[reSIProcate] Strange dum crash

[Scott Godin]

If your application calls ServerSubscription::send and sends a NOTIFY with
state Terminated or Dialog destroying response code from a thread other
than the DUM thread, then delete this is called and ServerSubscriptions map
in DialogUsageManager will be modified outside of the DUM thread by the
ServerSubscription destructor.

Scott


On Wed, May 7, 2014 at 8:22 AM, palladin <p-aladin at yandex.ru> wrote:

> Dear resip devels,
> resiprocate 1.9.2
>
> I have met strange dum crash,
> please consider next output:
>
> #0  resip::BaseUsage::getBaseHandle (this=0x0) at BaseUsage.cxx:38
> No locals.
> #1  0x00007f7f1bb85e8d in resip::ServerSubscription::getHandle (this=0x0)
> at ServerSubscription.cxx:19
> No locals.
> #2  0x00007f7f1bb7ec81 in resip::ServerPublication::updateMatchingSubscriptions
> (this=0x7f7ef80e4440) at ServerPublication.cxx:65
>         i = {first = {static Preallocate = {<No data fields>}, static
> Empty = {static Preallocate = <same as static member of an already seen
> type>, static Empty = <sam
> e as static member of an already seen type>, static npos = 4294967295,
> mBuf = "", mSize = 0, mCapacity = 16, mPreBuffer = '\000' <repeats 15
> times>, mShareEnum = 0}, st
> atic npos = 4294967295, mBuf =  <Address 0x8 out of bounds>, mSize =
> 31238560, mCapacity = 0, mPreBuffer = "@\253\334\001", '\000' <repeats 11
> times>, mShareEnum = 0},
> second = }
>         key = {static Preallocate = {<No data fields>}, static Empty =
> {static Preallocate = <same as static member of an already seen type>,
> static Empty = <same as st
> atic member of an already seen type>, static npos = 4294967295, mBuf =
> 0x7f7f1c057b30 "", mSize = 0, mCapacity = 16, mPreBuffer = '\000' <repeats
> 15 times>, mShareEnum
> = 0}, static npos = 4294967295, mBuf = 0x7f7ef8196b80
> "4417437702501252 at x.x.x.x:5060", mSize = 44, mCapacity = 44, mPreBuffer =
> "\360\021\304\221\377\177
> \000\000\235(\031\034\177\177\000", mShareEnum = 2}
>         subs = {first = <error reading variable>
>         handler = 0x7fff91c3f850
> #3  0x00007f7f1bb7ef46 in resip::ServerPublication::accept
> (this=0x7f7ef80e4440, statusCode=<value optimized out>) at
> ServerPublication.cxx:78
>
> Actually subs.first points to some garbage and it looks like
> std::multimap::equal_range returned corrupted iterator.
> Could you please advise if there is any chance of asynchronous
> modification of any Dialog or asynchronous ServerSubscription
> creation/destruction?
>
>
> Sincerely,tez
> _______________________________________________
> resiprocate-devel mailing list
> resiprocate-devel at resiprocate.org
> https://list.resiprocate.org/mailman/listinfo/resiprocate-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://list.resiprocate.org/pipermail/resiprocate-devel/attachments/20140507/8d7880bb/attachment.htm>