[asterisk-bugs] [Asterisk 0010926]: double call to ast_freame_free

[noreply at bugs.digium.com]

The following issue requires your FEEDBACK. 
====================================================================== 
http://bugs.digium.com/view.php?id=10926 
====================================================================== 
Reported By:                diegoias
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   10926
Category:                   Core-General
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     feedback
Asterisk Version:           1.4.12.1  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             10-09-2007 10:38 CDT
Last Modified:              10-09-2007 11:16 CDT
====================================================================== 
Summary:                    double call to ast_freame_free
Description: 
The scenario is easy to reproduce here, execute from the shell this
command:

for i in `seq 60`; do asterisk -rx 'originate
Local/19 at from-internal-custom extension 21 at from-internal-custom'; echo -n
"$i "; done

The dialplan has 2 extensions:
;---- 19 - call the SIPp channel
exten => 19,1,Answer
exten => 19,2,Dial(SIP/100 at turing:5061)

;---- 21 - looped music for an hour
exten => 21,1,Answer
exten => 21,2,Set(WAIT_TIME=7)
exten => 21,3,GotoIf($[${WAIT_TIME} < 2]?7)
exten => 21,4,PlayBack(/music-8khz-10min)
exten => 21,5,Set(WAIT_TIME=$[${WAIT_TIME} - 1])
exten => 21,6,Goto(3)
exten => 21,7,Hangup

in "turing", we have a SIPp server running, with this command:
./sipp -sn uas -p  5061  -d 100 -mp 12000  -l 100 -mi $IP -i $IP
-rtp_echo

and /music-8khz-10min is a 10 minutes wav file (16 bits, 8khz). 

In this scenario, asterisk dies, and gdb gives me this trace from the core
dump:
(gdb) bt
http://bugs.digium.com/view.php?id=0  0x00c7382c in free () from /lib/libc.so.6
http://bugs.digium.com/view.php?id=1  0x0809f09a in ast_frame_free (fr=0xd45ff4,
cache=1) at frame.c:360
http://bugs.digium.com/view.php?id=2  0x08086e0a in ast_channel_bridge
(c0=0x98a2fc0, c1=0x98a2fc0,
config=0xb78cdda0, fo=0xb78ccf18, rc=0xb78ccf14)
    at
/root/bristuff-0.4.0-test4-xr3/asterisk-1.4.12.1/include/asterisk/frame.h:390
http://bugs.digium.com/view.php?id=3  0x0059a08d in ast_bridge_call
(chan=0x98a2fc0, peer=0x98b2ff0,
config=0xb78cdda0) at res_features.c:1404
http://bugs.digium.com/view.php?id=4  0x00584791 in dial_exec_full
(chan=0x98a2fc0, data=<value optimized
out>, peerflags=0xb78cde64, continue_exec=0x0) at app_dial.c:1656
http://bugs.digium.com/view.php?id=5  0x00586b02 in dial_exec (chan=0x98a2fc0,
data=0xb78d1f38) at
app_dial.c:1710
http://bugs.digium.com/view.php?id=6  0x080c751e in pbx_extension_helper
(c=0x98a2fc0, con=0x0,
context=0x98a3140 "from-internal-custom", exten=0x98a3190 "19", priority=2,
label=0x0,
    callerid=0x0, action=E_SPAWN) at pbx.c:532
http://bugs.digium.com/view.php?id=7  0x080c9206 in __ast_pbx_run (c=0x98a2fc0)
at pbx.c:2288
http://bugs.digium.com/view.php?id=8  0x080ca1ae in pbx_thread (data=0x98a2fc0)
at pbx.c:2603
http://bugs.digium.com/view.php?id=9  0x080f616b in dummy_start (data=0x9872fa8)
at utils.c:793
http://bugs.digium.com/view.php?id=10 0x00d8016a in start_thread () from
/lib/libpthread.so.0
http://bugs.digium.com/view.php?id=11 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=12 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=13 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=14 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=15 0x00000000 in ?? ()

====================================================================== 

---------------------------------------------------------------------- 
 file - 10-09-07 11:16  
---------------------------------------------------------------------- 
I've tried numerous ways to on my own system to reproduce this using
exactly the information provided (thanks for that!) but have been unable,
which means this bug may be timing critical. To that extent would it be
possible to get access to the Asterisk box where this happens so I can add
additional debug and track it down? 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
10-09-07 11:16  file           Note Added: 0071709                          
10-09-07 11:16  file           Status                   new => feedback     
======================================================================