Crash reason¶

The destructor of Http::Client calls abort which asynchronously aborts the http request.

If impl->hasServer() is false, a pointer to the Client's impl_ member is passed to asyncStop; see https://github.com/emweb/wt/blob/master/src/Wt/Http/Client.C#L850
This member will be destructed briefly after this call, as abort is called from inside the Http::Client destructor.
However, in the asynchronously executed stop function (https://github.com/emweb/wt/blob/master/src/Wt/Http/Client.C#L178), this (possibly) dangling pointer will be dereferenced.

Note that this code was added in commit 9c44b4e3c2 with commit message "Fixed possible race condition when resetting impl_ of HTTP Client". However it is unclear to me which in which scenario the mentioned race condition is avoided.

Steps to reproduce the issue¶

1. Start a new thread
2. Start a (long running) http request using Wt::Http::Client
3. Destruct the Wt::Http::Client object (before the http request is finished.