Re: lib/54017: jemalloc deadlock?

[Thomas Klausner <wiz%NetBSD.org@localhost>]

The following reply was made to PR lib/54017; it has been noted by GNATS.

From: Thomas Klausner <wiz%NetBSD.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: lib/54017: jemalloc deadlock?
Date: Mon, 11 Mar 2019 23:33:42 +0100

 I can confirm that thunderbird and firefox built fine for me.
 
 I see a new problem with a libc from today, a repeatable pbulk-scan
 core dump that did not happen before the userland update. pbulk-scan
 binary was from 2017, though I've just rebuilt it to get symbols.
 
 # /usr/pkg_bulk/bin/bulkbuild
 Warning: All log files of the previous pbulk run will be
 removed in 5 seconds. If you want to abort, press Ctrl-C.
 Removing old scan results
 Scanning...
 .................................................. 50/211
 .................................................. 100/211
 .................................................. 150/211
 .................................................. 200/211
 ...........[1]   Segmentation fault (core dumped) ${pscan} -v -l -I ${pscan_start_script} -m ${m...
 # gdb /usr/pkg_bulk/bin/pbulk-scan pbulk-scan.core  
 GNU gdb (GDB) 8.0.1
 Copyright (C) 2017 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 This is free software: you are free to change and redistribute it.
 There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
 and "show warranty" for details.
 This GDB was configured as "x86_64--netbsd".
 Type "show configuration" for configuration details.
 For bug reporting instructions, please see:
 <http://www.gnu.org/software/gdb/bugs/>.
 Find the GDB manual and other documentation resources online at:
 <http://www.gnu.org/software/gdb/documentation/>.
 For help, type "help".
 Type "apropos word" to search for commands related to "word"...
 Reading symbols from /usr/pkg_bulk/bin/pbulk-scan...done.
 [New process 1]
 Core was generated by `pbulk-scan'.
 Program terminated with signal SIGSEGV, Segmentation fault.
 #0  0x000000004d804c5b in event_dispatch () at event.c:348
 
 warning: Source file is more recent than executable.
 348                         iter < last_iter && ev && (next = LIST_NEXT(ev, ev_link), 1);
 (gdb) bt
 #0  0x000000004d804c5b in event_dispatch () at event.c:348
 #1  0x000000004d80354b in master_mode (master_port=0x7f7fff20542f "192.168.0.33:2001", 
     start_script=0x7f7fff2053fe "/usr/pkg_bulk/libexec/pbulk/scan-client-start") at master.c:284
 #2  0x000000004d805468 in main (argc=2, argv=0x7f7fff204d88) at pscan.c:155
 (gdb) l
 343             if (ret == 0 && timeout == 0)
 344                     return;
 345             if (ret > 0) {
 346                     iter = poll_list;
 347                     for (ev = LIST_FIRST(&all_events);
 348                         iter < last_iter && ev && (next = LIST_NEXT(ev, ev_link), 1);
 349                         ev = next, ++iter) {
 350                             if (iter->revents) {
 351                                     if (!ev->ev_persistent) {
 352                                             --active_events;
 (gdb) p poll_list
 $16 = (struct pollfd *) 0x788c70bc3000
 (gdb) p iter
 $10 = (struct pollfd *) 0x788c70bc3010
 (gdb) p last_iter
 $9 = (struct pollfd *) 0x788c70bc3018
 (gdb) p ev
 $11 = (struct event *) 0x5a5a5a5a5a5a5a5a
 (gdb) p all_events
 $14 = {lh_first = 0x788c70ba70d8}
 (gdb) p &all_events
 $15 = (struct {...} *) 0x4db871b0 <all_events>
 (gdb) p *all_events.lh_first
 $18 = {ev_link = {le_next = 0x788c70ba7198, le_prev = 0x4db871b0 <all_events>}, ev_fd = 8, ev_write = 1, ev_persistent = 0,
   ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba70c0}
 (gdb) p *all_events.lh_first.ev_link.le_next
 $19 = {ev_link = {le_next = 0x788c70ba7018, le_prev = 0x788c70ba70d8}, ev_fd = 7, ev_write = 1, ev_persistent = 0,
   ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7180}
 (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next
 $20 = {ev_link = {le_next = 0x788c70ba7078, le_prev = 0x788c70ba7198}, ev_fd = 9, ev_write = 1, ev_persistent = 0,
   ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7000}
 (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next.ev_link.le_next
 $21 = {ev_link = {le_next = 0x4db87160 <signal_event>, le_prev = 0x788c70ba7018}, ev_fd = 10, ev_write = 1, ev_persistent = 0,
   ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7060}
 (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next.ev_link.le_next.ev_link.le_next
 $22 = {ev_link = {le_next = 0x0, le_prev = 0x788c70ba7078}, ev_fd = 4, ev_write = 0, ev_persistent = 1, ev_handler = 0x4d804430 <signal_read_handler>,
   ev_arg = 0x0}
 
 ev looks strange. Is that some poisoning?
  Thomas