Segmentation Fault in subscribe_event

[tango-controls-bot]

subscribe_event() gives segmentation fault with this backtrace:

\#0  0xb628cf52 in std::string::compare\(char const\*\) const \(\) from /usr/lib/gcc/i686-pc-linux-gnu/4.3.4/libstdc++.so.6
\(gdb\) bt
\#0  0xb628cf52 in std::string::compare\(char const\*\) const \(\) from /usr/lib/gcc/i686-pc-linux-gnu/4.3.4/libstdc++.so.6
\#1  0xb7d27e53 in operator==<char, std::char\_traits<char>, std::allocator<char> > \(this=0x846e2a8, device=0xb330a120, attribute=..., event=Tango::CHANGE\_EVENT,
callback=0x846d378, ev\_queue=0x0, filters=..., stateless=false\) at /usr/lib/gcc/i686-pc-linux-gnu/4.3.4/include/g++-v4/bits/basic\_string.h:2189
\#2  Tango::EventConsumer::subscribe\_event \(this=0x846e2a8, device=0xb330a120, attribute=..., event=Tango::CHANGE\_EVENT, callback=0x846d378, ev\_queue=0x0, filters=...,
stateless=false\) at event.cpp:1889
\#3  0xb7d28658 in Tango::EventConsumer::subscribe\_event \(this=0x846e2a8, device=0xb330a120, attribute=..., event=Tango::CHANGE\_EVENT, callback=0x846d378, filters=...,
stateless=<value optimized out>\) at event.cpp:1818
\#4  0xb7e07449 in Tango::DeviceProxy::subscribe\_event \(this=0xb330a120, attr\_name=..., event=Tango::CHANGE\_EVENT, callback=0x846d378, filters=...,
stateless=<value optimized out>\) at devapi\_base.cpp:6598
\#5  0xb72d19b4 in TAction::configure \(this=0x846d370\) at src/taction.cpp:199
\#6  0xb72d4ef4 in TAction \(this=0x846d370, s=..., dev=0xb330a120, dt=ATTRIBUTE, pt=..., args=..., m=AUTO\_REFRESH, p=1000\) at src/taction.cpp:46
\#7  0xb7300113 in ActionFactory::create \(this=0x811e1b8, device=0xb330a120, ev=...\) at src/action\_factory.cpp:158
\#8  0xb72c23e6 in DeviceThread::process \(this=0xb3301718\) at src/devicethread.cpp:155
\#9  0xb733c358 in DeviceThread::qt\_metacall \(this=0xb3301718, \_c=QMetaObject::InvokeMetaMethod, \_id=5, \_a=0xaaaedc58\) at moc/moc\_devicethread.cpp:83
\#10 0xb659c654 in QMetaObject::activate\(QObject\*, int, int, void\*\*\) \(\) from /usr/lib/qt4/libQtCore.so.4
\#11 0x00000000 in ?? \(\)

Thanks for any suggestion!

Giacomo

Reported by: jacum

Original Ticket: tango-cs/bugs/257

[tango-controls-bot]

Hi,

We need some more informations:
1 - Which Tango release are you using?
2 - Which OS?

In case you are using Tango 7.1.1, take care that the attr_name field of the EventData structure passed to the callback has changed compared to release 7.0.2. It is now the fully qualified attribute name (tango://host:port/....)
Can't it be the reason of your problem?

Regards

Emmanuel Taurel

Original comment by: taurel

[tango-controls-bot]

Hi Manu! Yes, this might be the case. I am using tango 7.1.1 Do you mean I have to pass the fully qualified attribute name to subscribe_event()? (The problem seems to take place there). Is this feature backward compatible?

I post another backtrace of the same failure in subscribe_event(), a bit deeper, just to let you know.

