[asterisk-bugs] [Asterisk 0010926]: double call to ast_freame_free

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=10926 
====================================================================== 
Reported By:                diegoias
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   10926
Category:                   Core-General
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.12.1  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             10-09-2007 10:38 CDT
Last Modified:              10-11-2007 11:42 CDT
====================================================================== 
Summary:                    double call to ast_freame_free
Description: 
The scenario is easy to reproduce here, execute from the shell this
command:

for i in `seq 60`; do asterisk -rx 'originate
Local/19 at from-internal-custom extension 21 at from-internal-custom'; echo -n
"$i "; done

The dialplan has 2 extensions:
;---- 19 - call the SIPp channel
exten => 19,1,Answer
exten => 19,2,Dial(SIP/100 at turing:5061)

;---- 21 - looped music for an hour
exten => 21,1,Answer
exten => 21,2,Set(WAIT_TIME=7)
exten => 21,3,GotoIf($[${WAIT_TIME} < 2]?7)
exten => 21,4,PlayBack(/music-8khz-10min)
exten => 21,5,Set(WAIT_TIME=$[${WAIT_TIME} - 1])
exten => 21,6,Goto(3)
exten => 21,7,Hangup

in "turing", we have a SIPp server running, with this command:
./sipp -sn uas -p  5061  -d 100 -mp 12000  -l 100 -mi $IP -i $IP
-rtp_echo

and /music-8khz-10min is a 10 minutes wav file (16 bits, 8khz). 

In this scenario, asterisk dies, and gdb gives me this trace from the core
dump:
(gdb) bt
http://bugs.digium.com/view.php?id=0  0x00c7382c in free () from /lib/libc.so.6
http://bugs.digium.com/view.php?id=1  0x0809f09a in ast_frame_free (fr=0xd45ff4,
cache=1) at frame.c:360
http://bugs.digium.com/view.php?id=2  0x08086e0a in ast_channel_bridge
(c0=0x98a2fc0, c1=0x98a2fc0,
config=0xb78cdda0, fo=0xb78ccf18, rc=0xb78ccf14)
    at
/root/bristuff-0.4.0-test4-xr3/asterisk-1.4.12.1/include/asterisk/frame.h:390
http://bugs.digium.com/view.php?id=3  0x0059a08d in ast_bridge_call
(chan=0x98a2fc0, peer=0x98b2ff0,
config=0xb78cdda0) at res_features.c:1404
http://bugs.digium.com/view.php?id=4  0x00584791 in dial_exec_full
(chan=0x98a2fc0, data=<value optimized
out>, peerflags=0xb78cde64, continue_exec=0x0) at app_dial.c:1656
http://bugs.digium.com/view.php?id=5  0x00586b02 in dial_exec (chan=0x98a2fc0,
data=0xb78d1f38) at
app_dial.c:1710
http://bugs.digium.com/view.php?id=6  0x080c751e in pbx_extension_helper
(c=0x98a2fc0, con=0x0,
context=0x98a3140 "from-internal-custom", exten=0x98a3190 "19", priority=2,
label=0x0,
    callerid=0x0, action=E_SPAWN) at pbx.c:532
http://bugs.digium.com/view.php?id=7  0x080c9206 in __ast_pbx_run (c=0x98a2fc0)
at pbx.c:2288
http://bugs.digium.com/view.php?id=8  0x080ca1ae in pbx_thread (data=0x98a2fc0)
at pbx.c:2603
http://bugs.digium.com/view.php?id=9  0x080f616b in dummy_start (data=0x9872fa8)
at utils.c:793
http://bugs.digium.com/view.php?id=10 0x00d8016a in start_thread () from
/lib/libpthread.so.0
http://bugs.digium.com/view.php?id=11 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=12 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=13 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=14 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=15 0x00000000 in ?? ()

====================================================================== 

---------------------------------------------------------------------- 
 russell - 10-11-07 11:42  
---------------------------------------------------------------------- 
file: Did you happen to see where the frame in question came from?  i.e.
Did you print f->src, and if so, did it have anything in it? 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
10-11-07 11:42  russell        Note Added: 0071821                          
======================================================================