timer_rbtree.root;
-    prev = cur->parent;
+
+    /* XXX nginx does not guarentee the parent of root is meaningful,
+     * so we temporarily override it to simplify tree traversal. */
+    temp = cur->parent;
+    cur->parent = NULL;
+
+    prev = NULL;
 
     events = ngx_pcalloc(ngx_cycle->pool,
                          lmcf->pending_timers * sizeof(ngx_event_t));
@@ -528,6 +534,9 @@ ngx_http_lua_abort_pending_timers(ngx_event_t *ev)
         cur = next;
     }
 
+    /* restore the old tree root's parent */
+    ngx_event_timer_rbtree.root->parent = temp;
+
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
                    "lua found %i pending timers to be aborted prematurely",
                    n);