Bug on libc_r?

[Joe Marcus Clarke]

Users testing the GNOME 2.3.x snapshots recently ran into a strange
crash in Nautilus.  I updated my own -CURRENT machine, and found the
problem is quite reproduceable.  I'm still trying to track down why this
suddenly started happening, but it looks like there might be a bug in
libc_r on -CURRENT.  This problem is not seen on -STABLE with the same
version of Nautilus and dependent libraries.

The version of -CURRENT in question is:

FreeBSD jclarke-pc.cisco.com 5.1-BETA FreeBSD 5.1-BETA #15: Thu May  8
12:45:49 EDT 2003    
marcus at jclarke-pc.cisco.com:/usr/obj/usr/src/sys/JCLARKE-PC  i386

The stack trace with thread locking debugging enabled is:

Program received signal SIGSEGV, Segmentation fault.
_atomic_lock () at {standard input}:15
15      {standard input}: No such file or directory.
        in {standard input}
Current language:  auto; currently asm
#0  _atomic_lock () at {standard input}:15
#1  0x28de9f44 in _spinlock_debug (lck=0x28a15678,
    fname=0x1 <Error reading address 0x1: Bad address>,
lineno=-1078989016)
    at /usr/src/lib/libc_r/uthread/uthread_spinlock.c:110
#2  0x28defbf4 in mutex_unlock_common (mutex=0x28a15678,
add_reference=1)
    at /usr/src/lib/libc_r/uthread/uthread_mutex.c:851
#3  0x28defa89 in _mutex_cv_unlock (mutex=0x1)
    at /usr/src/lib/libc_r/uthread/uthread_mutex.c:756
#4  0x28df4ae1 in _pthread_cond_wait (cond=0x28a15678, mutex=0x28a15678)
    at /usr/src/lib/libc_r/uthread/uthread_cond.c:254
#5  0x28df4c4e in __pthread_cond_wait (cond=0x1, mutex=0x1)
    at /usr/src/lib/libc_r/uthread/uthread_cond.c:343
#6  0x28d46595 in pthread_cond_wait () from /usr/lib/libc.so.5
#7  0x28a05a98 in gnome_vfs_thread_pool_wait_for_work (state=0x8400560)
    at gnome-vfs-thread-pool.c:152
#8  0x28a05af3 in thread_entry (cast_to_state=0x8400560)
    at gnome-vfs-thread-pool.c:172
#9  0x28b0acb2 in g_thread_create_proxy ()
   from /usr/local/lib/libglib-2.0.so.200
#10 0x28de848e in _thread_start ()
    at /usr/src/lib/libc_r/uthread/uthread_create.c:275

With thread locking debugging disabled, I get:

Program received signal SIGSEGV, Segmentation fault.
_atomic_lock () at {standard input}:15
15      {standard input}: No such file or directory.
        in {standard input}
Current language:  auto; currently asm
(gdb) bt
#0  _atomic_lock () at {standard input}:15
#1  0x28de9ba9 in _spinlock (lck=0x3957c)
    at /usr/src/lib/libc_r/uthread/uthread_spinlock.c:71
#2  0x28def742 in mutex_unlock_common (mutex=0x28a15678,
add_reference=1)
    at /usr/src/lib/libc_r/uthread/uthread_mutex.c:851
#3  0x28def5e9 in _mutex_cv_unlock (mutex=0x1)
    at /usr/src/lib/libc_r/uthread/uthread_mutex.c:756
#4  0x28df430f in _pthread_cond_wait (cond=0x28a15678, mutex=0x28a15678)
    at /usr/src/lib/libc_r/uthread/uthread_cond.c:254
#5  0x28df446e in __pthread_cond_wait (cond=0x1, mutex=0x1)
    at /usr/src/lib/libc_r/uthread/uthread_cond.c:343
#6  0x28d46595 in pthread_cond_wait () from /usr/lib/libc.so.5
#7  0x28a05a98 in gnome_vfs_thread_pool_wait_for_work (state=0x8400560)
    at gnome-vfs-thread-pool.c:152
#8  0x28a05af3 in thread_entry (cast_to_state=0x8400560)
    at gnome-vfs-thread-pool.c:172
#9  0x28b0acb2 in g_thread_create_proxy ()
   from /usr/local/lib/libglib-2.0.so.200
#10 0x28de82fe in _thread_start ()
    at /usr/src/lib/libc_r/uthread/uthread_create.c:275
(gdb) frame 1
#1  0x28de9ba9 in _spinlock (lck=0x3957c)
    at /usr/src/lib/libc_r/uthread/uthread_spinlock.c:71
71                      _thread_kern_sched_state(PS_SPINBLOCK, __FILE__,
__LINE__);
Current language:  auto; currently c
(gdb) print lck
$1 = (struct {...} *) 0x3957c
(gdb) print *lck
Error accessing memory address 0x3957c: Bad address.

Any idea if this is something in the GNOME stuff or in libc_r itself? 
Thanks.

Joe

-- 
PGP Key : http://www.marcuscom.com/pgp.asc
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20030509/1a8279bc/attachment.bin