[sldev] crash due to freeing invalid pointers on linux client during quit?

Max Okumoto okumoto at ucsd.edu
Fri Jul 20 17:33:17 PDT 2007


Hmmmm.....

Looks like there is a threading issue or a linking problem.  There 
should only be one instance of a LLDir_Linux object,
    linden/indra/llvfs/lldir.cpp  line 50: LLDir_Linux gDirUtil;

But it looks like the destructor for the object is being called twice! 

              Max


2007-07-21T00:25:53Z INFO: cleanup_app: VFS cleaned up
2007-07-21T00:25:53Z INFO: saveToFile: Saving settings to file: 
/home/okumoto/.secondlife/user_settings/settings.xml
2007-07-21T00:25:53Z INFO: cleanup_app: Saved settings
2007-07-21T00:25:53Z INFO: saveToFile: Saving settings to file: 
/home/okumoto/.secondlife/user_settings/crash_settings.xml
2007-07-21T00:25:53Z INFO: remove_marker_file()
2007-07-21T00:25:53Z WARNING: cleanup_app: Quitting with pending 
background tasks.
2007-07-21T00:25:53Z INFO: run: QUEUED THREAD TextureCache EXITING.
2007-07-21T00:25:53Z INFO: LLThread::staticRun() Exiting: TextureCache
2007-07-21T00:25:53Z INFO: run: QUEUED THREAD ImageDecode EXITING.
2007-07-21T00:25:53Z INFO: LLThread::staticRun() Exiting: ImageDecode
[Thread -1455207536 (LWP 4787) exited]
[Thread -1465697392 (LWP 4788) exited]
[Thread -1396315248 (LWP 4785) exited]
[Thread -1444717680 (LWP 4786) exited]
[Thread -1374082160 (LWP 4783) exited]
[Thread -1476187248 (LWP 4789) exited]
[Thread -1385825392 (LWP 4784) exited]
[Thread -1208534128 (LWP 4782) exited]
[Thread 126131088 (LWP 4781) exited]
[Switching to Thread 9668304 (LWP 4758)]

Breakpoint 3, 0x00b54dd6 in ~LLDir_Linux (this=0xb5c920) at 
/tmp/linden/local/home/linden/linden/indra/i686-linux-client-releasefordownload/llvfs/lldir_linux.cpp:118
118     LLDir_Linux::~LLDir_Linux()
(gdb) cont
Continuing.
2007-07-21T00:26:01Z INFO: run: QUEUED THREAD VFS EXITING.
2007-07-21T00:26:01Z INFO: LLThread::staticRun() Exiting: VFS
2007-07-21T00:26:01Z INFO: run: QUEUED THREAD LFS EXITING.
2007-07-21T00:26:01Z INFO: LLThread::staticRun() Exiting: LFS
2007-07-21T00:26:01Z INFO: cleanup_app: VFS Thread finished
2007-07-21T00:26:01Z INFO: ll_cleanup_apr: Cleaning up APR
2007-07-21T00:26:01Z INFO: main: Goodbye
[Thread 115641232 (LWP 4779) exited]
[Thread 95976336 (LWP 4780) exited]

Breakpoint 3, 0x00b54dd6 in ~LLDir_Linux (this=0xb5c920) at 
/tmp/linden/local/home/linden/linden/indra/i686-linux-client-releasefordownload/llvfs/lldir_linux.cpp:118
118     LLDir_Linux::~LLDir_Linux()


