SIGSEGV in pthread_mutex_lock during free

[ajopensrc]

Hi,

We are using jemalloc version 4.2.1 and hitting this crash when freeing memory. Could you please confirm if this is any jemalloc issue or an application bug?

Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f226c4b8d44 in pthread_mutex_lock () from /lib/x86_64-linux-gnu/libpthread.so.0
#1 0x00007f226cb1dabd in je_malloc_mutex_lock (mutex=0x81b4, tsdn=0x7f2253bd7698) at include/jemalloc/internal/mutex.h:94
#2 je_arena_dalloc_large (tsdn=0x7f2253bd7698, arena=, chunk=0x7f21db200000, ptr=)
at src/arena.c:3015

Found a similar stack in valgrind report under this issue but not sure if it was fixed:
monkey/monkey#221

Thanks,
Asmita

[jasone]

There's not enough information here to know for sure what's going on, but chances are very good that this crash is due to application-induced memory corruption.

[ajopensrc]

Ok. This is seen intermittently, likely under heavy memory usage and just wanted to confirm if it was any known issue fixed in newer version of jemalloc. Will check for any memory corruption possibilities in the application. Closing this for now.

Thanks for taking a look!

[santhoshmprabhu]

Hitting a similar issue in version 3.5.1-2:

#0  __GI___pthread_mutex_lock (mutex=0x1e1bc30) at ../nptl/pthread_mutex_lock.c:66
#1  0x00007fbd7cfc1cdf in ?? () from /usr/lib/x86_64-linux-gnu/libjemalloc.so
#2  0x00007fbd6ca1c11d in deallocate (this=<optimized out>, __p=<optimized out>) at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.5.0/../../../../include/c++/5.5.0/ext/new_allocator.h:110
#3  deallocate (__n=12, __a=..., __p=<optimized out>) at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.5.0/../../../../include/c++/5.5.0/bits/alloc_traits.h:517
#4  _M_deallocate_node (this=<optimized out>, __p=<optimized out>) at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.5.0/../../../../include/c++/5.5.0/bits/stl_deque.h:608
#5  _M_destroy_nodes (__nstart=<optimized out>, __nfinish=<optimized out>, this=<optimized out>) at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.5.0/../../../../include/c++/5.5.0/bits/stl_deque.h:742
#6  ~_Deque_base (this=<optimized out>) at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.5.0/../../../../include/c++/5.5.0/bits/stl_deque.h:664
#7  ~deque (this=<optimized out>) at /usr/bin/../lib/gcc/x86_64-linux-gnu/5.5.0/../../../../include/c++/5.5.0/bits/stl_deque.h:1039
#8  Json::Reader::~Reader (this=0x7fbd67bfdf50) at /usr/include/jsoncpp/json/reader.h:23

Is this fixed in later versions? This is the version that is available in the Ubuntu 14.04 repo.

[davidtgoldblatt]

As mentioned, this is probably an application-induced corruption bug; running under valgrind or address sanitizer is probably a good way to debug.