Hello

I dont know if this is helps you

(gdb) frame 0
#0 apr_palloc (pool=0x80f505028, in_size=Variable "in_size" is not available.
) at memory/unix/apr_pools.c:252
252     in memory/unix/apr_pools.c
(gdb) list
247     in memory/unix/apr_pools.c
(gdb) list -
237     in memory/unix/apr_pools.c
(gdb) list -
227     in memory/unix/apr_pools.c
(gdb) list -
217     in memory/unix/apr_pools.c
(gdb) list -
207     in memory/unix/apr_pools.c
(gdb) dump_allocator pool->allocator
Allocator current_free_index = 0, max_free_index = 0
Allocator free list:
 # 1: Cannot access memory at address 0x85
(gdb)

What is "some frame with request struct"?

Best regards
Michal Kumzak


Dne 26.1.2011 14:29, Marcelo Coelho napsal(a):
Hi,

Please use this .gdbinit and try these commands:

frame 0
list
list -
list -
list -
list -
dump_allocator pool->allocator

frame (some frame with request struct)
dump_request r
dump_table r->headers_in

Let's try to extract some information from your core dump.

Here is the file:

--------- .gdbinit file -----------


# gdb macros which may be useful for folks using gdb to debug
# apache.  Delete it if it bothers you.

define dump_table
     set $t = (apr_table_entry_t *)((apr_array_header_t *)$arg0)->elts
     set $n = ((apr_array_header_t *)$arg0)->nelts
     set $i = 0
     while $i<  $n
        if $t[$i].val == (void *)0L
           printf "[%u] '%s'=>NULL\n", $i, $t[$i].key
        else
           printf "[%u] '%s'='%s' [%p]\n", $i, $t[$i].key, $t[$i].val, 
$t[$i].val
        end
        set $i = $i + 1
     end
end
document dump_table
     Print the key/value pairs in a table.
end

define dump_string_hash
     set $h = $arg0->array
     set $n = $arg0->max
     set $i = 0
     while $i<  $n
         set $ent = $h[$i]
         while $ent != (void *)0L
             printf "'%s' =>  '%p'\n", $ent->key, $ent->val
             set $ent = $ent->next
         end
        set $i = $i + 1
     end
end
document dump_string_hash
     Print the entries in a hash table indexed by strings
end

define dump_string_shash
     set $h = $arg0->array
     set $n = $arg0->max
     set $i = 0
     while $i<  $n
         set $ent = $h[$i]
         while $ent != (void *)0L
             printf "'%s' =>  '%s'\n", $ent->key, $ent->val
             set $ent = $ent->next
         end
        set $i = $i + 1
     end
end
document dump_string_shash
     Print the entries in a hash table indexed by strings with string values
end

define ro
        run -DONE_PROCESS
end

define dump_string_array
     set $a = (char **)((apr_array_header_t *)$arg0)->elts
     set $n = (int)((apr_array_header_t *)$arg0)->nelts
     set $i = 0
     while $i<  $n
        printf "[%u] '%s'\n", $i, $a[$i]
        set $i = $i + 1
     end
end
document dump_string_array
     Print all of the elements in an array of strings.
end

define printmemn
     set $i = 0
     while $i<  $arg1
         if $arg0[$i]<  0x20 || $arg0[$i]>  0x7e
             printf "~"
         else
             printf "%c", $arg0[$i]
         end
         set $i = $i + 1
     end
end

define print_bkt_datacol
     # arg0 == column name
     # arg1 == format
     # arg2 == value
     # arg3 == suppress header?
     set $suppressheader = $arg3

     if !$suppressheader
         printf " "
         printf $arg0
         printf "="
     else
         printf " | "
     end
     printf $arg1, $arg2
end

define dump_bucket_ex
     # arg0 == bucket
     # arg1 == suppress header?
     set $bucket = (struct apr_bucket *)$arg0
     set $sh = $arg1
     set $refcount = -1

     print_bkt_datacol "bucket" "%-9s" $bucket->type->name $sh
     printf "(0x%08lx)", (unsigned long)$bucket
     print_bkt_datacol "length" "%-6ld" (long)($bucket->length) $sh
     print_bkt_datacol "data" "0x%08lx" $bucket->data $sh

     if !$sh
         printf "\n    "
     end

     if (($bucket->type ==&apr_bucket_type_eos)   || \
         ($bucket->type ==&apr_bucket_type_flush))

