Re: mpv coredump

[Thomas Klausner <wiz%NetBSD.org@localhost>]

On Sun, Feb 16, 2020 at 06:15:40PM +0100, Kamil Rytarowski wrote:
> On 16.02.2020 17:44, Tom Ivar Helbekkmo wrote:
> > Thomas Klausner <wiz%netbsd.org@localhost> writes:
> > 
> >>> To generate a diff of this commit:
> >>> cvs rdiff -u -r1.164 -r1.165 src/lib/libpthread/pthread.c
> >>> cvs rdiff -u -r1.101 -r1.102 src/lib/libpthread/pthread_int.h
> >>> cvs rdiff -u -r1.74 -r1.75 src/lib/libpthread/pthread_mutex.c
> >>> cvs rdiff -u -r1.18 -r1.19 src/lib/libpthread/pthread_tsd.c
> >>
> >> If I revert this, mpv works again.
> > 
> > Also, the GNU zip utilities (gzip, gunzip, gzcat) just hang (in state
> > "parked") when run on aarch64 after the above commit.  Reverting it lets
> > them work correctly again.
> > 
> > (Noticed while installing an upgrade - the upgrade stopped progressing
> > after base.tgz had been unpacked.)
> > 
> > -tih
> > 
> 
> Please test pthread.c 1.166.
> 


I tried but that wasn't sufficient.

cd /usr/src/lib/libpthread
cvs update
USETOOLS=no make
USETOOLS=no make install

#  ident pthread.c
pthread.c:
     $NetBSD: pthread.c,v 1.166 2020/02/16 17:14:31 kamil Exp $
     $NetBSD: pthread.c,v 1.166 2020/02/16 17:14:31 kamil Exp $
# ldd /usr/pkg/bin/mpv | grep pthread
        -lpthread.1 => /usr/lib/libpthread.so.1
# ls -l /usr/lib/libpthread*
-r--r--r--  1 root  wheel  108834 Feb 16 18:38 /usr/lib/libpthread.a
lrwxrwxr-x  1 root  wheel      27 Feb 16 18:38 /usr/lib/libpthread.so -> ../../lib/libpthread.so.1.4
lrwxrwxr-x  1 root  wheel      27 Feb 16 18:38 /usr/lib/libpthread.so.1 -> ../../lib/libpthread.so.1.4
lrwxrwxr-x  1 root  wheel      27 Feb 16 18:38 /usr/lib/libpthread.so.1.4 -> ../../lib/libpthread.so.1.4
-r--r--r--  1 root  wheel  629712 Feb 16 10:14 /usr/lib/libpthread_g.a
-r--r--r--  1 root  wheel  122880 Feb 16 18:38 /usr/lib/libpthread_p.a
# ls -l /lib/libpthread*
lrwxrwxr-x  1 root  wheel     17 Feb 16 18:38 /lib/libpthread.so -> libpthread.so.1.4
lrwxrwxr-x  1 root  wheel     17 Feb 16 18:38 /lib/libpthread.so.1 -> libpthread.so.1.4
-r--r--r--  1 root  wheel  97744 Feb 16 18:38 /lib/libpthread.so.1.4

