Project

General

Profile

Actions

Bug #3935

closed

Scheduler::executeEvent segfault (armhf)

Added by Junxiao Shi about 7 years ago. Updated about 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Utils
Target version:
Start date:
01/27/2017
Due date:
% Done:

100%

Estimated time:

Description

Environment: Linux 4.4.43-ti-r84 armv7l, Docker armhf-ubuntu_core 16.10
Packages: nfd-all 0.5.1-ppa2~yakkety
Command: HOME=/var/lib/ndn/nfd nfd
Expected: NFD starts
Actual: NFD crashes with segfault in ndn::util::scheduler::Scheduler::executeEvent


Files

valgrind.txt (144 KB) valgrind.txt valgrind log Junxiao Shi, 01/27/2017 10:21 PM
gdb.txt (29.9 KB) gdb.txt gdb backtrace Junxiao Shi, 01/27/2017 10:21 PM
vgcore.5528.7z.001 (4 MB) vgcore.5528.7z.001 core dump part 1 of 3 Junxiao Shi, 01/27/2017 10:25 PM
vgcore.5528.7z.002 (4 MB) vgcore.5528.7z.002 core dump part 2 of 3 Junxiao Shi, 01/27/2017 10:25 PM
vgcore.5528.7z.003 (3.66 MB) vgcore.5528.7z.003 core dump part 3 of 3 Junxiao Shi, 01/27/2017 10:26 PM

Updated by Junxiao Shi about 7 years ago

I have captured a core dump.
The following debug symbols are installed: ndn-cxx-dbg nfd-dbg libcrypto++6-dbg libgcc1-dbg libsqlite3-0-dbg.
And the logs are captured with:
HOME=/var/lib/ndn/nfd valgrind nfd &> valgrind.txt
gdb /usr/bin/nfd vgcore.* -ex 'thread apply all bt full' -ex quit > gdb.txt

The crash occurs when Boost.Scope_Exit invokes the callback, or within that callback.

gdb.txt thread 1 backtrace contains:

#4  ndn::util::scheduler::Scheduler::executeEvent (this=0x7161228, error=...) at ../src/util/scheduler.cpp:142
        boost_se_guard_142 = {f_ = {<boost::function0<void>> = {<boost::function_base> = {
                vtable = 0x4ba2605 <void boost::function0<void>::assign_to<ndn::util::scheduler::Scheduler::executeEvent(boost::system::error_code const&)::{lambda()#1}>(ndn::util::scheduler::Scheduler::executeEvent(boost::system::error_code const&)::{lambda()#1})::stored_vtable+1>, functor = {obj_ptr = 0x0, type = {type = 0x0, const_qualified = 17, volatile_qualified = 209}, func_ptr = 0x0, 
                  bound_memfunc_ptr = {memfunc_ptr = &virtual table offset 0, this adjustment 38660232, obj_ptr = 0xbd9d5130}, 
                  obj_ref = {obj_ptr = 0x0, is_const_qualified = 17, is_volatile_qualified = 209}, data = 0 '\000'}}, 
              static args = <optimized out>, static arity = <optimized out>}, <No data fields>}}
        now = {d_ = {rep_ = 8673241945747}}

In a different system (amd64 architecture), the same function's frame looks like:

#0  ndn::util::scheduler::Scheduler::executeEvent (this=0x7fffe4015ac0, error=...) at ../src/util/scheduler.cpp:145
        boost_se_guard_142 = {f_ = {<boost::function0<void>> = {<boost::function_base> = {vtable = 0x0, functor = {
                  obj_ptr = 0x7fffe4027140, type = {type = 0x7fffe4027140, const_qualified = false, volatile_qualified = false},
                  func_ptr = 0x7fffe4027140, bound_memfunc_ptr = {
                    memfunc_ptr = (void (boost::detail::function::X::*)(boost::detail::function::X * const,
    int)) 0x7fffe4027140, this adjustment 4294967296, obj_ptr = 0x7fffe4000900}, obj_ref = {obj_ptr = 0x7fffe4027140,
                    is_const_qualified = false, is_volatile_qualified = false}, data = 64 '@'}}, static args = <optimized out>,
              static arity = <optimized out>}, <No data fields>}}
        now = <optimized out>

Notice that the crashing process has func_ptr = 0x0, while the other system has func_ptr = 0x7fffe4027140.

Actions #2

Updated by Davide Pesavento about 7 years ago

Can you confirm that the segfault goes away if you revert commit:86dfa53feee7821446520cdfc41f29436d93689d ?

Actions #3

Updated by Junxiao Shi about 7 years ago

The segfault occurs in Docker container. I tried two different machines and backtrace is the same.
There is no segfault when running on the host.

Can you confirm that the segfault goes away if you revert commit:86dfa53feee7821446520cdfc41f29436d93689d ?

Yes.

Actions #4

Updated by Junxiao Shi about 7 years ago

  • Status changed from New to Code review
  • Assignee set to Junxiao Shi
  • Target version set to v0.6
Actions #5

Updated by Davide Pesavento about 7 years ago

  • Status changed from Code review to Closed
  • % Done changed from 0 to 100
Actions

Also available in: Atom PDF