[asterisk-bugs] [Asterisk 0016196]: Core dump in audio_audiohook_write_list

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16196 
====================================================================== 
Reported By:                atis
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   16196
Category:                   Core/General
Reproducibility:            sometimes
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:           SVN 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.1 
SVN Revision (number only!): 228147 
Request Review:              
====================================================================== 
Date Submitted:             2009-11-06 08:47 CST
Last Modified:              2009-11-06 09:30 CST
====================================================================== 
Summary:                    Core dump in audio_audiohook_write_list
Description: 
This crash was introduced somewhere between 1.6.1.6 and r228147. I can
reproduce it quite easily while running automated tests.

# 0  0x0000000000446613 in audio_audiohook_write_list
(chan=0x2aaac415ae68, audiohook_list=0x2aaaac2a0728,
direction=AST_AUDIOHOOK_DIRECTION_WRITE, frame=0x2aaaac455658) at
/usr/dist/asterisk-svn-1.6.1-latest-vanilla/include/asterisk/util
s.h:270
# 1  0x0000000000446a7e in ast_audiohook_write_list (chan=0x2aaac415ae68,
audiohook_list=0x2aaaac2a0728, direction=AST_AUDIOHOOK_DIRECTION_WRITE,
frame=0x2aaaac455658) at audiohook.c:704
# 2  0x00000000004608d5 in ast_write (chan=0x2aaac415ae68, fr=0x2411e40)
at channel.c:3472
# 3  0x0000000000466055 in ast_generic_bridge (c0=0x2aaac4359818,
c1=0x2aaac415ae68, config=0x429a07b0, fo=0x4299eb38, rc=0x4299eb30,
bridge_end={tv_sec = 0, tv_usec = 0}) at channel.c:4855
# 4  0x0000000000467e9e in ast_channel_bridge (c0=0x2aaac4359818,
c1=0x2aaac415ae68, config=0x429a07b0, fo=0x4299eb38, rc=0x4299eb30) at
channel.c:5194
# 5  0x000000000049cfeb in ast_bridge_call (chan=0x2aaac4359818,
peer=0x2aaac415ae68, config=0x429a07b0) at features.c:2544
# 6  0x00002aaabc84171f in try_calling (qe=0x429a0e60, options=0x429a0db7
"", announceoverride=0x429a0db9 "", url=0x429a0db8 "", tries=0x429a1084,
noption=0x429a1080, agi=0x0, macro=0x0, gosub=0x0, ringing=0) at
app_queue.c:4058
# 7  0x00002aaabc8459cd in queue_exec (chan=0x2aaac4359818,
data=0x429a12d0) at app_queue.c:4998

====================================================================== 

---------------------------------------------------------------------- 
 (0113292) atis (reporter) - 2009-11-06 09:30
 https://issues.asterisk.org/view.php?id=16196#c113292 
---------------------------------------------------------------------- 
I'm using Queue, Local channels (with state_interface), LOCK, GROUP, Dial
(with gosub on answer), Monitor and ChanSpy.

It's automated test system so, I have no idea for exact steps, however the
last log lines before crash shows that it could be related to ChanSpy and
Queue

[2009-11-06 16:49:00.0762] DEBUG[2301] chan_sip.c: SIP answering channel:
SIP/inbound-test-80-00000189
[2009-11-06 16:49:00.0763] DEBUG[2301] chan_sip.c: Setting framing from
config on incoming call
[2009-11-06 16:49:00.0763] DEBUG[2301] chan_sip.c: ** Our capability: 0x4
(ulaw) Video flag: True Text flag: True
[2009-11-06 16:49:00.0764] DEBUG[2301] chan_sip.c: ** Our prefcodec: 0x0
(nothing)
[2009-11-06 16:49:00.0764] DEBUG[2301] chan_sip.c: Trying to put 'SIP/2.0
200' onto UDP socket destined for 192.168.1.80:5060
[2009-11-06 16:49:00.0773] DEBUG[28273] chan_sip.c: Stopping
retransmission on '0938ab6846b8e1577acd409303fbf4f8 at 192.168.1.80' of
Response 102: Match Found
[2009-11-06 16:49:00.2328] DEBUG[32608] app_queue.c: There is 1 available
member.
[2009-11-06 16:49:00.2329] DEBUG[32608] app_queue.c: It's not our turn
(SIP/inbound-test-80-0000010e).
[2009-11-06 16:49:00.2330] DEBUG[2116] rtp.c: Got RTCP report of 64 bytes
[2009-11-06 16:49:00.2828] DEBUG[32447] app_queue.c: There is 1 available
member.
[2009-11-06 16:49:00.2829] DEBUG[32447] app_queue.c: It's not our turn
(SIP/inbound-test-80-00000106).
[2009-11-06 16:49:00.3068] DEBUG[1904] app_queue.c: There is 1 available
member.
[2009-11-06 16:49:00.3068] DEBUG[1904] app_queue.c: It's not our turn
(SIP/inbound-test-80-00000173).
[2009-11-06 16:49:00.3230] DEBUG[2170] channel.c: Set channel
SIP/22237-00000181 to write format slin
[2009-11-06 16:49:00.3231] VERBOSE[2170] app_chanspy.c:   == Spying on
channel SIP/22219-000000e9
[2009-11-06 16:49:00.3231] NOTICE[2170] app_chanspy.c: Attaching
SIP/22237-00000181 to SIP/22219-000000e9
[2009-11-06 16:49:00.3231] NOTICE[2170] app_chanspy.c: Attaching
SIP/22237-00000181 to SIP/22219-000000e9
[2009-11-06 16:49:00.3231] NOTICE[2170] app_chanspy.c: Attaching
SIP/22237-00000181 to SIP/inbound-test-80-00000090
[2009-11-06 16:49:00.3428] DEBUG[32524] app_queue.c: There is 1 available
member.
[2009-11-06 16:49:00.3428] DEBUG[32524] app_queue.c: It's not our turn
(SIP/inbound-test-80-0000010b). 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-11-06 09:30 atis           Note Added: 0113292                          
======================================================================