shinrich commented on pull request #7845:
URL: https://github.com/apache/trafficserver/pull/7845#issuecomment-871758818
After fixing the use-after-free, we get this crash after a few minutes.
Which at first glance doesn't seem to have anything to do with http2, but the
ua_txn is an Http2Stream and ua_txn->_proxy_ssn->_vc is null. So the assert
that is trying to catch responses showing up on the wrong thread triggers.
```
(gdb) bt
#0 0x00002b0fea1e63d7 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:55
#1 0x00002b0fea1e7ac8 in __GI_abort () at abort.c:90
#2 0x00002b0fe798132c in ink_abort
(message_format=message_format@entry=0x2b0fe79ff2a0 "%s:%d: failed assertion
`%s`") at ../../../../../../_scm/trafficserver9.1/src/tscore/ink_error.cc:99
#3 0x00002b0fe797a1d2 in _ink_assert (expression=expression@entry=0x104c460
"vc && vc->thread == this_ethread()", file=file@entry=0x1046ac0
"../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc",
line=line@entry=2543) at
../../../../../../_scm/trafficserver9.1/src/tscore/ink_assert.cc:37
#4 0x000000000083a8b9 in HttpSM::state_cache_open_write(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:2543
#5 0x0000000000835a1d in HttpSM::main_handler(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:2745
#6 0x000000000095166d in handleEvent (data=0x6250050f1f10, event=1108,
this=0x6250050f0100)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:219
#7 handleEvent (data=0x6250050f1f10, event=1108, this=0x6250050f0100)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:215
#8 HttpCacheSM::state_cache_open_write(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpCacheSM.cc:180
#9 0x0000000000caac8a in handleEvent (data=0x619000d9ad80, event=1108,
this=0x6250050f1ea8)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:219
#10 handleEvent (data=0x619000d9ad80, event=1108, this=0x6250050f1ea8)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:215
#11 CacheVC::callcont (this=0x619000d9ad80, event=1108) at
../../../../../../_scm/trafficserver9.1/iocore/cache/P_CacheInternal.h:639
#12 0x0000000000ccd263 in CacheVC::openWriteStartDone(int, Event*) () at
../../../../../../_scm/trafficserver9.1/iocore/cache/CacheWrite.cc:1597
#13 0x0000000000ccf147 in Cache::open_write(Continuation*, ats::CryptoHash
const*, HTTPInfo*, long, ats::CryptoHash const*, CacheFragType, char const*,
int) ()
at
../../../../../../_scm/trafficserver9.1/iocore/cache/CacheWrite.cc:1838
#14 0x0000000000c1382c in CacheProcessor::open_write (this=<optimized out>,
cont=cont@entry=0x6250050f1ea8, expected_size=expected_size@entry=0,
key=key@entry=0x2b0ff45d13c0,
request=request@entry=0x6250050f08a8, old_info=<optimized out>,
pin_in_cache=0, type=CACHE_FRAG_TYPE_HTTP) at
../../../../../../_scm/trafficserver9.1/iocore/cache/Cache.cc:3251
#15 0x0000000000950593 in HttpCacheSM::open_write
(this=this@entry=0x6250050f1ea8, key=key@entry=0x2b0ff45d13c0,
url=url@entry=0x6250050f0238, request=request@entry=0x6250050f08a8,
old_info=old_info@entry=0x0,
pin_in_cache=<optimized out>, retry=true, allow_multiple=false) at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpCacheSM.cc:373
#16 0x00000000007f3fd3 in HttpSM::do_cache_prepare_action(HttpCacheSM*,
HTTPInfo*, bool, bool) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:4843
#17 0x000000000084f9c3 in do_cache_prepare_write (this=0x6250050f0100) at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:4773
#18 HttpSM::set_next_state() () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:7689
#19 0x000000000082cf35 in HttpSM::state_api_callout(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:1640
#20 0x0000000000838306 in HttpSM::state_api_callback(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:1447
#21 0x00000000006fbf77 in TSHttpTxnReenable () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:6283
#22 0x00002b1032bace9b in ?? ()
#23 0x0000000000000026 in ?? ()
#24 0x00006190008f6b99 in ?? ()
#25 0x000060c000c9d780 in ?? ()
#26 0x00002b0ff45d1d30 in ?? ()
#27 0x00002b0ff45d1cd0 in ?? ()
#28 0x00006250050f0100 in ?? ()
#29 0x0000000041b58ab3 in ?? ()
#30 0x00002b1032bc54e0 in ?? ()
#31 0x00002b1032bacc70 in ?? ()
#32 0x000000000104e700 in ?? ()
#33 0x00002b0f00000000 in ?? ()
#34 0x00002b0fe799c8cc in StrList::_new_cell (this=0x561fe8ba39a,
s=0x2b0ff45d1cd0 "\263\212\265A", len_not_counting_nul=19090144) at
../../../../../../_scm/trafficserver9.1/src/tscore/ink_string++.cc:87
#35 0x00000000006bb327 in INKContInternal::handle_event(int, void*) () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:1137
#36 0x00000000006f3ab3 in handleEvent (data=0x6250050f0100, event=60015,
this=<optimized out>)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:219
#37 handleEvent (data=0x6250050f0100, event=60015, this=<optimized out>)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:215
#38 APIHook::invoke(int, void*) const () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:1374
#39 0x000000000082bb11 in HttpSM::state_api_callout(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:1568
#40 0x0000000000838306 in HttpSM::state_api_callback(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:1447
#41 0x00000000006fbf77 in TSHttpTxnReenable () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:6283
