mod_google_transcribe: segfault at google_speech_session_cleanup()

[vcc-core]

Hi,

I'd like to report a segfault.

bt:

#0  GStreamer::writesDone (this=0x0) at google_glue.cpp:142
#1  google_speech_session_cleanup (session=0x7f417c047938, channelIsClosing=1) at google_glue.cpp:321
#2  0x00007f414641286c in capture_callback (bug=0x7f4140150238, user_data=0x7f410cb1c958, type=SWITCH_ABC_TYPE_CLOSE) at mod_google_transcribe.c:66
#3  0x00007f41abfdd82a in switch_core_media_bug_close (bug=0x7f4146356bb8, destroy=SWITCH_FALSE) at src/switch_core_media_bug.c:1263
#4  0x00007f41abfdd69c in switch_core_media_bug_remove_all_function (session=0x7f417c047938, function=0x0) at src/switch_core_media_bug.c:1231
#5  0x00007f41ac009d79 in switch_core_session_hangup_state (session=0x7f417c047938, force=SWITCH_TRUE) at src/switch_core_state_machine.c:839
#6  0x00007f41ac00676a in switch_core_session_run (session=0x7f417c047938) at src/switch_core_state_machine.c:616
#7  0x00007f41abfff4bc in switch_core_session_thread (thread=0x7f41804469a0, obj=0x7f417c047938) at src/switch_core_session.c:1709
#8  0x00007f41abfff8ce in switch_core_session_thread_pool_worker (thread=0x7f41804469a0, obj=0x7f4180446830) at src/switch_core_session.c:1772
#9  0x00007f41ac71b1d4 in dummy_worker () from /opt/freeswitch/lib/libfreeswitch.so.1
#10 0x00007f41ab9836db in start_thread (arg=0x7f4146357700) at pthread_create.c:463
#11 0x00007f41ab6ac88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

bt full:

#0  GStreamer::writesDone (this=0x0) at google_glue.cpp:142
No locals.
#1  google_speech_session_cleanup (session=0x7f417c047938, channelIsClosing=1) at google_glue.cpp:321
        cb = 0x7f410cb1c958
        streamer = 0x0
        st = SWITCH_STATUS_SUCCESS
        channel = 0x7f417c072d90
        bug = 0x7f4140150238
        __func__ = "google_speech_session_cleanup"
#2  0x00007f414641286c in capture_callback (bug=0x7f4140150238, user_data=0x7f410cb1c958, type=SWITCH_ABC_TYPE_CLOSE) at mod_google_transcribe.c:66
        session = 0x7f417c047938
        __func__ = "capture_callback"
#3  0x00007f41abfdd82a in switch_core_media_bug_close (bug=0x7f4146356bb8, destroy=SWITCH_FALSE) at src/switch_core_media_bug.c:1263
        bp = 0x7f4140150238
        __func__ = "switch_core_media_bug_close"
#4  0x00007f41abfdd69c in switch_core_media_bug_remove_all_function (session=0x7f417c047938, function=0x0) at src/switch_core_media_bug.c:1231
        bp = 0x7f4140150238
        last = 0x0
        next = 0x0
        status = SWITCH_STATUS_FALSE
        closed = 0x7f4140150238
        __func__ = "switch_core_media_bug_remove_all_function"
#5  0x00007f41ac009d79 in switch_core_session_hangup_state (session=0x7f417c047938, force=SWITCH_TRUE) at src/switch_core_state_machine.c:839
        cause = SWITCH_CAUSE_NORMAL_CLEARING
        cause_q850 = SWITCH_CAUSE_NORMAL_CLEARING
        proceed = 1
        global_proceed = 1
        do_extra_handlers = 1
        silly = 0
        index = 0
        state = CS_HANGUP
        midstate = CS_HANGUP
        endpoint_interface = 0x55ff5e1e0530
        driver_state_handler = 0x7f416b3932a0 <rtc_event_handlers>
        application_state_handler = 0x0
        hook_var = 0x3a4f1ac9ff3f3000 <error: Cannot access memory at address 0x3a4f1ac9ff3f3000>
        use_session = 0
        __func__ = "switch_core_session_hangup_state"
        __PRETTY_FUNCTION__ = "switch_core_session_hangup_state"
#6  0x00007f41ac00676a in switch_core_session_run (session=0x7f417c047938) at src/switch_core_state_machine.c:616
        global_proceed = 1
        index = 0
        proceed = 1
        do_extra_handlers = 1
        ptr = 0x0
        rstatus = SWITCH_STATUS_SUCCESS
        state = CS_HANGUP
        midstate = CS_HANGUP
        endstate = CS_HANGUP
        endpoint_interface = 0x55ff5e1e0530
        driver_state_handler = 0x7f416b3932a0 <rtc_event_handlers>
        application_state_handler = 0x0
        silly = 0
        new_loops = 500
        __PRETTY_FUNCTION__ = "switch_core_session_run"
        __func__ = "switch_core_session_run"
#7  0x00007f41abfff4bc in switch_core_session_thread (thread=0x7f41804469a0, obj=0x7f417c047938) at src/switch_core_session.c:1709
        session = 0x7f417c047938
        event = 0x7f4146356d50
        event_str = 0x0
        val = 0x7f4146356d50 "\260m5FA\177"
        __func__ = "switch_core_session_thread"
        __PRETTY_FUNCTION__ = "switch_core_session_thread"
#8  0x00007f41abfff8ce in switch_core_session_thread_pool_worker (thread=0x7f41804469a0, obj=0x7f4180446830) at src/switch_core_session.c:1772
        td = 0x7f417c040888
        pop = 0x7f417c040888
        check_status = SWITCH_STATUS_SUCCESS
        node = 0x7f4180446830
        pool = 0x7f4180446748
        __func__ = "switch_core_session_thread_pool_worker"
#9  0x00007f41ac71b1d4 in dummy_worker () from /opt/freeswitch/lib/libfreeswitch.so.1
No symbol table info available.
#10 0x00007f41ab9836db in start_thread (arg=0x7f4146357700) at pthread_create.c:463
        pd = 0x7f4146357700
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139918327510784, 3401557513280429578, 139918327508672, 0, 139919301568928, 139919301568576, -3335391733362713078, -3335032375844266486}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
#11 0x00007f41ab6ac88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
No locals.

We are using the latest version of the module. Would you please take a look?

[davehorton]

does this happen every time, or no? Is it recreatable? If so, would it be possible to get the freeswitch log for when it happens?

[vcc-core]

I have attached the log: freeswitch_log.txt

does this happen every time, or no? Is it recreatable?

It's non-deterministic. We have been using it (albeit not much) for 2 weeks and we got 1 crash. And during the development of a solution using your module never crashed for me. Thus I'm not sure how to reproduce.

[davehorton]

Can you test with the above commit? I think that should fix it

[davehorton]

were you able to test with the latest code?

[vcc-core]

@davehorton : Sorry, the patched FS is still not deployed, it will probably be rolled out from next week's Monday to Wednesday.