[asterisk-bugs] [Asterisk 0013063]: Crash in iax2_destroy at chan_iax2.c:1309

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=13063 
====================================================================== 
Reported By:                ZX81
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   13063
Category:                   Channels/chan_iax2
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           SVN 
SVN Branch (only for SVN checkouts, not tarball releases):  1.4  
SVN Revision (number only!): 129803 
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             07-12-2008 19:12 CDT
Last Modified:              07-13-2008 19:54 CDT
====================================================================== 
Summary:                    Crash in iax2_destroy at chan_iax2.c:1309
Description: 
Brand new system taken from 1.4svn (r129803).

The machine is at my house and the network is particularly bad today
(http://bugs.digium.com/view.php?id=22#60%
packet loss).

I have a caching name server, and have registrations to three Asterisk 1.4
machines I own (trunking enabled).

There are no users on the machine as it is being built for production for
next week.

With no activity except for the outgoing registrations and qualify
statements, Asterisk crashed with the following:

http://bugs.digium.com/view.php?id=0  0xb732a9dc in iax2_destroy (callno=4176)
at chan_iax2.c:1309
http://bugs.digium.com/view.php?id=1  0xb7334dc3 in __iax2_poke_noanswer
(data=0x81f02e0) at
chan_iax2.c:8869
http://bugs.digium.com/view.php?id=2  0xb734d3d5 in iax2_process_thread
(data=0x81f40d0) at
chan_iax2.c:8642
http://bugs.digium.com/view.php?id=3  0x080ff690 in dummy_start (data=0x81e9c00)
at utils.c:912
http://bugs.digium.com/view.php?id=4  0xb7f37240 in start_thread () from
/lib/tls/i686/cmov/libpthread.so.0
http://bugs.digium.com/view.php?id=5  0xb7e5249e in clone () from
/lib/tls/i686/cmov/libc.so.6

The machine is:

2.6.18-5-686 http://bugs.digium.com/view.php?id=1 SMP Tue Dec 18 21:24:20 UTC
2007 i686 GNU/Linux

It crashed twice earlier (within 10 minutes of each other), but has not
crashed in the last 2 hours.

The only difference I can see (seeing as the box is doing nothing) is that
in the period where it crashed twice, the packet loss was extreme.

This may prove to be a difficult one to track down, however I have
recompiled Asterisk with DEBUG_THREADS and DONT_OPTIMIZE and will upload
another core if I get one.
====================================================================== 

---------------------------------------------------------------------- 
 ZX81 - 07-13-08 19:54  
---------------------------------------------------------------------- 
Ok, so I've run a few tests.

I checked out the revision that was related to the last release (assuming
that there would have been more reports if it was in release code).

That was 126590 and did not crash.  I've then gone through the commit logs
and found the revision numbers of changes to chan_iax2.c

I then went through and picked the revision half way between current and
not crashing.  If it crashed I went halfway between that one and the non
crasher.

126590 - [checked] does not crash (after 15 minutes)
126999 - [unchecked]
127068 - [unchecked]
127069 - [unchecked]
128639 - [checked] does not crash (after 24 minutes)
128737 - [checked] does not crash (after 27 minutes)
128795 - [checked] does crash (after 4 minutes)
129047 - [unchecked]
129803 - [checked] does crash (after 6 minutes)
130169 - [checked] does crash (after 10 minutes)

Therefore, the commit that caused the crash is:

http://svn.digium.com/view/asterisk?view=rev&revision=128795

The bug this closed was:

http://bugs.digium.com/view.php?id=13014 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
07-13-08 19:54  ZX81           Note Added: 0090181                          
======================================================================