[lwip-users] do_writemore: invalid length! assertion

[Yoav Nissim]

Hello.
I have been using lwIP and its socket layer on a Windows platform for a
while now. Its been used by an HTTP client only (for now).
Recently I have encountered the aforementioned assert (and crash).
Investigating this further has directed me to the following sequence of
events:

1. A TCP socket is initialized and connects to a streaming server
2. Thread A reads data from the socket.
3. Thread B sends data on the socket. This send operation is special as
it sends more than tcp_sndbuf() bytes.
4. do_writemore() does not ACK the waiting Thread B, since it waits for
sent_tcp() to trigger sending the next chunk of data.
5. Received data for the socket is processed, do_recv() is called, and
the op_completed semaphore is signalled to complete *the* operation.
6. Thread B wakes up instead of thread A, destroying the message (a
local variable).
7. tcp_sndbuf() bytes are sent, and tcp_sent() calls do_writemore() with
a pointer to the destroyed message.

Is this sequence plausible or have I missed something?
Assuming the sequence is valid, does lwIP support more than a single
thread handling a socket? If so, wouldn't we need a set of locks for all
netconn operations that can happen simultaneously (if there are any)?

Yoav.