         # metadata buckets, no content
         print_bkt_datacol "contents" "%c" ' ' $sh
         printf "                     "
         print_bkt_datacol "rc" "n/%c" 'a' $sh

     else
     if ($bucket->type ==&ap_bucket_type_error)

         # metadata bucket, no content but it does have an error code in it
         print_bkt_datacol "contents" "%c" ' ' $sh
         set $status = ((ap_bucket_error *)$bucket->data)->status
         printf " (status=%3d)        ", $status
         print_bkt_datacol "rc" "n/%c" 'a' $sh

     else
     if (($bucket->type ==&apr_bucket_type_file) || \
         ($bucket->type ==&apr_bucket_type_pipe) || \
         ($bucket->type ==&apr_bucket_type_socket))

         # buckets that contain data not in memory (ie not printable)

         print_bkt_datacol "contents" "[**unprintable**%c" ']' $sh
         printf "     "
         if $bucket->type ==&apr_bucket_type_file
             set $refcount = ((apr_bucket_refcount *)$bucket->data)->refcount
             print_bkt_datacol "rc" "%d" $refcount $sh
         end

     else
     if (($bucket->type ==&apr_bucket_type_heap)      || \
         ($bucket->type ==&apr_bucket_type_pool)      || \
         ($bucket->type ==&apr_bucket_type_mmap)      || \
         ($bucket->type ==&apr_bucket_type_transient) || \
         ($bucket->type ==&apr_bucket_type_immortal))

         # in-memory buckets

         if $bucket->type ==&apr_bucket_type_heap
             set $refcount = ((apr_bucket_refcount *)$bucket->data)->refcount
             set $p = (apr_bucket_heap *)$bucket->data
             set $data = $p->base+$bucket->start

         else
         if $bucket->type ==&apr_bucket_type_pool
             set $refcount = ((apr_bucket_refcount *)$bucket->data)->refcount
             set $p = (apr_bucket_pool *)$bucket->data
             if !$p->pool
                 set $p = (apr_bucket_heap *)$bucket->data
             end
             set $data = $p->base+$bucket->start

         else
         if $bucket->type ==&apr_bucket_type_mmap
             # is this safe if not APR_HAS_MMAP?
             set $refcount = ((apr_bucket_refcount *)$bucket->data)->refcount
             set $p = (apr_bucket_mmap *)$bucket->data
             set $data = ((char *)$p->mmap->mm)+$bucket->start

         else
         if (($bucket->type ==&apr_bucket_type_transient) || \
             ($bucket->type ==&apr_bucket_type_immortal))
             set $data = ((char *)$bucket->data)+$bucket->start

         end
         end
         end
         end

         if $sh
             printf " | ["
         else
             printf " contents=["
         end
         set $datalen = $bucket->length
         if $datalen>  17
             printmem $data 17
             printf "..."
             set $datalen = 20
         else
             printmemn $data $datalen
         end
         printf "]"
         while $datalen<  20
             printf " "
             set $datalen = $datalen + 1
         end

         if $refcount != -1
             print_bkt_datacol "rc" "%d" $refcount $sh
         else
             print_bkt_datacol "rc" "n/%c" 'a' $sh
         end

     else
         # 3rd-party bucket type
         print_bkt_datacol "contents" "[**unknown**%c" ']' $sh
         printf "         "
         print_bkt_datacol "rc" "n/%c" 'a' $sh
     end
     end
     end
     end

     printf "\n"

end

define dump_bucket
     dump_bucket_ex $arg0 0
end
document dump_bucket
     Print bucket info
end

define dump_brigade
     set $bb = (apr_bucket_brigade *)$arg0
     set $bucket = $bb->list.next
     set $sentinel = ((char *)((&($bb->list)) \
                                - ((size_t)&((struct apr_bucket *)0)->link)))
     printf "dump of brigade 0x%lx\n", (unsigned long)$bb

     printf "   | type     (address)    | length | "
     printf "data addr  | contents               | rc\n"
     printf "----------------------------------------"
     printf "----------------------------------------\n"

