bugDotGNU Portable.NET - Bugs: bug #11627, Crash during Garbage collection of...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #11627: Crash during Garbage collection of StreamWriter based on HttpStream

Submitter:  Erich Kitzmüller <ammoq>
Submitted:  Tue 18 Jan 2005 01:37:05 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

Jump to the original submission

Wed 06 Apr 2005 06:31:15 AM UTC, comment #10: 

fixed in cvs

Deryk Robosson <drobosson>
Group Member
Tue 05 Apr 2005 02:55:04 PM UTC, comment #9: 

Maybe a duplicate of bug #12552. Please apply patch #3884 and then run:

./auto_gen.sh
./configure
make clean all
make install (or su -c "make install")

... and then please report whether the crash still happens. Thanks !

(If you then do ./configure --enable-interrupts and the crash is happening again we know for sure that this bug is a duplicate of #12552)

Marc Haisenko <darkdust>
Group Member
Tue 22 Feb 2005 12:35:34 PM UTC, comment #8: 

On my system, it looks different in gdb:

(gdb) run Crash.exe http://10.1.1.11/test.xml
Starting program: /usr/local/bin/ilrun Crash.exe http://10.1.1.11/test.xml
[Thread debugging using libthread_db enabled]
[New Thread 1075769472 (LWP 21281)]
0
1
2
3
4
5

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1075769472 (LWP 21281)]
_ILCVMInterpreter (thread=0x8163d20) at cvm_call.c:934
934                     methodToCall = (GetObjectClassPrivate(tempptr))
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
_ILCVMInterpreter (thread=0x8163d20) at cvm_call.c:934
934                     methodToCall = (GetObjectClassPrivate(tempptr))
(gdb) c
Continuing.
Couldn't get registers: No such process.
(gdb)

Erich Kitzmüller <ammoq>
Tue 22 Feb 2005 08:57:26 AM UTC, comment #7: 

(gdb) run http-crash.exe http://127.0.0.1/~gopal/System.xml
Starting program: /usr/local/bin/ilrun http-crash.exe http://127.0.0.1/~gopal/System.xml
[New Thread 1024 (LWP 4135)]
0
1
2
3
4
5

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 4135)]
_ILCVMInterpreter (thread=0x815ad20) at cvm.c:934
Line number 934 out of range; cvm.c has 814 lines.
(gdb) c
Continuing.
6
7
8
9
10
11
12
13
14

Program received signal SIGSEGV, Segmentation fault.
_ILCVMInterpreter (thread=0x815ad20) at cvm.c:934
Line number 934 out of range; cvm.c has 814 lines.
(gdb)

Seems to continue fine on my box.

We have to figure out why the signal handling NULL check fails on your machine.

Gopal.V <t3rmin4t0r>
Group administrator
Wed 16 Feb 2005 02:09:27 PM UTC, comment #6: 

Duplicated bug on Mandrake Cooker, kernel 2.6.10 with CVS build of pnet.

gdb backtrace:

#0  _ILCVMInterpreter (thread=0x8163d20) at cvm_call.c:934
#1  0x0804c4dd in _ILCallMethod (thread=0x8163d20, method=0xb7ad9de0, unpack=0x804c200 <_ILCallUnpackDirectResult>,
    result=0x0, isCtor=0, _this=0x0, pack=0x804be20 <_ILCallPackVaParams>, userData=0xbfffed84) at call.c:706
#2  0x0804c7ee in ILExecThreadCall (thread=0x8163d20, method=0xb7ad9de0, result=0x0) at call.c:917
#3  0x080a23a5 in _ILFinalizeObject (block=0x8317e38, data=0x0) at heap.c:163
#4  0x080e6219 in GC_invoke_finalizers () at finalize.c:787
#5  0x080ce827 in PrivateGCNotifyFinalize (timeout=0, ignoreDisabled=-1215687068) at hb_gc.c:187
#6  0x080e6c71 in GC_generic_malloc (lb=16, k=4) at malloc.c:188
#7  0x080edc43 in GC_malloc_explicitly_typed (lb=16, d=0) at typd_mlc.c:653
#8  0x080a24fb in _ILEngineAllocAtomic (thread=0x8163e70, classInfo=0xb7dbc500, size=5) at heap.c:261
#9  0x0805b84f in System_SArray_ctor (thread=0x8163e70, length=1) at lib_array.c:120
#10 0x080e3adf in ffi_call_SYSV () at src/x86/sysv.S:59
#11 0x080e3ac3 in ffi_raw_call (cif=0x8323028, fn=0x805b7d0 <System_SArray_ctor>, rvalue=0xb78a1664, fake_avalue=0x0)
    at src/x86/ffi.c:515
#12 0x08099899 in _ILCVMInterpreter (thread=0x8163e70) at cvm_call.c:855
#13 0x0804c4dd in _ILCallMethod (thread=0x8163e70, method=0xb7d9b370, unpack=0x804c340 <_ILCallUnpackVResult>,
    result=0xbffff450, isCtor=0, _this=0x0, pack=0x804c050 <_ILCallPackVParams>, userData=0xbffff460) at call.c:706
#14 0x0804c818 in ILExecThreadCallV (thread=0x8163e70, method=0xb7d9b370, result=0xbffff450, args=0xbffff460)
    at call.c:928
#15 0x0804bd29 in main (argc=3, argv=0xbffff514) at ilrun.c:494

