https://issues.apache.org/bugzilla/show_bug.cgi?id=51062
--- Comment #6 from Krzysztof Kostałkowicz <[email protected]> 2011-04-15 06:44:09 EDT --- The process loops trying do dispose a corrupted list. Don't ask me where the corruption occurred. Below some output from gdb with my notes. --- apr_brigade_cleanup (data=0x8f5c3d0) at buckets/apr_brigade.c:42 42 while (!APR_BRIGADE_EMPTY(b)) { # *b (gdb) print *((apr_bucket_brigade *)data) $3 = {p = 0x8f5b220, list = {next = 0x8fa9768, prev = 0x8fa9768}, bucket_alloc = 0x8f9f670} # b (gdb) print ((apr_bucket_brigade *)data) $4 = (struct apr_bucket_brigade *) 0x8f5c3d0 # list head (gdb) print ((apr_bucket_brigade *)data)->list $5 = {next = 0x8fa9768, prev = 0x8fa9768} # address of list head (gdb) print &((apr_bucket_brigade *)data)->list $24 = (struct apr_bucket_list *) 0x8f5c3d4 # first element of b (gdb) print (((apr_bucket_brigade *)data)->list)->next $6 = (struct apr_bucket *) 0x8fa9768 # value of first element of b (gdb) print *(((apr_bucket_brigade *)data)->list)->next $7 = {link = {next = 0x8f75c34, prev = 0x8f75c34}, type = 0x16c0e0, length = 4294967295, start = -1, data = 0x8f75608, free = 0x80662f8 <apr_bucket_free@plt>, list = 0x8fa9698} # second element of b (gdb) print (((apr_bucket_brigade *)data)->list)->next->link->next $8 = (struct apr_bucket * volatile) 0x8f75c34 # value of second element of b (gdb) print *(((apr_bucket_brigade *)data)->list)->next->link->next $9 = {link = {next = 0x8f75c34, prev = 0x8f75c34}, type = 0x8fa9698, length = 150427552, start = 6062569827032112, data = 0x8066538, free = 0x8f755c8, list = 0x8f75c54} # sentinel for b (computed with APR_RING_SENTINEL) (gdb) print (struct apr_bucket *)((char *)(&(&((apr_bucket_brigade *)data)->list)->next)) $23 = (struct apr_bucket *) 0x8f5c3d4 # it's not (but should be) possible to reach sentinel of b from b # while loops because the list is not empty # ie. APR_RING_FIRST((hp)) != APR_RING_SENTINEL((hp), elem, link) # apr_bucket_free(void *mem) goes into if_true branch # it does not change the data structure (the assignments do not change anything) # if check_not_already_free(node_header_t *node) was called # it would abort during first loop iteration -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
