| Summary: | gdb crashed when drkonqi ran it on plasmashell crashes | ||
|---|---|---|---|
| Product: | gdb | Reporter: | Matt Fagnani <matt.fagnani> |
| Component: | backtrace | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | UNCONFIRMED --- | ||
| Severity: | normal | CC: | tromey |
| Priority: | P2 | ||
| Version: | 14.1 | ||
| Target Milestone: | --- | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
| Project(s) to access: | ssh public key: | ||
| Attachments: |
Full trace of all threads for the third crash mentioned
Journal for the drkonqi, kioslave, gdb crashes when creating a plasmashell crash trace |
||
|
Description
Matt Fagnani
2023-12-08 12:18:23 UTC
Thanks for the report.
In the first trace:
#5 0x000055dc80ae97e7 in iter_match_first_hashed (dict=0x55dca15bb2a0, name=...,
iterator=0x7ffe3d29d858) at ../../gdb/dictionary.c:586
This line is:
symbol_name_matcher_ftype *matches_name
= lang->get_symbol_name_matcher (name);
... so maybe lang==null? This really shouldn't happen.
I see in your post you tried to examine this -- thank you:
(gdb) p lang
$1 = <optimized out>
I guess you'd need to build a gdb without optimization.
> There were errors in reading the name variable at that line like m_demangled_name = <error: Cannot access memory at address 0xf435c9f3d929f800>
This is the payload of an un-instantiated optional<>, so it's fine that
it is an invalid pointer -- I don't think this can be the bug.
It might be good to see which block this comes from. From the blocks
it is possible to find the function symbol (you may have to walk up
the block hierarchy a bit). From there we could try to dig up the DWARF
and see if something weird is going on.
Speaking of weird:
#4 <signal handler called>
#5 0x0000559d5be3c93a in skip_ws (
string1=@0x7ffed94630f8: 0x559d65f1c4f0 "ConversionCheck::supported",
string2=@0x7ffed94630f0: 0x7ffed94632e8 "QThread", end_str2=end_str2@entry=0x7ffed94632ef "")
at ../../gdb/utils.c:2049
This crash is extremely suspicious to me. You can see from the trace
that the arguments are just ordinary, valid strings. This function is
very simple:
while (ISSPACE (*string1))
string1++;
while (string2 < end_str2 && ISSPACE (*string2))
string2++;
... so how could this possibly be crashing? ISSPACE is a macro that
references a global static table, and that's never caused a problem...
I don't have a theory for what could be happening here.
Created attachment 15245 [details] Journal for the drkonqi, kioslave, gdb crashes when creating a plasmashell crash trace Thanks. The core dumps of the first 3 gdb crashes I mentioned were removed from my system automatically due to crashes which happened after them and journal rotation. I have the full traces saved. I did look at the string1 values for the crash in skip_ws. (gdb) frame 5 #5 0x0000559d5be3c93a in skip_ws ( string1=@0x7ffed94630f8: 0x559d65f1c4f0 "ConversionCheck::supported", string2=@0x7ffed94630f0: 0x7ffed94632e8 "QThread", end_str2=end_str2@entry=0x7ffed94632ef "") at ../../gdb/utils.c:2049 2049 while (ISSPACE (*string1)) (gdb) p string1 $3 = (const char *&) @0x7ffed94630f8: 0x559d65f1c4f0 "ConversionCheck::supported" (gdb) p *string1 $4 = 67 'C' The journal at the time of the last crash with gdb 14.1 showed that plasma-plasmashell.service sent SIGABRT to