[asterisk-dev] Segfault Asterisk pj_atomic_dec_and_get in res_pjsip_pubsub

[Ross Beer]

Hi All,


The database issues appear to be resolved in the latest 13 branch which is fantastic! Thank you all for your efforts.


I'm now facing another issue which could be related to PJSIP or Asterisk. It looks like an issue with Presence. Here is a snippet of the backtrace:


Program terminated with signal SIGSEGV, Segmentation fault.

#0  pj_atomic_dec_and_get (atomic_var=0x200000002) at ../src/pj/os_core_unix.c:962

962    pj_mutex_lock( atomic_var->mutex );

[Current thread is 1 (Thread 0x7f3120987700 (LWP 31576))]

#0  0x00007f31b4c26b29 in pj_atomic_dec_and_get (atomic_var=0x200000002) at ../src/pj/os_core_unix.c:962

        new_value = <optimized out>

#1  0x00007f31b4c2b89d in pj_grp_lock_dec_ref (glock=0x7f3169033008) at ../src/pj/lock.c:554

        cnt = <optimized out>

#2  0x00007f31b4c2b89d in pj_grp_lock_dec_ref (glock=0x7f3169033008) at ../src/pj/lock.c:631

#3  0x00007f31b69a5629 in evsub_destroy (sub=sub at entry=0x7f31600ffb68) at ../src/pjsip-simple/evsub.c:574

        dlgsub_head = <optimized out>

        dlgsub = <optimized out>

#4  0x00007f31b69a57b8 in set_state (sub=sub at entry=0x7f31600ffb68, state=PJSIP_EVSUB_STATE_TERMINATED, state_str=<optimized out>, event=0x7f3120986ab0, event at entry=0x0, reason=reason at entry=0x0) at ../src/pjsip-simple/evsub.c:622

        prev_state = PJSIP_EVSUB_STATE_ACTIVE

        dummy_event = {prev = 0x7f311c9567e8, next = 0x0, type = PJSIP_EVENT_USER, body = {timer = {entry = 0x0}, tsx_state = {src = {rdata = 0x0, tdata = 0x0, timer = 0x0, status = 0, data = 0x0}, tsx = 0x0, prev_state = 0, type = PJSIP_EVENT_UNKNOWN}, tx_msg = {tdata = 0x0}, tx_error = {tdata = 0x0, tsx = 0x0}, rx_msg = {rdata = 0x0}, user = {user1 = 0x0, user2 = 0x0, user3 = 0x0, user4 = 0x0}}}

#5  0x00007f31b69a74d7 in pjsip_evsub_send_request (sub=0x7f31600ffb68, tdata=tdata at entry=0x7f311c9567e8) at ../src/pjsip-simple/evsub.c:1378

        status = 0

#6  0x00007f314e52c086 in internal_pjsip_evsub_send_request (sub_tree=sub_tree at entry=0x7f3160077608, tdata=tdata at entry=0x7f311c9567e8) at res_pjsip_pubsub.c:1581

        selector = {type = PJSIP_TPSELECTOR_NONE, u = {transport = 0x0, listener = 0x0, ptr = 0x0}}

#7  0x00007f314e532afc in send_notify (tdata=<optimized out>, sub_tree=0x7f3160077608) at res_pjsip_pubsub.c:1727

        res = <optimized out>

        evsub = <optimized out>

        tdata = 0x7f311c9567e8

#8  0x00007f314e532afc in send_notify (sub_tree=sub_tree at entry=0x7f3160077608, force_full_state=force_full_state at entry=1) at res_pjsip_pubsub.c:2179

        evsub = <optimized out>

        tdata = 0x7f311c9567e8

#9  0x00007f314e532c02 in serialized_pubsub_on_server_timeout (userdata=0x7f3160077608) at res_pjsip_pubsub.c:3264

        sub_tree = 0x7f3160077608

        dlg = 0x7f317811feb8

#10 0x00000000005ea3c3 in ast_taskprocessor_execute (tps=0x7f31601d9ab8) at taskprocessor.c:850

        local = {local_data = 0x7f3120987700, data = 0x5f11a2 <ast_threadstorage_set_ptr+60>}

        t = 0x7f3175582430

        size = 1

        __PRETTY_FUNCTION__ = "ast_taskprocessor_execute"

#11 0x00000000005f35d4 in execute_tasks (data=0x7f31601d9ab8) at threadpool.c:1322

        tps = 0x7f31601d9ab8

#12 0x00000000005ea3c3 in ast_taskprocessor_execute (tps=0x1e23998) at taskprocessor.c:850

        local = {local_data = 0x7f3120986c80, data = 0x1e22330}

        t = 0x7f31b00067f0

        size = 31597416

        __PRETTY_FUNCTION__ = "ast_taskprocessor_execute"

#13 0x00000000005f1889 in threadpool_execute (pool=0x1e22388) at threadpool.c:351

        __PRETTY_FUNCTION__ = "threadpool_execute"

#14 0x00000000005f2f40 in worker_active (worker=0x7f31c0009cd8) at threadpool.c:1105

        alive = 1

#15 0x00000000005f2cf8 in worker_start (arg=0x7f31c0009cd8) at threadpool.c:1024

        worker = 0x7f31c0009cd8

        saved_state = (ZOMBIE | unknown: 32560)

        __PRETTY_FUNCTION__ = "worker_start"

#16 0x00000000005ff1d1 in dummy_start (data=0x7f31c00011c0) at utils.c:1235

        __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {0, 2796589904138404041, 139851786295935, 139848976987904, 507904, 507904, 2796589904146792649, -2833544559795568439}, __mask_was_saved = 0}}, __pad = {0x7f3120986df0, 0x0, 0x7f3120987b68, 0x7f31d2898438 <__pthread_keys+344>}}

        __cancel_routine = 0x451ba8 <ast_unregister_thread>

        __cancel_arg = 0x7f3120987700

        __not_first_call = 0

        ret = 0x7f31d1c778d8

        a = {start_routine = 0x5f2c71 <worker_start>, data = 0x7f31c0009cd8, name = 0x7f31c0008480 "worker_start         started at [ 1079] threadpool.c worker_thread_start()"}

#17 0x00007f31d268661a in start_thread () at /lib64/libpthread.so.0

#18 0x00007f31d19c259d in clone () at /lib64/libc.so.6


>From Gerrit I notice  that Richard Mudgett has a change to related to presence, and wondered if this commit would resolve the above issue?


Kind regards,

Ross

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20160609/019a6dc6/attachment-0001.html>