[Evolution] Double SEGV and deadlock [SMP]



Package: Evolution
Priority: Normal
Version: 1.2.2
Synopsis: Double SEGV and deadlock [SMP]
Bugzilla-Product: Evolution
Bugzilla-Component: Mailer

Description:

Threads 3 and 1 both receive a SEGV. Thread 1 is in libc free()
function. Post mortem on thread 3 indicates that e_mempool_new() may be
returning a garbage pointer. The application deadlocks attempting to
display gnome crash dialog.


(gdb) thread apply all bt

Thread 9 (Thread 180232 (LWP 1907)):
#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at ../sysdeps/unix/sysv/linux/sigsuspend.c:45
#1  0x40391f35 in __pthread_wait_for_restart_signal (self=0xbebffbe0) at pthread.c:1084
#2  0x4038ef05 in pthread_cond_wait (cond=0x0, mutex=0x416c23c8) at restart.h:34
#3  0x4022caea in e_msgport_wait (mp=0x41406ac0) at e-msgport.c:305
#4  0x4022d38a in thread_dispatch (din=0x416e6830) at e-msgport.c:665
#5  0x4038fd53 in pthread_start_thread (arg=0xbebffbe0) at manager.c:300

Thread 8 (Thread 98311 (LWP 1902)):
#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at ../sysdeps/unix/sysv/linux/sigsuspend.c:45
#1  0x40391f35 in __pthread_wait_for_restart_signal (self=0xbedffbe0) at pthread.c:1084
#2  0x4038ef05 in pthread_cond_wait (cond=0x0, mutex=0x814ba70) at restart.h:34
#3  0x4022caea in e_msgport_wait (mp=0x814ba40) at e-msgport.c:305
#4  0x4022d38a in thread_dispatch (din=0x814b9e8) at e-msgport.c:665
#5  0x4038fd53 in pthread_start_thread (arg=0xbedffbe0) at manager.c:300

Thread 7 (Thread 81926 (LWP 1901)):
#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at ../sysdeps/unix/sysv/linux/sigsuspend.c:45
#1  0x40391f35 in __pthread_wait_for_restart_signal (self=0xbefffbe0) at pthread.c:1084
#2  0x4038ef05 in pthread_cond_wait (cond=0x0, mutex=0x814ba70) at restart.h:34
#3  0x4022caea in e_msgport_wait (mp=0x814ba40) at e-msgport.c:305
#4  0x4022d38a in thread_dispatch (din=0x814b9e8) at e-msgport.c:665
#5  0x4038fd53 in pthread_start_thread (arg=0xbefffbe0) at manager.c:300

Thread 6 (Thread 114693 (LWP 1903)):
#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at ../sysdeps/unix/sysv/linux/sigsuspend.c:45
#1  0x40391f35 in __pthread_wait_for_restart_signal (self=0xbf1ffbe0) at pthread.c:1084
#2  0x4038ef05 in pthread_cond_wait (cond=0x0, mutex=0x814ba70) at restart.h:34
#3  0x4022caea in e_msgport_wait (mp=0x814ba40) at e-msgport.c:305
#4  0x4022d38a in thread_dispatch (din=0x814b9e8) at e-msgport.c:665
#5  0x4038fd53 in pthread_start_thread (arg=0xbf1ffbe0) at manager.c:300

Thread 5 (Thread 49156 (LWP 1896)):
#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at ../sysdeps/unix/sysv/linux/sigsuspend.c:45
#1  0x40391f35 in __pthread_wait_for_restart_signal (self=0xbf3ffbe0) at pthread.c:1084
#2  0x4038ef05 in pthread_cond_wait (cond=0x0, mutex=0x814ba70) at restart.h:34
#3  0x4022caea in e_msgport_wait (mp=0x814ba40) at e-msgport.c:305
#4  0x4022d38a in thread_dispatch (din=0x814b9e8) at e-msgport.c:665
#5  0x4038fd53 in pthread_start_thread (arg=0xbf3ffbe0) at manager.c:300

Thread 4 (Thread 32771 (LWP 1893)):
#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at ../sysdeps/unix/sysv/linux/sigsuspend.c:45
#1  0x40391f35 in __pthread_wait_for_restart_signal (self=0xbf5ffbe0) at pthread.c:1084
#2  0x4038ef05 in pthread_cond_wait (cond=0x0, mutex=0x814b9b8) at restart.h:34
#3  0x4022caea in e_msgport_wait (mp=0x814b988) at e-msgport.c:305
#4  0x4022d38a in thread_dispatch (din=0x814b930) at e-msgport.c:665
#5  0x4038fd53 in pthread_start_thread (arg=0xbf5ffbe0) at manager.c:300