Thanks Manu

Giacomo

Core was generated by \`./bin/synoptic'.                                                                          
Program terminated with signal 11, Segmentation fault.                                                           
\#0  0xb61dad1d in std::\_Rb\_tree\_rotate\_right\(std::\_Rb\_tree\_node\_base\*, std::\_Rb\_tree\_node\_base\*&\) \(\)             
from /usr/lib/gcc/i686-pc-linux-gnu/4.3.4/libstdc++.so.6                                                      
\(gdb\) bt                                                                                                         
\#0  0xb61dad1d in std::\_Rb\_tree\_rotate\_right\(std::\_Rb\_tree\_node\_base\*, std::\_Rb\_tree\_node\_base\*&\) \(\)             
from /usr/lib/gcc/i686-pc-linux-gnu/4.3.4/libstdc++.so.6                                                      
\#1  0xb61daea4 in std::\_Rb\_tree\_insert\_and\_rebalance\(bool, std::\_Rb\_tree\_node\_base\*, std::\_Rb\_tree\_node\_base\*, std::\_Rb\_tree\_node\_base&\) \(\) from /usr/lib/gcc/i686-pc-linux-gnu/4.3.4/libstdc++.so.6                                      
\#2  0xb7caf170 in std::\_Rb\_tree<std::string, std::pair<std::string const, std::string>, std::\_Select1st<std::pair<std::string const, std::string> >, std::less<std::string>, std::allocator<std::pair<std::string const, std::string> > >::\_M\_insert\_\(std::\_Rb\_tree\_node\_base const\*, std::\_Rb\_tree\_node\_base const\*, std::pair<std::string const, std::string> const&\) \(\) from /usr/local/tango-7.1.1/lib/libtango.so.7
\#3  0xb7caf3af in std::\_Rb\_tree<std::string, std::pair<std::string const, std::string>, std::\_Select1st<std::pair<std::string const, std::string> >, std::less<std::string>, std::allocator<std::pair<std::string const, std::string> > >::\_M\_insert\_unique\(std::pair<std::string const, std::string> const&\) \(\) from /usr/local/tango-7.1.1/lib/libtango.so.7
\#4  0xb7d37f42 in std::map<std::string, std::string, std::less<std::string>, std::allocator<std::pair<std::string const, std::string> > >::insert \(this=0x837c318, dev=...\)
at /usr/lib/gcc/i686-pc-linux-gnu/4.3.4/include/g++-v4/bits/stl\_map.h:469
\#5  Tango::Database::import\_device \(this=0x837c318, dev=...\) at dbapi\_base.cpp:895
\#6  0xb7d58d59 in Tango::DbDevice::import\_device \(this=0x8420318\) at dbapi\_device.cpp:138
\#7  0xb7d9697d in Tango::DeviceProxy::get\_corba\_name \(this=0x8420030, need\_check\_acc=true\) at devapi\_base.cpp:2283
\#8  0xb7d91d8c in Tango::DeviceProxy::real\_constructor \(this=0x8420030, name=...,
need\_check\_acc=<value optimized out>\) at devapi\_base.cpp:1643
\#9  0xb7d936d3 in DeviceProxy \(this=0x8420030, name=..., orb=0x0\) at devapi\_base.cpp:1568
\#10 0xb7cab68d in Tango::EventConsumer::connect\_event \(this=0x841c6c0, device=0xb0208bb8, attribute=...,
event=Tango::CHANGE\_EVENT, callback=0x841bf70, ev\_queue=0x0, filters=..., event\_name=..., event\_id=0\)
at event.cpp:2115
\#11 0xb7cacdf0 in Tango::EventConsumer::subscribe\_event \(this=0x841c6c0, device=0xb0208bb8, attribute=...,
event=Tango::CHANGE\_EVENT, callback=0x841bf70, ev\_queue=0x0, filters=..., stateless=false\) at event.cpp:1981
\#12 0xb7cad658 in Tango::EventConsumer::subscribe\_event \(this=0x841c6c0, device=0xb0208bb8, attribute=...,
event=Tango::CHANGE\_EVENT, callback=0x841bf70, filters=..., stateless=<value optimized out>\) at event.cpp:1818
\#13 0xb7d8c449 in Tango::DeviceProxy::subscribe\_event \(this=0xb0208bb8, attr\_name=..., event=Tango::CHANGE\_EVENT,
callback=0x841bf70, filters=..., stateless=<value optimized out>\) at devapi\_base.cpp:6598
\#14 0xb72569b4 in TAction::configure \(this=0x841bf68\) at src/taction.cpp:199
\#15 0xb7259ef4 in TAction \(this=0x841bf68, s=..., dev=0xb0208bb8, dt=ATTRIBUTE, pt=..., args=..., m=AUTO\_REFRESH,
p=1000\) at src/taction.cpp:46
\#16 0xb7285113 in ActionFactory::create \(this=0x811e478, device=0xb0208bb8, ev=...\) at src/action\_factory.cpp:158
\#17 0xb72473e6 in DeviceThread::process \(this=0xb0201d98\) at src/devicethread.cpp:155
\---Type <return> to continue, or q <return> to quit---
\#18 0xb72c1358 in DeviceThread::qt\_metacall \(this=0xb0201d98, \_c=QMetaObject::InvokeMetaMethod, \_id=5,
\_a=0xaf9fdc58\) at moc/moc\_devicethread.cpp:83
\#19 0xb6521654 in QMetaObject::activate\(QObject\*, int, int, void\*\*\) \(\) from /usr/lib/qt4/libQtCore.so.4
\#20 0x00000000 in ?? \(\)

Original comment by: jacum

[tango-controls-bot]

Dear manu, I avail myself of the occasion to signal another problem I am encountering, which unfortunately I cannot debug by means of a valid backtrace.