     if $bucket == $sentinel
         printf "brigade is empty\n"
     end

     set $j = 0
     while $bucket != $sentinel
         printf "%2d", $j
         dump_bucket_ex $bucket 1
         set $j = $j + 1
         set $bucket = $bucket->link.next
     end
     printf "end of brigade\n"
end
document dump_brigade
     Print bucket brigade info
end

define dump_filters
     set $f = $arg0
     while $f
         printf "%s(0x%lx): ctx=0x%lx, r=0x%lx, c=0x%lx\n", \
         $f->frec->name, (unsigned long)$f, (unsigned long)$f->ctx, \
         $f->r, $f->c
         set $f = $f->next
     end
end
document dump_filters
     Print filter chain info
end

define dump_filter_chain
     set $r = $arg0
     set $f = $r->output_filters
     while $f
         if $f == $r->output_filters
             printf "r->output_filters =>\n"
         end
         if $f == $r->proto_output_filters
             printf "r->proto_output_filters =>\n"
         end
         if $f == $r->connection->output_filters
             printf "r->connection->output_filters =>\n"
         end

         printf "  %s(0x%lx): type=%d, ctx=0x%lx, r=%s(0x%lx), c=0x%lx\n", \
           $f->frec->name, (unsigned long)$f, $f->frec->ftype, (unsigned 
long)$f->ctx, \
           $f->r == $r ? "r" : ($f->r == 0L ? "null" : \
           ($f->r == $r->main ? "r->main" :  \
           ($r->main&&  $f->r == $r->main->main ? "r->main->main" : "????"))), \
           $f->r, $f->c

         set $f = $f->next
     end
end
document dump_filter_chain
     Print filter chain info given a request_rec pointer
end

define dump_process_rec
     set $p = $arg0
     printf "process_rec=0x%lx:\n", (unsigned long)$p
     printf "   pool=0x%lx, pconf=0x%lx\n", \
            (unsigned long)$p->pool, (unsigned long)$p->pconf
end
document dump_process_rec
     Print process_rec info
end

define dump_server_rec
     set $s = $arg0
     printf "name=%s:%d\n", \
             $s->server_hostname, $s->port
     dump_process_rec($s->process)
end
document dump_server_rec
     Print server_rec info
end

define dump_servers
     set $s = $arg0
     while $s
         dump_server_rec($s)
         printf "\n"
         set $s = $s->next
     end
end
document dump_servers
     Print server_rec list info
end

define dump_allocator
     printf "Allocator current_free_index = %d, max_free_index = %d\n", \
             ($arg0)->current_free_index, ($arg0)->max_free_index
     printf "Allocator free list:\n"
     set $i = 0
     set $max =(sizeof $arg0->free)/(sizeof $arg0->free[0])
     while $i<  $max
         set $node = $arg0->free[$i]
         if $node != 0
             printf " #%2d: ", $i
             while $node != 0
                 printf "%d, ", $node->endp - $node->first_avail
                 set $node = $node->next
             end
             printf "ends.\n"
         end
         set $i = $i + 1
     end
end
document dump_allocator
     Print status of an allocator and its freelists.
end