Thread 3 (Thread 16386 (LWP 1892)):
#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at ../sysdeps/unix/sysv/linux/sigsuspend.c:45
#1  0x40391f35 in __pthread_wait_for_restart_signal (self=0xbf7ffbe0) at pthread.c:1084
#2  0x40393790 in __pthread_alt_lock (lock=0x8105498, self=0xbf7ffbe0) at restart.h:34
#3  0x40390984 in __pthread_mutex_lock (mutex=0x8105488) at mutex.c:120
#4  0x080ae6b3 in segv_redirect (sig=1) at main.c:80
#5  0x4039575a in __pthread_sighandler (signo=11, ctx=
      {gs = 0, __gsh = 0, fs = 0, __fsh = 0, es = 43, __esh = 0, ds = 43, __dsh = 0, edi = 128, esi = 
185467032, ebp = 3212834404, esp = 3212834380, ebx = 1076058104, edx = 256, ecx = 1, eax = 2, trapno = 14, 
err = 6, eip = 1076016724, cs = 35, __csh = 0, eflags = 66050, esp_at_signal = 3212834380, ss = 43, __ssh = 
0, fpstate = 0xbf7ff3d0, oldmask = 2147483648, cr2 = 185467032}) at sighandler.c:38
#6  <signal handler called>
#7  e_mempool_new (blocksize=141266760, threshold=128, flags=139996672) at e-memory.c:420
#8  0x4007c6fd in camel_text_index_name_init (idn=0x86b8f48) at camel-text-index.c:1501
#9  0x400661e5 in camel_object_init (o=0x86b8f48, klass=0x8665ef8, type=0x8665ef8) at camel-object.c:380
#10 0x40066261 in camel_object_new (type=0x8665ef8) at camel-object.c:406
#11 0x4007c7ce in camel_text_index_name_new (idx=0x4130f560, name=0x8408f6a "1046689793.22055_4923.devil", 
nameid=134932076) at camel-text-index.c:1538
#12 0x4007b407 in text_index_add_name (idx=0x4130f560, name=0x8408f6a "1046689793.22055_4923.devil") at 
camel-text-index.c:617
#13 0x40052528 in camel_index_add_name (idx=0x411a9020, name=0x8408f6a "1046689793.22055_4923.devil") at 
camel-index.c:185
#14 0x40046850 in camel_folder_summary_info_new_from_parser (s=0x820e288, mp=0x86347d0) at 
camel-folder-summary.c:932
#15 0x400466f5 in camel_folder_summary_add_from_parser (s=0x820e288, mp=0x86347d0) at 
camel-folder-summary.c:843
#16 0x412f53d0 in camel_maildir_summary_add (cls=0x820e288, name=0x41a1d993 "1046689793.22055_4923.devil:2,", 
forceindex=0) at camel-maildir-summary.c:478
#17 0x412f5731 in maildir_summary_check (cls=0x820e288, changes=0x81c8490, ex=0x86aa2b0) at 
camel-maildir-summary.c:605
#18 0x412eded3 in camel_local_summary_check (cls=0x820e288, changeinfo=0x81c8490, ex=0x86aa2b0) at 
camel-local-summary.c:257
#19 0x412f5ad2 in maildir_summary_sync (cls=0x820e288, expunge=0, changes=0x81c8490, ex=0x86aa2b0) at 
camel-maildir-summary.c:726
#20 0x412edf16 in camel_local_summary_sync (cls=0x820e288, expunge=0, changeinfo=0x81c8490, ex=0x86aa2b0) at 
camel-local-summary.c:286
#21 0x412ecca6 in local_sync (folder=0x81b6b48, expunge=0, ex=0x86aa2b0) at camel-local-folder.c:420
#22 0x4004ae39 in camel_folder_sync (folder=0x81b6b48, expunge=0, ex=0x86aa2b0) at camel-folder.c:279
#23 0x0809e590 in mlf_sync (folder=0x81b6b48, expunge=0, ex=0x86aa2b0) at mail-local.c:260
#24 0x4004ae39 in camel_folder_sync (folder=0x41314f78, expunge=0, ex=0x86aa2b0) at camel-folder.c:279
#25 0x400825db in vee_sync (folder=0x81a9208, expunge=0, ex=0x86aa2b0) at camel-vee-folder.c:613
#26 0x4004ae39 in camel_folder_sync (folder=0x81a9208, expunge=0, ex=0x86aa2b0) at camel-folder.c:279
#27 0x080a4abf in sync_folder_sync (mm=0x411a9020) at mail-ops.c:1524
#28 0x080a144f in mail_msg_received (e=0x814b8b8, msg=0x86aa298, data=0x0) at mail-mt.c:503
#29 0x4022d1f6 in thread_received_msg (e=0x814b8b8, m=0x86aa298) at e-msgport.c:617
#30 0x4022d2f1 in thread_dispatch (din=0x814b8b8) at e-msgport.c:698
#31 0x4038fd53 in pthread_start_thread (arg=0xbf7ffbe0) at manager.c:300