# mpv file
segfault
# gdb mpv mpv.core

Core was generated by `mpv'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007796410ebd31 in je_extent_heap_remove (ph=ph@entry=0x779630e05a58, phn=phn@entry=0x779631207340) at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:278
278     ph_gen(, extent_heap_, extent_heap_t, extent_t, ph_link, extent_snad_comp)
[Current thread is 1 (process 3)]
(gdb) bt
#0  0x00007796410ebd31 in je_extent_heap_remove (ph=ph@entry=0x779630e05a58, phn=phn@entry=0x779631207340) at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:278
#1  0x0000779641113977 in arena_bin_slabs_nonfull_remove (slab=0x779631207340, bin=0x779630e059e0) at /usr/src/external/bsd/jemalloc/lib/../dist/src/arena.c:1484
#2  arena_dissociate_bin_slab (bin=0x779630e059e0, slab=0x779631207340, arena=0x779630e008c0) at /usr/src/external/bsd/jemalloc/lib/../dist/src/arena.c:1484
#3  arena_dalloc_bin_locked_impl (tsdn=tsdn@entry=0x77964c1f90a0, arena=arena@entry=0x779630e008c0, slab=0x779631207340, ptr=<optimized out>, junked=junked@entry=true) at /usr/src/external/bsd/jemalloc/lib/../dist/src/arena.c:1546
#4  0x0000779641114d49 in je_arena_dalloc_bin_junked_locked (tsdn=tsdn@entry=0x77964c1f90a0, arena=arena@entry=0x779630e008c0, extent=<optimized out>, ptr=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../dist/src/arena.c:1562
#5  0x00007796410be7a5 in je_tcache_bin_flush_small (tsd=tsd@entry=0x77964c1f90a0, tcache=tcache@entry=0x77964c1f9260, tbin=tbin@entry=0x77964c1f93f0, binind=binind@entry=16, rem=5) at /usr/src/external/bsd/jemalloc/lib/../include/jemalloc/internal/tsd.h:138
#6  0x00007796410bfc72 in je_tcache_event_hard (tsd=tsd@entry=0x77964c1f90a0, tcache=tcache@entry=0x77964c1f9260) at /usr/src/external/bsd/jemalloc/lib/../dist/src/tcache.c:54
#7  0x000077964111afb5 in tcache_event (tcache=<optimized out>, tsd=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../include/jemalloc/internal/tcache_inlines.h:37
#8  tcache_alloc_large (slow_path=<optimized out>, zero=<optimized out>, binind=<optimized out>, size=<optimized out>, tcache=<optimized out>, arena=<optimized out>, tsd=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../include/jemalloc/internal/tcache_inlines.h:159
#9  arena_malloc (slow_path=<optimized out>, tcache=<optimized out>, zero=<optimized out>, ind=<optimized out>, size=<optimized out>, arena=<optimized out>, tsdn=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../include/jemalloc/internal/arena_inlines_b.h:98
#10 iallocztm (slow_path=<optimized out>, arena=<optimized out>, is_internal=<optimized out>, tcache=<optimized out>, zero=<optimized out>, ind=<optimized out>, size=<optimized out>, tsdn=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../include/jemalloc/internal/jemalloc_internal_inlines_c.h:53
#11 imalloc_no_sample (ind=<optimized out>, usize=<optimized out>, size=<optimized out>, tsd=<optimized out>, dopts=<optimized out>, sopts=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../dist/src/jemalloc.c:1742
#12 imalloc_body (tsd=<optimized out>, dopts=<optimized out>, sopts=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../dist/src/jemalloc.c:1938
#13 imalloc (dopts=<synthetic pointer>, sopts=<synthetic pointer>) at /usr/src/external/bsd/jemalloc/lib/../dist/src/jemalloc.c:2041
#14 malloc (size=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../dist/src/jemalloc.c:2071
#15 0x0000779642c1287b in luaM_realloc_ (L=L@entry=0x77964c07f000, block=block@entry=0x0, osize=osize@entry=0, nsize=nsize@entry=160) at lmem.c:84
#16 0x0000779642c181b4 in setnodevector (size=4, t=0x77964b573940, L=0x77964c07f000) at ltable.c:291
#17 luaH_resize (L=L@entry=0x77964c07f000, t=t@entry=0x77964b573940, nasize=0, nhsize=nhsize@entry=4) at ltable.c:312
#18 0x0000779642c1b01d in luaV_execute (L=L@entry=0x77964c07f000) at lvm.c:603
#19 0x0000779642c0e05b in luaD_call (L=L@entry=0x77964c07f000, func=<optimized out>, nResults=nResults@entry=0, allowyield=allowyield@entry=0) at ldo.c:402
#20 0x0000779642c095d6 in lua_callk (L=L@entry=0x77964c07f000, nargs=nargs@entry=0, nresults=nresults@entry=0, ctx=ctx@entry=0, k=k@entry=0x0) at lapi.c:905
#21 0x000000000049782a in load_scripts (L=0x77964c07f000) at ../player/lua.c:271
#22 0x0000779642c0dc47 in luaD_precall (L=L@entry=0x77964c07f000, func=<optimized out>, nresults=0) at ldo.c:319
#23 0x0000779642c0e03e in luaD_call (L=0x77964c07f000, func=<optimized out>, nResults=<optimized out>, allowyield=<optimized out>) at ldo.c:401
#24 0x0000779642c0d488 in luaD_rawrunprotected (L=L@entry=0x77964c07f000, f=f@entry=0x779642c0788b <f_call>, ud=ud@entry=0x7796323efc90) at ldo.c:131
#25 0x0000779642c0e2eb in luaD_pcall (L=L@entry=0x77964c07f000, func=func@entry=0x779642c0788b <f_call>, u=u@entry=0x7796323efc90, old_top=48, ef=<optimized out>) at ldo.c:603
#26 0x0000779642c096b3 in lua_pcallk (L=L@entry=0x77964c07f000, nargs=nargs@entry=0, nresults=nresults@entry=0, errfunc=errfunc@entry=-2, ctx=ctx@entry=0, k=k@entry=0x0) at lapi.c:949
#27 0x0000000000498e4d in run_lua (L=0x77964c07f000) at ../player/lua.c:332
#28 0x0000779642c0dc47 in luaD_precall (L=L@entry=0x77964c07f000, func=<optimized out>, nresults=0) at ldo.c:319
#29 0x0000779642c0e03e in luaD_call (L=0x77964c07f000, func=<optimized out>, nResults=<optimized out>, allowyield=<optimized out>) at ldo.c:401
#30 0x0000779642c0d488 in luaD_rawrunprotected (L=L@entry=0x77964c07f000, f=f@entry=0x779642c0788b <f_call>, ud=ud@entry=0x7796323efed0) at ldo.c:131
#31 0x0000779642c0e2eb in luaD_pcall (L=L@entry=0x77964c07f000, func=func@entry=0x779642c0788b <f_call>, u=u@entry=0x7796323efed0, old_top=16, ef=<optimized out>) at ldo.c:603
#32 0x0000779642c096b3 in lua_pcallk (L=L@entry=0x77964c07f000, nargs=nargs@entry=1, nresults=nresults@entry=0, errfunc=errfunc@entry=0, ctx=ctx@entry=0, k=k@entry=0x0) at lapi.c:949
#33 0x00000000004992e7 in mp_cpcall (func=0x498b47 <run_lua>, ud=0x77964c082040, L=0x77964c07f000) at ../player/lua.c:102
#34 load_lua (client=<optimized out>, fname=0x77964c0d08d0 "@osc.lua") at ../player/lua.c:365
#35 0x00000000004a0e28 in script_thread (p=0x77964c155fe0) at ../player/scripting.c:95
#36 0x000077964480cbd2 in ?? () from /usr/lib/libpthread.so.1
#37 0x000077964108fd10 in ?? () from /usr/lib/libc.so.12
Backtrace stopped: Cannot access memory at address 0x7796323f0000
(gdb) 

 Thomas