[asterisk-bugs] [Asterisk 0010926]: double call to ast_freame_free

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=10926 
====================================================================== 
Reported By:                diegoias
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   10926
Category:                   Core-General
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.12.1  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             10-09-2007 10:38 CDT
Last Modified:              10-17-2007 03:23 CDT
====================================================================== 
Summary:                    double call to ast_freame_free
Description: 
The scenario is easy to reproduce here, execute from the shell this
command:

for i in `seq 60`; do asterisk -rx 'originate
Local/19 at from-internal-custom extension 21 at from-internal-custom'; echo -n
"$i "; done

The dialplan has 2 extensions:
;---- 19 - call the SIPp channel
exten => 19,1,Answer
exten => 19,2,Dial(SIP/100 at turing:5061)

;---- 21 - looped music for an hour
exten => 21,1,Answer
exten => 21,2,Set(WAIT_TIME=7)
exten => 21,3,GotoIf($[${WAIT_TIME} < 2]?7)
exten => 21,4,PlayBack(/music-8khz-10min)
exten => 21,5,Set(WAIT_TIME=$[${WAIT_TIME} - 1])
exten => 21,6,Goto(3)
exten => 21,7,Hangup

in "turing", we have a SIPp server running, with this command:
./sipp -sn uas -p  5061  -d 100 -mp 12000  -l 100 -mi $IP -i $IP
-rtp_echo

and /music-8khz-10min is a 10 minutes wav file (16 bits, 8khz). 

In this scenario, asterisk dies, and gdb gives me this trace from the core
dump:
(gdb) bt
http://bugs.digium.com/view.php?id=0  0x00c7382c in free () from /lib/libc.so.6
http://bugs.digium.com/view.php?id=1  0x0809f09a in ast_frame_free (fr=0xd45ff4,
cache=1) at frame.c:360
http://bugs.digium.com/view.php?id=2  0x08086e0a in ast_channel_bridge
(c0=0x98a2fc0, c1=0x98a2fc0,
config=0xb78cdda0, fo=0xb78ccf18, rc=0xb78ccf14)
    at
/root/bristuff-0.4.0-test4-xr3/asterisk-1.4.12.1/include/asterisk/frame.h:390
http://bugs.digium.com/view.php?id=3  0x0059a08d in ast_bridge_call
(chan=0x98a2fc0, peer=0x98b2ff0,
config=0xb78cdda0) at res_features.c:1404
http://bugs.digium.com/view.php?id=4  0x00584791 in dial_exec_full
(chan=0x98a2fc0, data=<value optimized
out>, peerflags=0xb78cde64, continue_exec=0x0) at app_dial.c:1656
http://bugs.digium.com/view.php?id=5  0x00586b02 in dial_exec (chan=0x98a2fc0,
data=0xb78d1f38) at
app_dial.c:1710
http://bugs.digium.com/view.php?id=6  0x080c751e in pbx_extension_helper
(c=0x98a2fc0, con=0x0,
context=0x98a3140 "from-internal-custom", exten=0x98a3190 "19", priority=2,
label=0x0,
    callerid=0x0, action=E_SPAWN) at pbx.c:532
http://bugs.digium.com/view.php?id=7  0x080c9206 in __ast_pbx_run (c=0x98a2fc0)
at pbx.c:2288
http://bugs.digium.com/view.php?id=8  0x080ca1ae in pbx_thread (data=0x98a2fc0)
at pbx.c:2603
http://bugs.digium.com/view.php?id=9  0x080f616b in dummy_start (data=0x9872fa8)
at utils.c:793
http://bugs.digium.com/view.php?id=10 0x00d8016a in start_thread () from
/lib/libpthread.so.0
http://bugs.digium.com/view.php?id=11 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=12 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=13 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=14 0xb78d4480 in ?? ()
http://bugs.digium.com/view.php?id=15 0x00000000 in ?? ()

====================================================================== 

---------------------------------------------------------------------- 
 diegoias - 10-17-07 03:23  
---------------------------------------------------------------------- 
I upgraded the source once more, and now Asterisk dies when generating a
single FXS call. 

Now the lame factor gets a new scale:
The original test was done on a VIA based machine. We decided to move the
setup to an Intel based machine, and puf! Everything is working perfectly,
and I do mean everything.

It seems that the trigger for this was the VIA based CPU, or gcc
generating bad code for that platform (I don't think that you have any
Intel only specific code in the source no...?). 

How would you like me to continue this investigation? 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
10-17-07 03:23  diegoias       Note Added: 0072140                          
======================================================================