Calls `curl_multi_assign` with null

[bevanjkay]

When building the latest version of curl at Homebrew, we ran into a segfault when regression testing Julia as a curl dependent.
The segfault issue has been resolved in curl, however it likely points to an issue in the curl multi handler in Julia.

See curl comment for reference;
curl/curl#14860 (comment)

For our CI build;
Complete logs are available here. The referenced error starts here on macOS 14 arm64.

[an-Iceberg]

I am affected by this issue as well. I can't update any packages i've installed because a segmentation fault at curl_multi_assign happens.

[giordano]

@bevanjkay do you have a self-contained reproducer?

[giordano]

If I change

diff --git a/src/Curl/Curl.jl b/src/Curl/Curl.jl
index fd9b4c9..a2cc146 100644
--- a/src/Curl/Curl.jl
+++ b/src/Curl/Curl.jl
@@ -51,6 +51,7 @@ function curl_multi_socket_action(multi_handle, s, ev_bitmask, running_handles)
     ccall((:curl_multi_socket_action, libcurl), CURLMcode, (Ptr{CURLM}, curl_socket_t, Cint, Ptr{Cint}), multi_handle, s, ev_bitmask, running_handles)
 end
 function curl_multi_assign(multi_handle, sockfd, sockp)
+    multi_handle == C_NULL && error("multi_handle is NULL")
     ccall((:curl_multi_assign, libcurl), CURLMcode, (Ptr{CURLM}, curl_socket_t, Ptr{Cvoid}), multi_handle, sockfd, sockp)
 end
 

all tests pass for me. Please, provide a self-contained minimal reproducer, otherwise it looks complicated to address this issue.

[giordano]

And with

diff --git a/src/Curl/Curl.jl b/src/Curl/Curl.jl
index fd9b4c9..546ef21 100644
--- a/src/Curl/Curl.jl
+++ b/src/Curl/Curl.jl
@@ -51,6 +51,8 @@ function curl_multi_socket_action(multi_handle, s, ev_bitmask, running_handles)
     ccall((:curl_multi_socket_action, libcurl), CURLMcode, (Ptr{CURLM}, curl_socket_t, Cint, Ptr{Cint}), multi_handle, s, ev_bitmask, running_handles)
 end
 function curl_multi_assign(multi_handle, sockfd, sockp)
+    @info "Hello from curl_multi_assign"
+    multi_handle == C_NULL && error("multi_handle is NULL")
     ccall((:curl_multi_assign, libcurl), CURLMcode, (Ptr{CURLM}, curl_socket_t, Ptr{Cvoid}), multi_handle, sockfd, sockp)
 end
 

I tried to follow the (non-minimal) reproducer by @carlocab in curl/curl#14860 (comment) and I still can't see multi_handle being NULL:

% julia -p 3 --project=/tmp -e 'using Pkg; Pkg.add("Example")'
[ Info: Hello from curl_multi_assign
[ Info: Hello from curl_multi_assign
[ Info: Hello from curl_multi_assign
[ Info: Hello from curl_multi_assign
[ Info: Hello from curl_multi_assign
[ Info: Hello from curl_multi_assign
   Resolving package versions...
[ Info: Hello from curl_multi_assign
[ Info: Hello from curl_multi_assign
[ Info: Hello from curl_multi_assign
[ Info: Hello from curl_multi_assign
   Installed Example ─ v0.5.3
    Updating `/private/tmp/Project.toml`
  [7876af07] + Example v0.5.3
    Updating `/private/tmp/Manifest.toml`
  [7876af07] + Example v0.5.3
Precompiling packages finished.
  1 dependency successfully precompiled in 1 seconds. 25 already precompiled.

Note that Example is being installed (I had deleted the source from my ${JULIA_DEPOT_PATH}/packages directory), and the message Hello from curl_multi_assign to confirm my custom Downloads version is being used.

[giordano]

Alright, I finally managed to hit a NULL handle with

% julia --project=/tmp -e 'using Downloads; Downloads.download("https://example.org", IOBuffer())'
┌ Error: socket_callback: unexpected error
│   err = multi.handle is NULL
└ @ Downloads.Curl ~/repo/Downloads.jl/src/Curl/Multi.jl:204

but only with libcurl 8.10.0+. This is happening at the exit of julia, so probably in the finalizer of the

Downloads.jl/src/Curl/Curl.jl

Lines 93 to 101 in 89d3c7d

	# Close any Multis and their timers at exit that haven't been finalized by then
	Base.atexit() do
	while true
	w = @lock MULTIS_LOCK (isempty(MULTIS) ? nothing : pop!(MULTIS))
	w === nothing && break
	w = w.value
	w isa Multi && done!(w)
	end
	end

All my tests above were with Julia master (0073917331) and built-in libcurl 8.6.0. I also can't reproduce it with a local build of libcurl 8.9.0. What I did here was to use same version of Julia and Downloads.jl and link it to a local build of libcurl 8.10.0 or 8.10.1. But the thing is that the code path on the julia side changed only by changing libcurl version.

[mrufsvold]

I don't understand the linking between libcurl, libcurl_jll, etc. very well, so please forgive me if this isn't adding any new information.

I hit this same segfault using the Downloads.jl backend for AWS.jl. It ran continuously for 5 hours with no problem. Then crashed on a segfault. This did not occur why Julia was exiting. Unfortunately, since it ran the same loop for many hours before hand and there are several places in the code that interact with AWS services, it's hard for me to narrow down a reproducible example.

Here is the trace:

[1] signal (11.1): Segmentation fault
in expression starting at /usr/local/consolidator_script.jl:25
curl_multi_cleanup at /usr/local/julia-1.10.5/bin/../lib/julia/libcurl.so.4 (unknown line)
curl_multi_cleanup at /cache/build/builder-amdci4-4/julialang/julia-release-1-dot-10/usr/share/julia/stdlib/v1.10/LibCURL/src/lC_curl_h.jl:214 [inlined]
done! at /cache/build/builder-amdci4-4/julialang/julia-release-1-dot-10/usr/share/julia/stdlib/v1.10/Downloads/src/Curl/Multi.jl:29 [inlined]
#36 at /cache/build/builder-amdci4-4/julialang/julia-release-1-dot-10/usr/share/julia/stdlib/v1.10/Downloads/src/Curl/Multi.jl:81 [inlined]
lock at ./lock.jl:229
#35 at /cache/build/builder-amdci4-4/julialang/julia-release-1-dot-10/usr/share/julia/stdlib/v1.10/Downloads/src/Curl/Multi.jl:78 [inlined]
#726 at ./asyncevent.jl:306
jfptr_YY.726_75903.1 at /usr/local/julia-1.10.5/lib/julia/sys.so (unknown line)
_jl_invoke at /cache/build/builder-amdci4-4/julialang/julia-release-1-dot-10/src/gf.c:2895 [inlined]
ijl_apply_generic at /cache/build/builder-amdci4-4/julialang/julia-release-1-dot-10/src/gf.c:3077
jl_apply at /cache/build/builder-amdci4-4/julialang/julia-release-1-dot-10/src/julia.h:1982 [inlined]
start_task at /cache/build/builder-amdci4-4/julialang/julia-release-1-dot-10/src/task.c:1238
Allocations: 18104701385 (Pool: 18059901401; Big: 44799984); GC: 6844

I am running:
Julia v1.10.5
LibCURL_jll v8.4.0

On a linux docker container running on x86.

It's rather difficult to pull more details since this is a non-interactive app running in the cloud, but if there is anything I can provide that would be helpful, I'm happy to get it.