plasmashell, drkonqi, kioslave5, and gdb. The gdb traces might just have been the state gdb was in plasma-plasmashell.service aborted them which might be related to them varying so much. I'm attaching the journal around the time of these crashes. Dec 08 05:42:28 systemd[1444]: plasma-plasmashell.service: State 'stop-sigterm' timed out. Aborting. Dec 08 05:42:28 audit[3571]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=3571 comm="kioslave5" exe="/usr/libexec/kf5/kioslave5" sig=6 res=1 Dec 08 05:42:28 plasmashell[3581]: Fatal signal: Aborted Dec 08 05:42:28 plasmashell[3581]: ----- Backtrace ----- Dec 08 05:42:28 systemd[1444]: plasma-plasmashell.service: Killing process 3472 (plasmashell) with signal SIGABRT. Dec 08 05:42:28 plasmashell[3556]: KCrash: Application 'drkonqi' crashing... Dec 08 05:42:28 plasmashell[3556]: KCrash: Attempting to start /usr/libexec/drkonqi Dec 08 05:42:28 systemd[1444]: plasma-plasmashell.service: Killing process 3556 (drkonqi) with signal SIGABRT. Dec 08 05:42:28 systemd[1444]: plasma-plasmashell.service: Killing process 3571 (kioslave5) with signal SIGABRT. Dec 08 05:42:28 systemd[1444]: plasma-plasmashell.service: Killing process 3581 (gdb) with signal SIGABRT. Dec 08 05:42:28 systemd[1]: Created slice system-systemd\x2dcoredump.slice - Slice /system/systemd-coredump. There was a trace in the journal involving the drkonqi Python program /usr/share/drkonqi/gdb/preamble.py though I'm not sure if it was for the first or second drkonqi crash on plasmashell or drkonqi. plasmashell might've crashed a second time when drkonqi ran /usr/share/drkonqi/gdb/preamble.py in gdb. Dec 08 05:42:53 plasmashell[3633]: Traceback (most recent call last): Dec 08 05:42:53 plasmashell[3633]: File "<string>", line 1, in <module> Dec 08 05:42:53 plasmashell[3633]: File "/usr/share/drkonqi/gdb/preamble.py", line 620, in print_preamble Dec 08 05:42:53 plasmashell[3633]: print_qml_trace() Dec 08 05:42:53 plasmashell[3633]: File "/usr/share/drkonqi/gdb/preamble.py", line 578, in print_qml_trace Dec 08 05:42:53 plasmashell[3633]: ret = qml_trace_frame(frame) Dec 08 05:42:53 plasmashell[3633]: ^^^^^^^^^^^^^^^^^^^^^^ Dec 08 05:42:53 plasmashell[3633]: File "/usr/share/drkonqi/gdb/preamble.py", line 518, in qml_trace_frame Dec 08 05:42:53 plasmashell[3633]: dereferenced_type = typeobj.target().unqualified() Dec 08 05:42:53 plasmashell[3633]: ^^^^^^^^^^^^^^^^ Dec 08 05:42:53 plasmashell[3633]: KeyboardInterrupt Dec 08 05:42:53 plasmashell[3633]: /tmp/drkonqi.wHnfVC:3: Error in sourced command file: Dec 08 05:42:53 plasmashell[3633]: Error while executing Python code. I reported this problem at https://bugs.kde.org/show_bug.cgi?id=478287 There are systemd service watchdog timeouts which default to 45 s like DefaultTimeoutStopSec=45s described in man systemd-user.conf. /usr/lib/systemd/user/plasma-plasmashell.service had TimeoutSec=40sec. So when drkonqi was still creating the trace of plasmashell 40 s after plasmashell crashed, systemd aborted plasma-plasmashell.service's processes plasmashell, drkonqi, kioslave5, gdb. Fedora processes use the drop-in configuration file /usr/lib/systemd/user/service.d/10-timeout-abort.conf which has TimeoutStopFailureMode=abort which makes processes abort when timing out to generate core dumps