We use anonymous Posix semaphores for some synchronization in hotspot.

sem_destroy() can fail on some platforms with EBUSY if the semaphore has still threads waiting on it. The glibc does not care and will happily report success, but other Unices care (eg BSD, AIX) and refuse to close the semaphore, leaving the sem_t structure untouched.

It then happened for us that a new semaphore was created at the exact location of the old, still unclosed semaphore, and the unchanged sem_t structure was fed to sem_init(), which would fail with the same EBUSY error and trigger a guarantee.

One simple thing we should do is to assert success after closing a semaphore, as we do on all other semaphore operations. Granted, we won't see anything on Linux with glibc, but maybe shake loose errors on other platforms.