Thread 2 (Thread 32769 (LWP 1891)):
#0  0x411582c0 in *__GI___poll (fds=0x81752a4, nfds=1, timeout=201) at ../sysdeps/unix/sysv/linux/poll.c:63
#1  0x4038fa8e in __pthread_manager (arg=0xc9) at manager.c:145

Thread 1 (Thread 16384 (LWP 1847)):
#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at ../sysdeps/unix/sysv/linux/sigsuspend.c:45
#1  0x40391f35 in __pthread_wait_for_restart_signal (self=0x40396080) at pthread.c:1084
#2  0x40393790 in __pthread_alt_lock (lock=0x411a9cf0, self=0x40396080) at restart.h:34
#3  0x40390984 in __pthread_mutex_lock (mutex=0x411a9ce0) at mutex.c:120
#4  0x41103000 in ptmalloc_lock_all () at arena.c:222
#5  0x40391047 in __fork () at ptfork.c:74
#6  0x40bd79fc in gnome_init () from /usr/lib/libgnomeui.so.32
#7  0x080ae6d6 in segv_redirect (sig=-1073746004) at main.c:71
#8  0x4039575a in __pthread_sighandler (signo=11, ctx=
      {gs = 0, __gsh = 0, fs = 0, __fsh = 0, es = 43, __esh = 0, ds = 43, __dsh = 0, edi = 1092263136, esi = 
142184952, ebp = 3221222104, esp = 3221222064, ebx = 1092259872, edx = 1092263196, ecx = 1092263136, eax = 
142184992, trapno = 0, err = 0, eip = 1091588810, cs = 35, __csh = 0, eflags = 2097670, esp_at_signal = 
3221222064, ss = 43, __ssh = 0, fpstate = 0xbffff030, oldmask = 2147483648, cr2 = 0}) at sighandler.c:38
#9  <signal handler called>
#10 __libc_free (mem=0x87991f8) at malloc.c:3345
#11 0x40f966fb in g_free (mem=0x87991f8) at gmem.c:411
#12 0x405b171d in e_tree_sorted_node_resorted () from /usr/lib/libgal.so.21
#13 0x405b1eb6 in e_tree_sorted_node_resorted () from /usr/lib/libgal.so.21
#14 0x405b1f05 in e_tree_sorted_node_resorted () from /usr/lib/libgal.so.21
#15 0x405b1f05 in e_tree_sorted_node_resorted () from /usr/lib/libgal.so.21
#16 0x405b1f05 in e_tree_sorted_node_resorted () from /usr/lib/libgal.so.21
#17 0x405b277e in e_tree_table_adapter_get_type () from /usr/lib/libgal.so.21
#18 0x40eb9043 in gtk_marshal_NONE__POINTER (object=0x855eee8, func=0x405b2728 
<e_tree_table_adapter_get_type+196>, func_data=0x81aad78, args=0xbffff538)
    at gtkmarshal.c:193
#19 0x40ee8b6c in gtk_handlers_run (handlers=0x84fe0e0, signal=0xbffff4e4, object=0x855eee8, 
params=0xbffff538, after=0) at gtksignal.c:1917
#20 0x40ee7fd5 in gtk_signal_real_emit (object=0x855eee8, signal_id=136, params=0xbffff538) at 
gtksignal.c:1477
#21 0x40ee60b3 in gtk_signal_emit (object=0x855eee8, signal_id=136) at gtksignal.c:552
#22 0x405aa535 in e_tree_model_node_changed () from /usr/lib/libgal.so.21
#23 0x405af95e in e_tree_selection_model_get_type () from /usr/lib/libgal.so.21
#24 0x405af0f1 in e_tree_selection_model_get_type () from /usr/lib/libgal.so.21
#25 0x40f964ea in g_idle_dispatch (source_data=0x405af094, dispatch_time=0xbffff920, user_data=0x855eee8) at 
gmain.c:1367
#26 0x40f954c8 in g_main_dispatch (dispatch_time=0xbffff920) at gmain.c:656
#27 0x40f95ad3 in g_main_iterate (block=1, dispatch=1) at gmain.c:877
#28 0x40f95c6c in g_main_run (loop=0x814ef00) at gmain.c:935
#29 0x40eb77f7 in gtk_main () at gtkmain.c:524
#30 0x404f8ecd in bonobo_main () from /usr/lib/libbonobo.so.2
#31 0x080ae84c in main (argc=-1073743020, argv=0x80f8a35) at main.c:160
0x411582c0      63      in ../sysdeps/unix/sysv/linux/poll.c
(gdb) t 3