In my library I have a list of pairs time_t/DevError list.

QList<QPair<time\_t, DevErrorList> >    logs;

Normally I push_back pairs on it, and when the list grows, I pop_front(). It seems that that pop_front() causes an
aborted signal.

What I do is take the DevFailed &e obtained in the exception and pass e.errors to the method below, setMessage():

void TVariant::setMessage\(const DevErrorList& el\)
\{
time\_t now = time\(NULL\);
QPair<time\_t, DevErrorList> err\(now, el\); /\* here you see how I create the couple \*/

TUtil::instance\(\)->log\(err\); /\* see log\(\) below\(\) \*/
d\_message = TUtil::instance\(\)->formatMessage\(err\);
\}

Then log() is called:

void TUtil::log\(QPair<time\_t, DevErrorList> err, bool noConsole\)
\{
logs.push\_back\(err\);
if \(logs.size\(\) == MAX\_LOGS\)
logs.pop\_front\(\); /\* this seems to be addressed by the backtrace \*/
...
\}

The trace is as follows:

\*\*\* glibc detected \*\*\* ./bin/synoptic: double free or corruption \(fasttop\): 0x084dd400 \*\*\*
======= Backtrace: =========                                                              
/lib/libc.so.6\(+0x6c064\)\[0xb6149064\]                                                      
/lib/libc.so.6\(+0x6d8f3\)\[0xb614a8f3\]                                                      
/lib/libc.so.6\(cfree+0x6d\)\[0xb614d89d\]                                                    
/usr/lib/gcc/i686-pc-linux-gnu/4.3.4/libstdc++.so.6\(\_ZdlPv+0x22\)\[0xb63131a2\]              
/usr/lib/gcc/i686-pc-linux-gnu/4.3.4/libstdc++.so.6\(\_ZdaPv+0x1e\)\[0xb63131fe\]              
/usr/local/tango-7.1.1/lib/libtango.so.7\(\_ZN20\_CORBA\_String\_helper4freeEPc+0x2b\)\[0xb7c9e64b\]
/usr/local/tango-7.1.1/lib/libtango.so.7\(\_ZN5Tango12DevErrorListD1Ev+0x46\)\[0xb7ca0ba6\]      
/testingqtango3.1/runtime/lib/libQTango.so.3\(\_ZN5QPairIlN5Tango12DevErrorListEED1Ev+0x20\)\[0xb744fe7c\]
/testingqtango3.1/runtime/lib/libQTangoCore.so.3\(\_ZN5QListI5QPairIlN5Tango12DevErrorListEEE13node\_destructEPNS4\_4NodeE+0x2b\)\[0xb73562a9\]                                                                                                  
/testingqtango3.1/runtime/lib/libQTangoCore.so.3\(\_ZN5QListI5QPairIlN5Tango12DevErrorListEEE5eraseENS4\_8iteratorE+0x2b\)\[0xb735b6a1\]                                                                                                        
/testingqtango3.1/runtime/lib/libQTangoCore.so.3\(\_ZN5QListI5QPairIlN5Tango12DevErrorListEEE11removeFirstEv+0x76\)\[0xb735b748\]                                                                                                              
/testingqtango3.1/runtime/lib/libQTangoCore.so.3\(\_ZN5QListI5QPairIlN5Tango12DevErrorListEEE9pop\_frontEv+0x1d\)\[0xb735b76d\]                                                                                                                 
/testingqtango3.1/runtime/lib/libQTangoCore.so.3\(\_ZN5TUtil3logE5QPairIlN5Tango12DevErrorListEEb+0x55\)\[0xb734b329\]    
/testingqtango3.1/runtime/lib/libQTangoCore.so.3\(\_ZN8TVariant10setMessageERKN5Tango12DevErrorListE+0x6c\)\[0xb73162b6\] 
/testingqtango3.1/runtime/lib/libQTangoCore.so.3\(\_ZN7TAction7executeE8QVariantb+0x16d7\)\[0xb7331c9b\]                  
/testingqtango3.1/runtime/lib/libQTangoCore.so.3\(\_ZN7TAction11qt\_metacallEN11QMetaObject4CallEiPPv+0x200\)\[0xb73a00e2\]
/usr/lib/qt4/libQtCore.so.4\(\_ZN11QMetaObject8activateEP7QObjectiiPPv+0x294\)\[0xb65ff654\]                              
======= Memory map: ========                                                                                         
08048000-080c4000 r-xp 00000000 fd:03 180225     /home/giacomo/devel/fermi/panels/synoptic/bin/synoptic              
080c4000-080c5000 rw-p 0007c000 fd:03 180225     /home/giacomo/devel/fermi/panels/synoptic/bin/synoptic  

Unfortunately, gdb does not provide any help in this case.