Dzonatas wrote:
> I'm pretty sure that the use of coLinux along with the malloc tools 
> you use will nail that down. =p
>
> http://colinux.wikia.com/wiki/Main_Page
>
> Nicholaz Beresford wrote:
>>
>> I know that there is an issue with one of the buttons
>> on the login screen accessing memory after it was freed
>> (not sure if this is related though).
>>
>>
>> Nick
>>
>>
>> Second Life from the inside out:
>> http://nicholaz-beresford.blogspot.com/
>>
>>
>> Max Okumoto wrote:
>>> Hi is anyone compiling the linux client from source and seeing 
>>> crashes when you
>>> quit the client 1.18.0.6?  It's happening everytime for me so there 
>>> is a good chance
>>> I will be able to track it down soon.
>>>
>>> It looks like a double free, or an invalid pointer in the llimage 
>>> library with a
>>> std::string object.
>>>
>>>                    Max
>>>
>>> (gdb) info reg
>>> eax            0x29273e4        43152356
>>> ecx            0xbfa29baf       -1079862353
>>> edx            0xbfa2a727       -1079859417
>>> ebx            0x293fff4        43253748
>>> esp            0xbfa29b94       0xbfa29b94
>>> ebp            0xbfa29bc4       0xbfa29bc4
>>> esi            0x2      2
>>> edi            0xb6b81f0        191594992
>>> eip            0x286e79a        0x286e79a <free_check+426>
>>> eflags         0x202    [ IF ]
>>> cs             0x73     115
>>> ss             0x7b     123
>>> ds             0x7b     123
>>> es             0x7b     123
>>> fs             0x0      0
>>> gs             0x33     51
>>> (gdb) where
>>> #0  0x02862be6 in __libc_message () from /lib/libc.so.6
>>> #1  0x0286e79a in free_check () from /lib/libc.so.6
>>> #2  0x0286df55 in free () from /lib/libc.so.6
>>> #3  0x0278c691 in operator delete () from /usr/lib/libstdc++.so.6
>>> #4  0x0276924d in std::string::_Rep::_M_destroy () from 
>>> /usr/lib/libstdc++.so.6
>>> #5  0x0068f090 in __tcf_1 ()
>>>    at 
>>> /usr/lib/gcc/i386-redhat-linux/4.1.2/../../../../include/c++/4.1.2/bits/basic_string.h:233 
>>>
>>> #6  0x0282fb09 in __cxa_finalize () from /lib/libc.so.6
>>> #7  0x00688ca4 in __do_global_dtors_aux ()
>>>   from /opt/SecondLife_i686_1_18_0_6/lib/libllimage.so
>>> #8  0x006cc6dc in _fini () from 
>>> /opt/SecondLife_i686_1_18_0_6/lib/libllimage.so
>>> #9  0x007ba5de in _dl_fini () from /lib/ld-linux.so.2
>>> #10 0x0282f859 in exit () from /lib/libc.so.6
>>> #11 0x02819df4 in __libc_start_main () from /lib/libc.so.6
>>> #12 0x08069b31 in _start ()
>>> (gdb) cont
>>> *** glibc detected *** 
>>> /opt/SecondLife_i686_1_18_0_6/bin/do-not-directly-run-secondlife-bin: 
>>> free(): invalid pointer: 0x0b6b81f0 ***
>>> ======= Backtrace: =========
>>> /lib/libc.so.6[0x286e79a]
>>> /lib/libc.so.6(cfree+0x35)[0x286df55]
>>> /usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0x278c691]
>>> /usr/lib/libstdc++.so.6(_ZNSs4_Rep10_M_destroyERKSaIcE+0x1d)[0x276924d]
>>> /opt/SecondLife_i686_1_18_0_6/lib/libllimage.so[0x68f090]
>>> /lib/libc.so.6(__cxa_finalize+0xa9)[0x282fb09]
>>> /opt/SecondLife_i686_1_18_0_6/lib/libllimage.so[0x688ca4]
>>> /opt/SecondLife_i686_1_18_0_6/lib/libllimage.so[0x6cc6dc]
>>> /lib/ld-linux.so.2[0x7ba5de]
>>> /lib/libc.so.6(exit+0xe9)[0x282f859]
>>> /lib/libc.so.6(__libc_start_main+0xe4)[0x2819df4]
>>> /opt/SecondLife_i686_1_18_0_6/bin/do-not-directly-run-secondlife-bin[0x8069b31] 
>>>
>>> ======= Memory map: ========
>>>
>>>
>>>
>>> _______________________________________________
>>> Click here to unsubscribe or manage your list subscription:
>>> /index.html
>> _______________________________________________
>> Click here to unsubscribe or manage your list subscription:
>> /index.html
>>
>>
>



More information about the SLDev mailing list