segfault in delete_handle(handle_list *)

[Joe Buehler]

I am tracking down a problem that shows up in the ksh93 regression tests.
I get a segfault during a fork():

11512730 [proc] ksh 593 delete_handle: nuking handle 'events[0]'
11512737 [main] ksh 593 delete_handle: nuking handle 'pinfo_shared_handle'
11512962 [proc] ksh 593 wait_subproc: done
11513573 [main] ksh 593 handle_exceptions: In cygwin_except_handler exc 0xC0000005 at 0x610098A3 sp 0x22F310
11513840 [main] ksh 593 handle_exceptions: In cygwin_except_handler sig = 11 at 0x610098A3
11514410 [main] ksh 593 handle_exceptions: In cygwin_except_handler calling 0x0
11514738 [main] ksh 593 try_to_debug: debugger_command 'q:/.hekimian.com/cygwin-shared/bin/dumper.exe e:/cygwin/usr/local/src/ast-src/BUILDDIR/arch/cygwin.i386/bin/ksh.exe'
11515824 [main] ksh 593 open_stackdumpfile: Dumping stack trace to ksh.exe.stackdump

Looking at the instructions around eip:

0x61009895 <_Z13delete_handleP11handle_list+65>:	call   0x6108c182 <_ZN6strace5prntfEjPKcS1_z>
0x6100989a <_Z13delete_handleP11handle_list+70>:	mov    0x8(%ebp),%edx
0x6100989d <_Z13delete_handleP11handle_list+73>:	mov    0x8(%ebp),%eax
0x610098a0 <_Z13delete_handleP11handle_list+76>:	mov    0x18(%eax),%eax
0x610098a3 <_Z13delete_handleP11handle_list+79>:	mov    0x18(%eax),%eax # segfault here
0x610098a6 <_Z13delete_handleP11handle_list+82>:	mov    %eax,0x18(%edx)

It looks like this corresponds to "hl->next = hl->next->next;" in the code:

static void __stdcall
delete_handle (handle_list *hl)
{
   handle_list *hnuke = hl->next;
   debug_printf ("nuking handle '%s'", hnuke->name);
   hl->next = hl->next->next;
   memset (hnuke, 0, sizeof (*hnuke));
}

The segfault indicates that hl->next is a bad pointer.  But that doesn't
make much sense because it was just dereferenced for the debug_printf().
So that makes me suspect that there is a thread issue here.

Before I dive in and try and figure this out, I have attached the
fork() part of the strace output, in case the problem is obvious to someone who
knows this part of Cygwin well.  Is it possible that another thread is walking
the same handle list at the same time?

One thing that is highly suspicious is that there is another call in another thread
to delete_handle 7 microseconds before the one that fails:

11512730 [proc] ksh 593 delete_handle: nuking handle 'events[0]'
11512737 [main] ksh 593 delete_handle: nuking handle 'pinfo_shared_handle'
-- 
Joe Buehler
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: trace.txt
URL: <http://cygwin.com/pipermail/cygwin-developers/attachments/20030326/5b6a02fd/attachment.txt>