Thanks for any suggestion or hint.

Giacomo

Original comment by: jacum

[tango-controls-bot]

Hi again. perhaps this can help about DevErrorList destruction problem.
At client shutdown, I got a segmentation fault and this time the backtrace is perhaps more useful:

Core was generated by \`./bin/synoptic'.
Program terminated with signal 11, Segmentation fault.
\#0  \_CORBA\_Sequence<Tango::DevError>::freebuf \(this=0x849972c, \_\_in\_chrg=<value optimized out>\)
at /usr/local/omniorb-4.1.4/include/omniORB4/seqTemplatedecls.h:179
179         if \(b\) delete \[\] b;
\(gdb\) bt
\#0  \_CORBA\_Sequence<Tango::DevError>::freebuf \(this=0x849972c, \_\_in\_chrg=<value optimized out>\)
at /usr/local/omniorb-4.1.4/include/omniORB4/seqTemplatedecls.h:179
\#1  ~\_CORBA\_Sequence \(this=0x849972c, \_\_in\_chrg=<value optimized out>\)
at /usr/local/omniorb-4.1.4/include/omniORB4/seqTemplatedecls.h:217
\#2  ~\_CORBA\_Unbounded\_Sequence \(this=0x849972c, \_\_in\_chrg=<value optimized out>\)
at /usr/local/omniorb-4.1.4/include/omniORB4/seqTemplatedecls.h:339
\#3  ~DevErrorList \(this=0x849972c, \_\_in\_chrg=<value optimized out>\) at ./idl/tango.h:2185
\#4  0xb73fee7c in ~QPair \(this=0x8499728, \_\_in\_chrg=<value optimized out>\) at /usr/include/qt4/QtCore/qpair.h:55
\#5  0xb72ee025 in QList<QPair<long, Tango::DevErrorList> >::node\_destruct \(this=0x811d764, from=0x85af020,
to=0x85af024\) at /usr/include/qt4/QtCore/qlist.h:367
\#6  0xb72ee08b in QList<QPair<long, Tango::DevErrorList> >::free \(this=0x811d764, data=0x85af000\)
at /usr/include/qt4/QtCore/qlist.h:559
\#7  0xb72ee10c in ~QList \(this=0x811d764, \_\_in\_chrg=<value optimized out>\) at /usr/include/qt4/QtCore/qlist.h:534
\#8  0xb72fb396 in ~TUtil \(this=0x811d758, \_\_in\_chrg=<value optimized out>\) at src/tutil.cpp:197
\#9  0xb65af487 in QObjectPrivate::deleteChildren\(\) \(\) from /usr/lib/qt4/libQtCore.so.4
\#10 0x080c4564 in QString::shared\_null \(\)
\#11 0x080ec8b5 in ?? \(\)
\#12 0x00000000 in ?? \(\)

Hope this helps.

Tango 7.1.1 compiled in debug mode (configure.in: added -g to compiler frags) Omniorb 4.1.4.
Operating system Linux

gcc -v : gcc version 4.3.4 \(Gentoo 4.3.4 p1.0, pie-10.1.5\)

Thanks.

Giacomo

Original comment by: jacum

[tango-controls-bot]

Original comment by: taurel

[tango-controls-bot]

Re,

Let's start with the event problem.
I have attached to this bug thread a small software that I am using to do some basic test on event. I have tried it with one device of the distribution TangoTest class and it works fine.

Could you try to compile it and to run it on one of your test device?
I use it like this
"event sys/tangotest/1 double_scalar"

Then tell us what happens

Regards

Manu

Original comment by: taurel

[tango-controls-bot]

Dear Manu
Thanks a lot!
I will deeply analyze my library and perform some more tests.
Then I'll sure let you know. Since the problem arises with a very large number of
threads, it is not easy to me to understand where the problem lies.
Actually, since the problem did not appear until 7.1.1, I contacted you.
But for now do not worry: I'm going to try some other tests...and of course I'll let you know!
Thanks a lot!
Giacomo

Original comment by: jacum

[tango-controls-bot]

• status: open --> closed

Original comment by: taurel