[asterisk-bugs] [Asterisk 0015915]: crash when calling ao2_unlock inside pthread_timer_disable_continuous

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=15915 
====================================================================== 
Reported By:                keiron
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   15915
Category:                   Resources/res_timing_pthread
Reproducibility:            random
Severity:                   crash
Priority:                   normal
Status:                     acknowledged
Asterisk Version:           Older 1.6.1 
JIRA:                       SWP-307 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-09-18 01:03 CDT
Last Modified:              2009-12-04 00:04 CST
====================================================================== 
Summary:                    crash when calling ao2_unlock inside
pthread_timer_disable_continuous
Description: 
When under heavy load we have experienced random crashes (6 times in a day)
at the same point in the code. The load is with about 200 channels, 70
users and making a lot of calls. It was very stable until we started
reaching a certain level of usage.
====================================================================== 

---------------------------------------------------------------------- 
 (0114711) paul-tg (reporter) - 2009-12-04 00:04
 https://issues.asterisk.org/view.php?id=15915#c114711 
---------------------------------------------------------------------- 
I've analysed the state of the pthread_timers structure in one of the core
files, and found no inconsistency.

Specifically, using the backtrace above I derived that the thread handle
passed in to pthread_timer_disable_continuous() was 1218, so the backtrace
*should have* looked like:

https://issues.asterisk.org/view.php?id=0 _ao2_unlock (user_data=0x80,
file=0x2aaabb0336e0
"res_timing_pthread.c",
    func=0x2aaabb033d20 "pthread_timer_disable_continuous", line=240,
    var=0x2aaabb0336f5 "timer") at astobj2.c:115
https://issues.asterisk.org/view.php?id=1 0x00002aaabb0309ce in
pthread_timer_disable_continuous (handle=1218)
    at res_timing_pthread.c:240
https://issues.asterisk.org/view.php?id=2 0x0000000000470edd in __ast_read
(chan=0xbd0eab0, dropaudio=0)
    at channel.c:2693

and find_timer() ought to have matched the following entry:

(gdb) print{struct pthread_timer}0x13013208
$105 = {pipe = {1218, 1219}, state = TIMER_STATE_IDLE, rate = 0, interval
= 0,
  tick_count = 0, pending_ticks = 0, start = {tv_sec = 0, tv_usec = 0},
  continuous = 0}

This however looks valid, so I still don't know why the comparison returns
low values with a single bit set (so far I've seen 0x01, 0x04, and 0x80)
instead of a valid memory address. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-12-04 00:04 paul-tg        Note Added: 0114711                          
======================================================================