Re: [sr-dev] crash at f_malloc.c

Daniel-Constantin Mierla writes: below is the same with MEMDBG ?=1 from another crash. -- juha (gdb) where #0 0x0000000000641d6a in fm_insert_free (qm=0x7f1756261000, frag=0x7f1756a32ab8) at mem/f_malloc.c:242 #1 0x00000000006445a9 in fm_free (qmp=0x7f1756261000, p=0x7f1756a32af0, file=0x7f175bb14f2d "tm: h_table.c", func=0x7f175bb151cb <__FUNCTION__.9593> "free_cell", line=135) at mem/f_malloc.c:626 #2 0x00007f175ba4eaa5 in free_cell (dead_cell=0x7f1756a0b168) at h_table.c:135 #3 0x00007f175bad14b0 in wait_handler (ti=285224763, wait_tl=0x7f1756a0b1e8, data=0x7f1756a0b168) at timer.c:648 #4 0x00000000004aaf88 in timer_list_expire (t=285224763, h=0x7f17562ae360, slow_l=0x7f17562af4e8, slow_mark=260) at timer.c:873 #5 0x00000000004ab3e5 in timer_handler () at timer.c:938 #6 0x00000000004ab853 in timer_main () at timer.c:977 #7 0x000000000052f67a in main_loop () at main.c:1650 #8 0x00000000005354d2 in main (argc=17, argv=0x7ffc55e2d168) at main.c:2566 (gdb) frame 0 #0 0x0000000000641d6a in fm_insert_free (qm=0x7f1756261000, frag=0x7f1756a32ab8) at mem/f_malloc.c:242 242 in mem/f_malloc.c (gdb) p *qm $1 = {type = 0, size = 33554432, used = 6473272, real_used = 8437168, max_real_used = 8820360, ffrags = 114, first_frag = 0x7f1756269478, last_frag = 0x7f1758260fc8, free_bitmap = {580542139582204, 576460752311812096, 281492173619200, 288230930219337730, 1099645845632, 4611686018427420672, 0, 0, 0, 2048, 4, 9227875636482146816, 8796093030400, 2199023779840, 2, 0, 0, 0, 134217728, 0, 137438953472, 0, 73016541184, 576460752303423488, 34359738372, 137438986240, 576460752303685632, 262144, 0, 0, 0, 0, 2050}, free_hash = {{first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f17569af710, no = 2}, {first = 0x7f17569b6d00, no = 3}, {first = 0x7f17569f41d0, no = 3}, { first = 0x7f17569af7b0, no = 2}, {first = 0x7f1756a21dc8, no = 1}, {first = 0x7f1756a8a8d0, no = 2}, {first = 0x0, no = 0}, { first = 0x7f1756a87610, no = 1}, {first = 0x7f1756a87800, no = 5}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, { first = 0x7f1756a22008, no = 1}, {first = 0x7f1756a67828, no = 2}, {first = 0x7f1756a87748, no = 1}, {first = 0x0, no = 0} <repeats 27 times>, {first = 0x7f17569bc118, no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, { first = 0x0, no = 0}, {first = 0x7f1756a7cff0, no = 1}, {first = 0x0, no = 0} <repeats 37 times>, {first = 0x7f1756a327c8, no = 6}, { first = 0x0, no = 0} <repeats 35 times>, {first = 0x7f17569fe5a8, no = 1}, {first = 0x0, no = 0} <repeats 22 times>, { first = 0x7f1756a31a68, no = 7}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f17569f4228, no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, { first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f1756a31f30, no = 6}, {first = 0x0, no = 0} <repeats 13 times>, {first = 0x7f1756a6e5e8, no = 1}, {first = 0x0, no = 0} <repeats 16 times>, { first = 0x7f1756a2a290, no = 6}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f1756a2abc0, no = 6}, { first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f1756a2e3a0, no = 5}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f1756a604e8, no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, { first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f17569f4888, no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f17569f3a60, no = 1}, { first = 0x0, no = 0} <repeats 18 times>, {first = 0x7f17569bb4b8, no = 1}, {first = 0x0, no = 0} <repeats 12 times>, { first = 0x7f17569ede78, no = 1}, {first = 0x0, no = 0} <repeats 19 times>, {first = 0x7f1756a75c38, no = 1}, {first = 0x0, no = 0} <repeats 12 times>, {first = 0x7f1756a7fd48, no = 1}, {first = 0x0, no = 0} <repeats 38 times>, {first = 0x7f1756a8a9f8, no = 1}, { first = 0x0, no = 0} <repeats 46 times>...}} (gdb) p *frag $2 = {size = 17944, u = {nxt_free = 0x7f1756a2b288, reserved = 139738214478472}, prv_free = 0x62876e620000de4f, file = 0x7f175bb14f2d "tm: h_table.c", func = 0x7f175bb151cb <__FUNCTION__.9593> "free_cell", line = 135, check = 4042322160} (gdb) p *f $3 = {size = 139738209821792, u = {nxt_free = 0x7f17565ba460, reserved = 139738209821792}, prv_free = 0x62876e620000de4f, file = 0x10020 <error: Cannot access memory at address 0x10020>, func = 0x7f1756a2d0b0 "From: \"Juha Heinanen\" <sip:foo@test.tutpro.com>;tag=UPUUEy88QXYNOoJhqQWQIrSwoVM31O0y\r\nTo: <sip:foo@test.tutpro.com>\r\nContact: <sip:42351086@192.98.102.10:40198;transport=tcp>\r\nCall-ID: x7hS1hVpUOS2EGm"..., line = 86, check = 139738214486368} (gdb) info locals f = 0x7f1756a2b288 hash = 2049 after = 0 (gdb) p qm->free_hash[hash] $4 = {first = 0x7f1756a2c2b8, no = 11} (gdb) p *qm->free_hash[hash].first $5 = {size = 0, u = {nxt_free = 0x7f1756a2b288, reserved = 139738214478472}, prv_free = 0x0, file = 0x0, func = 0x0, line = 0, check = 139738299043583}