Bug 18099

Here is small testing program (-pthread):

--
#define _THREAD_SAFE
#include <err.h>
#include <pthread.h>
#include <stdio.h>

pthread_t	tid;

pthread_cond_t	cond = PTHREAD_COND_INITIALIZER;

/* ARGSUSED */
void *test(void *dummy)
{

	if (pthread_cond_broadcast(&cond) != 0)
		warnx("pthread_cond_broadcast()");
	if (pthread_cond_timedwait(&cond, NULL, NULL) != 0)
		warnx("pthread_cond_timedwait()");
	return NULL;
}

int main(void)
{

	if (pthread_create(&tid, NULL, test, NULL) != 0)
		errx(1, "pthread_create()");
	if (pthread_join(tid, NULL) != 0)
		errx(1, "pthread_join()");
	return 0;
}
--

According to standards, pthread_cond_broadcast() should do nothing
without any error. And I think pthread_cond_timedwait() should not
produce a coredump. But if you run it, you get:

--
tst: pthread_cond_broadcast()
Segmentation fault (core dumped)
--

If you apply following patch, you get only:

--
tst: pthread_cond_timedwait()
--

a) pthread_cond_broadcast() will not produce any error: the problem
   occurs only when condition is initialized statically and have not
   been used (= allocated) before - maybe this is artifical example, but
   I had a problem with this in a real situation (on Solaris it works
   fine but on FreeBSD before patch it doesn't)

   (second and third chunk of patch for pthread_cond_signal() and
   pthread_cond_broadcast() functions)

b) pthread_cond_timedwait() will produce error only instead of coredump;
   if you look into sources, it really looks as a copy & paste & insert bug

   (first chunk of patch)