https://issues.apache.org/bugzilla/show_bug.cgi?id=51062
--- Comment #6 from Krzysztof Kostałkowicz <KKostalkowicz@ivmx.pl> 2011-04-15 06:44:09
EDT ---
The process loops trying do dispose a corrupted list.
Don't ask me where the corruption occurred.
Below some output from gdb with my notes.
---
apr_brigade_cleanup (data=0x8f5c3d0) at buckets/apr_brigade.c:42
42 while (!APR_BRIGADE_EMPTY(b)) {
# *b
(gdb) print *((apr_bucket_brigade *)data)
$3 = {p = 0x8f5b220, list = {next = 0x8fa9768, prev = 0x8fa9768},
bucket_alloc = 0x8f9f670}
# b
(gdb) print ((apr_bucket_brigade *)data)
$4 = (struct apr_bucket_brigade *) 0x8f5c3d0
# list head
(gdb) print ((apr_bucket_brigade *)data)->list
$5 = {next = 0x8fa9768, prev = 0x8fa9768}
# address of list head
(gdb) print &((apr_bucket_brigade *)data)->list
$24 = (struct apr_bucket_list *) 0x8f5c3d4
# first element of b
(gdb) print (((apr_bucket_brigade *)data)->list)->next
$6 = (struct apr_bucket *) 0x8fa9768
# value of first element of b
(gdb) print *(((apr_bucket_brigade *)data)->list)->next
$7 = {link = {next = 0x8f75c34, prev = 0x8f75c34}, type = 0x16c0e0,
length = 4294967295, start = -1, data = 0x8f75608,
free = 0x80662f8 <apr_bucket_free@plt>, list = 0x8fa9698}
# second element of b
(gdb) print (((apr_bucket_brigade *)data)->list)->next->link->next
$8 = (struct apr_bucket * volatile) 0x8f75c34
# value of second element of b
(gdb) print *(((apr_bucket_brigade *)data)->list)->next->link->next
$9 = {link = {next = 0x8f75c34, prev = 0x8f75c34}, type = 0x8fa9698,
length = 150427552, start = 6062569827032112, data = 0x8066538,
free = 0x8f755c8, list = 0x8f75c54}
# sentinel for b (computed with APR_RING_SENTINEL)
(gdb) print (struct apr_bucket *)((char *)(&(&((apr_bucket_brigade
*)data)->list)->next))
$23 = (struct apr_bucket *) 0x8f5c3d4
# it's not (but should be) possible to reach sentinel of b from b
# while loops because the list is not empty
# ie. APR_RING_FIRST((hp)) != APR_RING_SENTINEL((hp), elem, link)
# apr_bucket_free(void *mem) goes into if_true branch
# it does not change the data structure (the assignments do not change
anything)
# if check_not_already_free(node_header_t *node) was called
# it would abort during first loop iteration
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
|