define dump_conn
     set $c = $arg0
     print "[conn_rec dump]\n"
end

define dump_request
     set $r = $arg0
     printf "[request_rec dump]\n"
     if $r->the_request != 0x0
         printf "r->the_request      = '%s'\n", $r->the_request
     end
     printf "r->proxyreq         = %u\n", $r->proxyreq
     printf "r->header_only      = %u\n", $r->header_only
     if $r->protocol != 0x0
         printf "r->protocol         = '%s'\n", $r->protocol
     end
     printf "r->proto_num        = %u\n", $r->proto_num
     if $r->hostname != 0x0
         printf "r->hostname         = '%s'\n", $r->hostname
     end
     printf "r->request_time     = %u\n", $r->request_time
     if $r->status_line != 0x0
         printf "r->startus_line     = '%s'\n", $r->status_line
     end
     printf "r->status           = %u\n", $r->status
     if $r->method != 0x0
         printf "r->method           = '%s'\n", $r->method
     end
     printf "r->method_number    = %u\n", $r->method_number
     printf "r->allowed          = %u\n", $r->allowed
     printf "r->sent_bodyct      = %u\n", $r->sent_bodyct
     printf "r->bytes_sent       = %u\n", $r->bytes_sent
     printf "r->mtime            = %u\n", $r->mtime
     printf "r->chunked          = %u\n", $r->chunked
     printf "r->byterange        = %u\n", $r->byterange
     if $r->boundary != 0x0
         printf "r->boundary         = '%s'\n", $r->boundary
     end
     if $r->range != 0x0
         printf "r->range            = '%s'\n", $r->range
     end
     printf "r->clength          = %u\n", $r->clength
     printf "r->remaining        = %u\n", $r->remaining
     printf "r->read_length      = %u\n", $r->read_length
     printf "r->read_body        = %u\n", $r->read_body
     printf "r->read_chunked     = %u\n", $r->read_chunked
     printf "r->expecting_100    = %u\n", $r->expecting_100
     if $r->content_type != 0x0
         printf "r->content_type     = '%s'\n", $r->content_type
     end
     if $r->handler != 0x0
         printf "r->handler          = '%s'\n", $r->handler
     end
     if $r->content_encoding != 0x0
         printf "r->content_encoding = '%s'\n", $r->content_encoding
     end
     if $r->content_language != 0x0
         printf "r->content_language = '%s'\n", $r->content_language
     end
     if $r->vlist_validator != 0x0
         printf "r->vlist_validator  = '%s'\n", $r->vlist_validator
     end
     printf "r->no_cache         = %u\n", $r->no_cache
     printf "r->no_local_copy    = %u\n", $r->no_local_copy
     if $r->unparsed_uri != 0x0
         printf "r->unparsed_uri     = '%s'\n", $r->unparsed_uri
     end
     if $r->uri != 0x0
         printf "r->uri              = '%s'\n", $r->uri
     end
     if $r->filename != 0x0
         printf "r->filename         = '%s'\n", $r->filename
     end
     if $r->path_info != 0x0
         printf "r->path_info        = '%s'\n", $r->path_info
     end
     if $r->args != 0x0
         printf "r->args             = '%s'\n", $r->args
     end
end

# Set sane defaults for common signals:
handle SIGPIPE noprint pass nostop
handle SIGUSR1 print pass nostop


------------------------------


On Jan 26, 2011, at 11:13 AM, Michal Kumžák wrote:

Hello

I applied patch for Apr-1.4.2 port, but segfault appear again.

[Wed Jan 26 13:48:05 2011] [notice] child pid 70619 exit signal Segmentation 
fault (11), possible coredump in /tmp

(gdb) bt full
#0  apr_palloc (pool=0x80f505028, in_size=Variable "in_size" is not available.
) at memory/unix/apr_pools.c:252
        active = (apr_memnode_t *) 0x80f507000
        node = (apr_memnode_t *) 0x65
        mem = Variable "mem" is not available.
(gdb)

Best regards
Michal Kumzak

Dne 26.1.2011 1:39, Marcelo Coelho napsal(a):
Hello,

Many users reported backtraces like this:

(gdb) bt full
#0  apr_palloc (pool=0x80f6a1028, in_size=Variable "in_size" is not
available.
) at memory/unix/apr_pools.c:252
          active = (apr_memnode_t *) 0x80f6a1000
          node = (apr_memnode_t *) 0x6f
          mem = Variable "mem" is not available.

Maybe this isn't a peruser bug, but an APR bug. We can try use this patch to 
fix this problem.

Description: http://svn.apache.org/viewvc?view=revision&revision=990435

Patch: 
http://svn.apache.org/viewvc/apr/apr/trunk/memory/unix/apr_pools.c?r1=990435&r2=990434&pathrev=990435&view=patch

--
Marcelo Coelho
marcelo at mco2.com.br


_______________________________________________
Peruser mailing list
[email protected]
http://www.telana.com/mailman/listinfo/peruser
_______________________________________________
Peruser mailing list
[email protected]
http://www.telana.com/mailman/listinfo/peruser

_______________________________________________
Peruser mailing list
[email protected]
http://www.telana.com/mailman/listinfo/peruser
_______________________________________________
Peruser mailing list
[email protected]
http://www.telana.com/mailman/listinfo/peruser

Reply via email to