[Switching to thread 3 (Thread 16386 (LWP 1892))]#0  0x410c2ae2 in *__GI___sigsuspend (set=0x411a9020) at 
../sysdeps/unix/sysv/linux/sigsuspend.c:45
45      ../sysdeps/unix/sysv/linux/sigsuspend.c: No such file or directory.
        in ../sysdeps/unix/sysv/linux/sigsuspend.c
(gdb) f 7
#7  e_mempool_new (blocksize=141266760, threshold=128, flags=139996672) at e-memory.c:420
420             pool->blocksize = blocksize;
(gdb) up
#8  0x4007c6fd in camel_text_index_name_init (idn=0x86b8f48) at camel-text-index.c:1501
1501            p->pool = e_mempool_new(256, 128, E_MEMPOOL_ALIGN_BYTE);
(gdb) do
#7  e_mempool_new (blocksize=141266760, threshold=128, flags=139996672) at e-memory.c:420
420             pool->blocksize = blocksize;
(gdb) list
415     #ifdef G_THREADS_ENABLED
416             g_static_mutex_unlock(&mempool_mutex);
417     #endif
418             if (threshold >= blocksize)
419                     threshold = blocksize * 2 / 3;
420             pool->blocksize = blocksize;
421             pool->threshold = threshold;
422             pool->blocks = NULL;
423             pool->threshold_blocks = NULL;
424     
(gdb) p mempool_mutex
$1 = {runtime_mutex = 0x0, aligned_pad_u = {pad = '\0' <repeats 23 times>, dummy_double = 0, dummy_pointer = 
0x0, dummy_long = 0}}
(gdb) list 380
375     
376     /* a pool of mempool header blocks */
377     static MemChunk *mempool_memchunk;
378     #ifdef G_THREADS_ENABLED
379     static GStaticMutex mempool_mutex = G_STATIC_MUTEX_INIT;
380     #endif
381     
382     /**
383      * e_mempool_new:
384      * @blocksize: The base blocksize to use for all system alocations.
(gdb) 
385      * @threshold: If the allocation exceeds the threshold, then it is
386      * allocated separately and stored in a separate list.
387      * @flags: Alignment options: E_MEMPOOL_ALIGN_STRUCT uses native
388      * struct alignment, E_MEMPOOL_ALIGN_WORD aligns to 16 bits (2 bytes),
389      * and E_MEMPOOL_ALIGN_BYTE aligns to the nearest byte.  The default
390      * is to align to native structures.
391      * 
392      * Create a new mempool header.  Mempools can be used to efficiently
393      * allocate data which can then be freed as a whole.
394      *
(gdb) 
395      * Mempools can also be used to efficiently allocate arbitrarily
396      * aligned data (such as strings) without incurring the space overhead
397      * of aligning each allocation (which is not required for strings).
398      *
399      * However, each allocation cannot be freed individually, only all
400      * or nothing.
401      * 
402      * Return value: 
403      **/
404     MemPool *e_mempool_new(int blocksize, int threshold, EMemPoolFlags flags)
(gdb) 
405     {
406             MemPool *pool;
407     
408     #ifdef G_THREADS_ENABLED
409             g_static_mutex_lock(&mempool_mutex);
410     #endif
411             if (mempool_memchunk == NULL) {
412                     mempool_memchunk = e_memchunk_new(8, sizeof(MemPool));
413             }
414             pool = e_memchunk_alloc(mempool_memchunk);
(gdb) info local
pool = (MemPool *) 0xb0e0098
(gdb) p *pool
Cannot access memory at address 0xb0e0098
(gdb) info args
blocksize = 141266760
threshold = 128
flags = 139996672





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]