Deryk Robosson <drobosson>
Group Member
Thu 20 Jan 2005 10:00:20 AM UTC, comment #5: 

This second program Crash.cs works better for reproducing the crash. It's a simple loop that opens an XmlTextReader and immediately closes it. After 4 Iterations, it segfaults on my PC... with the quickhack (see previous post) it works.
For reproducing the crash, you need to access the file from a http server; reading a local xml file does not cause the crash.


[erich@localhost erich]$ cscc Crash.cs -lSystem.Xml -o Crash.exe
[erich@localhost erich]$ cat test.xml
<hello><world></world></hello>
[erich@localhost erich]$ ilrun Crash.exe http://10.1.1.11/test.xml
0
1
2
3
4
Segmentation fault
[erich@localhost erich]$ ilrun Crash.exe test.xml
0
1
2
3
4
5
6
...
99
[erich@localhost erich]$

Erich Kitzmüller <ammoq>
Wed 19 Jan 2005 05:26:55 PM UTC, comment #4: 

Stephen Compall: I did my own build, with default options. Where can I find your rpms?
All: Sorry, my example (Test.cs) was too simple, I can't reproduce the bug now. Maybe I was fooled by the segfault inside gdb... Anyway, I'm sure there is such a problem, maybe in more difficult cases (garbage collection?)
In my real-world program, the program segfaults (most likely during garbage collection); if I add the following few lines in cvm_call.c, it works:

--- cvm_call.c  2005-01-19 18:07:25.282411440 +0100
+++ cvm_call_orig.c     2005-01-19 18:04:39.228655448 +0100
@@ -928,12 +928,6 @@
 {
        /* Call a virtual method */
        tempptr = stacktop[-((ILInt32)CVM_ARG_DWIDE1_SMALL)].ptrValue;
-
-       /* ERICH quickhack */
-       if (tempptr == NULL) {
-         NULL_POINTER_EXCEPTION();
-       }
-
        BEGIN_NULL_CHECK(tempptr)
        {
                /* Locate the method to be called */

Obviously this should be obsolete when using the signal-based BEGIN_NULL_CHECK...
The same program worked fine on Mandrake 9.1 (Kernel 2.4.x)...

Erich Kitzmüller <ammoq>
Wed 19 Jan 2005 01:50:53 PM UTC, comment #3: 

Erich Kitzmüller: since you mentioned the platform, I am curious: did you use the RPMs I built for Mandrake 10.1?  If so, could you see if the problem is duplicable in an installation from source with default options?

Stephen Compall <S11001001>
Group Member
Wed 19 Jan 2005 09:38:33 AM UTC, comment #2: 

I just checked a simple example which throws an NullRef exception normally but segfaults inside gdb ?.

Anonymous
Tue 18 Jan 2005 09:30:25 AM UTC, comment #1: 

It seems that (at least in my configuration: MandrakeLinux 10.1, kernel 2.6.8.1, glibc-2.3.3, gcc 3.4.1) Nullpointer references are not caught for virtual method calls. The attached short program is enough to cause a crash.

Erich Kitzmüller <ammoq>
Tue 18 Jan 2005 01:37:05 AM UTC, original submission:  

In StreamWriter.Dispose(bool disposing), stream.Flush() is called. Unfortunately, HttpStream is already disposed, so "underlying" is already null. HttpStream.Flush() simply calls underlying.Flush(), so this should IMO throw a NullReferenceException. But, even more unfortunately, the virtual machine crashes with a segmentation violation, in cvm_call.c line 934, since tempptr is a null pointer.

Erich Kitzmüller <ammoq>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #2380:  Crash.cs added by ammoq (218B - text/x-csharp)
file #2374:  Test.cs added by ammoq (138B - text/x-csharp)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 4 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-04-06 drobosson StatusNone Fixed
    Open/ClosedOpen Closed
2005-01-20 ammoq Attached File- Added Crash.cs, #2080
2005-01-18 ammoq Attached File- Added Test.cs, #2074

Back to the top

Powered by Savane 3.13-d3ae.
Corresponding source code