https://fedoraproject.org/wiki/Changes/Shorter_Shutdown_Timer I changed the timeout to TimeoutSec=120sec, logged out and logged in. I reproduced the plasmashell crash, and the trace completed after about 40 s. drkonqi, plasmashell, and kioslave5 were aborted after 120 s. The default timeout of 40 s for plasma-plasmashell.service wasn't long enough to trace plasmashell and report the crash. I previously removed the qt5, glib2, and glibc debuginfo packages I had installed and reproduced the plasmashell crash. drkonqi and kioslave5 didn't crash when I created a trace in drkonqi, but gdb crashed with a segmentation fault and drkonqi showed that the crash information couldn't be created. This might be a different problem though. Core was generated by `/usr/bin/gdb -nw -n -batch -x /tmp/drkonqi.TTkFsq -x /tmp/drkonqi.lSUBPQ -p 183'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00005602a71e2ebc in operator() (__closure=<optimized out>, msg=0x5602a7ea2880 "0x5602a71e3140 ") at ../../gdb/bt-utils.c:59 59 gdb_stderr->write_async_safe (msg, strlen (msg)); [Current thread is 1 (Thread 0x7fdb2f086080 (LWP 19378))] (gdb) bt #0 0x00005602a71e2ebc in operator() (__closure=<optimized out>, msg=0x5602a7ea2880 "0x5602a71e3140 ") at ../../gdb/bt-utils.c:59 #1 libbacktrace_print (data=data@entry=0x0, pc=pc@entry=94569393697088, filename=0x7fdaf1405c90 "../../gdb/bt-utils.c", lineno=122, function=0x7fdaffe1d0b9 "gdb_internal_backtrace_1") at ../../gdb/bt-utils.c:94 #2 0x00005602a78c77d7 in report_inlined_functions (pc=pc@entry=94569393697088, callback=callback@entry=0x5602a71e2e50 <libbacktrace_print(void*, uintptr_t, char const*, int, char const*)>, data=data@entry=0x0, filename=filename@entry=0x5602a7ea2a70, lineno=0x5602a7ea2a30, function=0x7fdaf13e9fb8) at ../../libbacktrace/dwarf.c:3612 #3 0x00005602a78ca932 in dwarf_lookup_pc (state=<optimized out>, ddata=<optimized out>, pc=<optimized out>, callback=<optimized out>, error_callback=<optimized out>, data=<optimized out>, found=<optimized out>) at ../../libbacktrace/dwarf.c:3879 #4 0x00005602a78cc316 in dwarf_fileline (state=0x7fdb2f1d3000, pc=94569393697088, callback=0x5602a71e2e50 <libbacktrace_print(void*, uintptr_t, char const*, int, char const*)>, error_callback=0x5602a71e2d30 <libbacktrace_error(void*, char const*, int)>, data=0x0) at ../../libbacktrace/dwarf.c:3906 #5 0x00005602a78c0ae3 in unwind (context=<optimized out>, vdata=0x5602a7ea2dd0) at ../../libbacktrace/backtrace.c:91 #6 0x00007fdb2e72488d in _Unwind_Backtrace () from /lib64/libgcc_s.so.1 #7 0x00005602a78c0b6c in backtrace_full (state=0x7fdb2f1d3000, skip=<optimized out>, callback=<optimized out>, error_callback=<optimized out>, data=<optimized out>) at ../../libbacktrace/backtrace.c:127 --Type <RET> for more, q to quit, c to continue without paging--c #8 0x00005602a71e3141 in gdb_internal_backtrace_1 () at ../../gdb/bt-utils.c:122 #9 gdb_internal_backtrace () at ../../gdb/bt-utils.c:168 #10 0x00005602a7320253 in handle_fatal_signal (sig=sig@entry=11) at ../../gdb/event-top.c:895 #11 0x00005602a732042a in handle_sigsegv (sig=11) at ../../gdb/event-top.c:968 #12 <signal handler called> #13 block::scope (this=<optimized out>) at ../../gdb/block.c:293 #14 0x00005602a7267067 in cp_lookup_transparent_type (name=0x5602a93ce0b0 "QApplication") at ../../gdb/cp-namespace.c:1029 #15 0x00005602a735c09d in check_typedef (type=<optimized out>, type@entry=0x5602a93da450) at ../../gdb/gdbtypes.c:3052 #16 0x00005602a733e650 in language_defn::read_var_value (this=<optimized out>, var=0x5602aaa651b0, var_block=0x0, frame=...) at ../../gdb/findvar.c:518 #17 0x00005602a733d833 in read_var_value (var=var@entry=0x5602aaa651b0, var_block=var_block@entry=0x0, frame=...) at ../../gdb/findvar.c:746 #18 0x00005602a74dd879 in sympy_value (self=<optimized out>, args=<optimized out>) at ../../gdb/python/py-symbol.c:306 #19 0x00007fdb2e9fb4d6 in method_vectorcall_VARARGS () from /lib64/libpython3.12.so.1.0 #20 0x00007fdb2ea0ac7c in PyObject_Vectorcall () from /lib64/libpython3.12.so.1.0 #21 0x00007fdb2e90f7e1 in _PyEval_EvalFrameDefault.cold () from /lib64/libpython3.12.so.1.0 #22 0x00007fdb2ea8a996 in PyEval_EvalCode () from /lib64/libpython3.12.so.1.0 #23 0x00007fdb2eaadafa in run_eval_code_obj () from /lib64/libpython3.12.so.1.0 #24 0x00007fdb2eaa8a7e in run_mod () from /lib64/libpython3.12.so.1.0 #25 0x00007fdb2ea9ab16 in PyRun_StringFlags () from /lib64/libpython3.12.so.1.0 #26 0x00007fdb2ea9aa64 in PyRun_SimpleStringFlags () from /lib64/libpython3.12.so.1.0 #27 0x00005602a74f22da in python_command (arg=<optimized out>, from_tty=<optimized out>) at ../../gdb/python/python.c:453 #28 0x00005602a721f795 in cmd_func (cmd=<optimized out>, args=<optimized out>, from_tty=<optimized out>) at ../../gdb/cli/cli-decode.c:2735 #29 0x00005602a762fb25 in execute_command (p=<optimized out>, p@entry=0x5602c3a05290 "py print_preamble()", from_tty=<optimized out>) at ../../gdb/top.c:575 #30 0x00005602a7320ab2 in command_handler (command=0x5602c3a05290 "py print_preamble()") at ../../gdb/event-top.c:555 #31 0x00005602a7630525 in read_command_file (stream=stream@entry=0x5602c3ee1af0) at ../../gdb/top.c:342 #32 0x00005602a722d0e9 in script_from_file (stream=stream@entry=0x5602c3ee1af0, file=file@entry=0x7ffd6cf49733 "/tmp/drkonqi.TTkFsq") at ../../gdb/cli/cli-script.c:1642 #33 0x00005602a721d45b in source_script_from_stream ( file_to_open=0x5602c38da360 "/tmp/drkonqi.TTkFsq", file=0x7ffd6cf49733 "/tmp/drkonqi.TTkFsq", stream=0x5602c3ee1af0) at ../../gdb/cli/cli-cmds.c:730 #34 source_script_with_search (file=0x7ffd6cf49733 "/tmp/drkonqi.TTkFsq", file@entry=<error reading variable: value has been optimized out>, from_tty=<error reading variable: value has been optimized out>, search_path=<error reading variable: value has been optimized out>) at ../../gdb/cli/cli-cmds.c:775 #35 0x00005602a740d90a in catch_command_errors (command=<optimized out>, arg=<optimized out>, from_tty=<optimized out>, do_bp_actions=do_bp_actions@entry=false) at ../../gdb/main.c:513 #36 0x00005602a740d9b8 in execute_cmdargs (cmdarg_vec=cmdarg_vec@entry=0x7ffd6cf48a90, file_type=file_type@entry=CMDARG_FILE, cmd_type=cmd_type@entry=CMDARG_COMMAND, ret=ret@entry=0x7ffd6cf48a84) at ../../gdb/main.c:609 #37 0x00005602a740fe49 in captured_main_1 (context=context@entry=0x7ffd6cf48c90) at ../../gdb/main.c:1293 #38 0x00005602a7410870 in captured_main (data=0x7ffd6cf48c90) at ../../gdb/main.c:1314 #39 gdb_main (args=args@entry=0x7ffd6cf48cd0) at ../../gdb/main.c:1343 #40 0x00005602a70e0bb0 in main (argc=11, argv=0x7ffd6cf48e28) at ../../gdb/gdb.c:47 |