[sr-dev] crash at f_malloc.c

[Juha Heinanen]

Daniel-Constantin Mierla writes:

> >> >From second core, get:
> >>
> >> frame 0
> >> p *qm
> >> p *frag
> >> p *f
> >> info locals
> >> p qm->free_hash[hash]
> >> p *qm->free_hash[hash].first

below is the same with MEMDBG ?=1  from another crash.

-- juha

(gdb) where
#0  0x0000000000641d6a in fm_insert_free (qm=0x7f1756261000, frag=0x7f1756a32ab8) at mem/f_malloc.c:242
#1  0x00000000006445a9 in fm_free (qmp=0x7f1756261000, p=0x7f1756a32af0, file=0x7f175bb14f2d "tm: h_table.c", 
    func=0x7f175bb151cb <__FUNCTION__.9593> "free_cell", line=135) at mem/f_malloc.c:626
#2  0x00007f175ba4eaa5 in free_cell (dead_cell=0x7f1756a0b168) at h_table.c:135
#3  0x00007f175bad14b0 in wait_handler (ti=285224763, wait_tl=0x7f1756a0b1e8, data=0x7f1756a0b168) at timer.c:648
#4  0x00000000004aaf88 in timer_list_expire (t=285224763, h=0x7f17562ae360, slow_l=0x7f17562af4e8, slow_mark=260) at timer.c:873
#5  0x00000000004ab3e5 in timer_handler () at timer.c:938
#6  0x00000000004ab853 in timer_main () at timer.c:977
#7  0x000000000052f67a in main_loop () at main.c:1650
#8  0x00000000005354d2 in main (argc=17, argv=0x7ffc55e2d168) at main.c:2566
(gdb) frame 0
#0  0x0000000000641d6a in fm_insert_free (qm=0x7f1756261000, frag=0x7f1756a32ab8) at mem/f_malloc.c:242
242	in mem/f_malloc.c
(gdb)  p *qm
$1 = {type = 0, size = 33554432, used = 6473272, real_used = 8437168, max_real_used = 8820360, ffrags = 114, first_frag = 0x7f1756269478, 
  last_frag = 0x7f1758260fc8, free_bitmap = {580542139582204, 576460752311812096, 281492173619200, 288230930219337730, 1099645845632, 
    4611686018427420672, 0, 0, 0, 2048, 4, 9227875636482146816, 8796093030400, 2199023779840, 2, 0, 0, 0, 134217728, 0, 137438953472, 0, 
    73016541184, 576460752303423488, 34359738372, 137438986240, 576460752303685632, 262144, 0, 0, 0, 0, 2050}, free_hash = {{first = 0x0, 
      no = 0}, {first = 0x0, no = 0}, {first = 0x7f17569af710, no = 2}, {first = 0x7f17569b6d00, no = 3}, {first = 0x7f17569f41d0, no = 3}, {
      first = 0x7f17569af7b0, no = 2}, {first = 0x7f1756a21dc8, no = 1}, {first = 0x7f1756a8a8d0, no = 2}, {first = 0x0, no = 0}, {
      first = 0x7f1756a87610, no = 1}, {first = 0x7f1756a87800, no = 5}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
      first = 0x7f1756a22008, no = 1}, {first = 0x7f1756a67828, no = 2}, {first = 0x7f1756a87748, no = 1}, {first = 0x0, 
      no = 0} <repeats 27 times>, {first = 0x7f17569bc118, no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
      first = 0x0, no = 0}, {first = 0x7f1756a7cff0, no = 1}, {first = 0x0, no = 0} <repeats 37 times>, {first = 0x7f1756a327c8, no = 6}, {
      first = 0x0, no = 0} <repeats 35 times>, {first = 0x7f17569fe5a8, no = 1}, {first = 0x0, no = 0} <repeats 22 times>, {
      first = 0x7f1756a31a68, no = 7}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, 
      no = 0}, {first = 0x7f17569f4228, no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
      first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f1756a31f30, 
      no = 6}, {first = 0x0, no = 0} <repeats 13 times>, {first = 0x7f1756a6e5e8, no = 1}, {first = 0x0, no = 0} <repeats 16 times>, {
      first = 0x7f1756a2a290, no = 6}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, 
      no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f1756a2abc0, no = 6}, {
      first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f1756a2e3a0, no = 5}, {first = 0x0, 
      no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, 
      no = 0}, {first = 0x7f1756a604e8, no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
      first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f17569f4888, no = 1}, {first = 0x0, no = 0}, {first = 0x0, 
      no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f17569f3a60, no = 1}, {
      first = 0x0, no = 0} <repeats 18 times>, {first = 0x7f17569bb4b8, no = 1}, {first = 0x0, no = 0} <repeats 12 times>, {
      first = 0x7f17569ede78, no = 1}, {first = 0x0, no = 0} <repeats 19 times>, {first = 0x7f1756a75c38, no = 1}, {first = 0x0, 
      no = 0} <repeats 12 times>, {first = 0x7f1756a7fd48, no = 1}, {first = 0x0, no = 0} <repeats 38 times>, {first = 0x7f1756a8a9f8, no = 1}, {
      first = 0x0, no = 0} <repeats 46 times>...}}
(gdb)  p *frag
$2 = {size = 17944, u = {nxt_free = 0x7f1756a2b288, reserved = 139738214478472}, prv_free = 0x62876e620000de4f, 
  file = 0x7f175bb14f2d "tm: h_table.c", func = 0x7f175bb151cb <__FUNCTION__.9593> "free_cell", line = 135, check = 4042322160}
(gdb)  p *f
$3 = {size = 139738209821792, u = {nxt_free = 0x7f17565ba460, reserved = 139738209821792}, prv_free = 0x62876e620000de4f, 
  file = 0x10020 <error: Cannot access memory at address 0x10020>, 
  func = 0x7f1756a2d0b0 "From: \"Juha Heinanen\" <sip:foo at test.tutpro.com>;tag=UPUUEy88QXYNOoJhqQWQIrSwoVM31O0y\r\nTo: <sip:foo at test.tutpro.com>\r\nContact: <sip:42351086 at 192.98.102.10:40198;transport=tcp>\r\nCall-ID: x7hS1hVpUOS2EGm"..., line = 86, check = 139738214486368}
(gdb)  info locals
f = 0x7f1756a2b288
hash = 2049
after = 0
(gdb)  p qm->free_hash[hash]
$4 = {first = 0x7f1756a2c2b8, no = 11}
(gdb)  p *qm->free_hash[hash].first
$5 = {size = 0, u = {nxt_free = 0x7f1756a2b288, reserved = 139738214478472}, prv_free = 0x0, file = 0x0, func = 0x0, line = 0, 
  check = 139738299043583}