---Type <return> to continue, or q <return> to quit---
#42 0x00002b100c233e3d in main_handler (cont=<optimized out>,
event=<optimized out>, edata=<optimized out>) at
../../../../../_scm/trafficserver9.1/plugins/regex_revalidate/regex_revalidate.c:441
#43 0x00000000006bb327 in INKContInternal::handle_event(int, void*) () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:1137
#44 0x00000000006f3ab3 in handleEvent (data=0x6250050f0100, event=60015,
this=<optimized out>)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:219
#45 handleEvent (data=0x6250050f0100, event=60015, this=<optimized out>)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:215
#46 APIHook::invoke(int, void*) const () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:1374
#47 0x000000000082bb11 in HttpSM::state_api_callout(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:1568
#48 0x0000000000838306 in HttpSM::state_api_callback(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:1447
#49 0x00000000006fbf77 in TSHttpTxnReenable () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:6283
#50 0x00002b10012b7fed in carpLookup(tsapi_cont*, TSEvent, void*) () at
_vcs/carp-9.1/carp/carp.cc:776
#51 0x00000000006bb327 in INKContInternal::handle_event(int, void*) () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:1137
#52 0x00000000006f3ab3 in handleEvent (data=0x6250050f0100, event=60015,
this=<optimized out>)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:219
#53 handleEvent (data=0x6250050f0100, event=60015, this=<optimized out>)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:215
#54 APIHook::invoke(int, void*) const () at
../../../../../_scm/trafficserver9.1/src/traffic_server/InkAPI.cc:1374
#55 0x000000000082bb11 in HttpSM::state_api_callout(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:1568
#56 0x00000000008509fb in HttpSM::set_next_state() () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:7456
#57 0x000000000082cf35 in HttpSM::state_api_callout(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:1640
#58 0x00000000008509fb in HttpSM::set_next_state() () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:7456
#59 0x0000000000833c9c in HttpSM::state_cache_open_read(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:2683
#60 0x0000000000835a1d in HttpSM::main_handler(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpSM.cc:2745
#61 0x000000000094f996 in handleEvent (data=0x6250050f1f10, event=1102,
this=0x6250050f0100)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:219
#62 handleEvent (data=0x6250050f1f10, event=1102, this=0x6250050f0100)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:215
#63 HttpCacheSM::state_cache_open_read(int, void*) () at
../../../../../../_scm/trafficserver9.1/proxy/http/HttpCacheSM.cc:118
#64 0x0000000000caac8a in handleEvent (data=0x619002ed3380, event=1102,
this=0x6250050f1ea8)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:219
#65 handleEvent (data=0x619002ed3380, event=1102, this=0x6250050f1ea8)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:215
#66 CacheVC::callcont (this=this@entry=0x619002ed3380,
event=event@entry=1102) at
../../../../../../_scm/trafficserver9.1/iocore/cache/P_CacheInternal.h:639
#67 0x0000000000c9e3dc in CacheVC::openReadStartHead(int, Event*) () at
../../../../../../_scm/trafficserver9.1/iocore/cache/CacheRead.cc:1246
#68 0x0000000000c2a22e in CacheVC::handleReadDone(int, Event*) () at
../../../../../../_scm/trafficserver9.1/iocore/cache/Cache.cc:2298
#69 0x0000000000c3230b in AIOCallbackInternal::io_complete
(this=0x619002ed3510, event=<optimized out>, data=<optimized out>)
at
/home/shinrich/build-new/_build/build_release_posix-x86_64_gcc_8/trafficserver9.1/build/../../../../_scm/trafficserver9.1/iocore/aio/P_AIO.h:121
#70 0x0000000000fc8e3d in handleEvent (data=0x609000105e30, event=1,
this=<optimized out>) at
../../../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:219
#71 handleEvent (data=0x609000105e30, event=1, this=<optimized out>) at
../../../../../../_scm/trafficserver9.1/iocore/eventsystem/I_Continuation.h:215
#72 EThread::process_event(Event*, int) () at
../../../../../../_scm/trafficserver9.1/iocore/eventsystem/UnixEThread.cc:164
#73 0x0000000000fca215 in EThread::process_queue
(this=this@entry=0x2b0ff0a9c800,
NegativeQueue=NegativeQueue@entry=0x2b0ff45d4460,
ev_count=ev_count@entry=0x2b0ff45d4420,
nq_count=nq_count@entry=0x2b0ff45d43e0) at
../../../../../../_scm/trafficserver9.1/iocore/eventsystem/UnixEThread.cc:199
#74 0x0000000000fcaf36 in EThread::execute_regular
(this=this@entry=0x2b0ff0a9c800) at
../../../../../../_scm/trafficserver9.1/iocore/eventsystem/UnixEThread.cc:259
#75 0x0000000000fcc082 in execute (this=0x2b0ff0a9c800) at
../../../../../../_scm/trafficserver9.1/iocore/eventsystem/UnixEThread.cc:364
#76 EThread::execute (this=0x2b0ff0a9c800) at
../../../../../../_scm/trafficserver9.1/iocore/eventsystem/UnixEThread.cc:342
#77 0x0000000000fc6f86 in spawn_thread_internal (a=0x60600007dae0) at
../../../../../../_scm/trafficserver9.1/iocore/eventsystem/Thread.cc:92
#78 0x00002b0fe936fea5 in start_thread (arg=0x2b0ff45d6700) at
pthread_create.c:307
#79 0x00002b0fea2ae9fd in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:111
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
