tarantool
tarantool copied to clipboard
test: log_destroy() sometimes segfaults on app-tap/logger.test.lua
Tarantool version: 2.3.0-61-g5b9f207df OS version: Gentoo Linux.
How to reproduce:
$ cmake . -DCMAKE_BUILD_TYPE=Debug -DENABLE_BACKTRACE=ON -DENABLE_DIST=ON && make -j
$ TEST_RUN_TESTS="$(yes app-tap/logger.test.lua | head -n 1000)" make test # several times
Backtrace:
(gdb) bt
#0 0x00007fe9392d9f1b in raise () from /lib64/libc.so.6
#1 0x00007fe9392c3535 in abort () from /lib64/libc.so.6
#2 0x0000560611c11ef7 in sig_fatal_cb (signo=11, siginfo=0x7fff252656f0, context=0x7fff252655c0) at /home/alex/p/tarantool-meta/r/t-2/src/main.cc:300
#3 <signal handler called>
#4 0x0000560611d52d13 in fiber_yield () at /home/alex/p/tarantool-meta/r/t-2/src/lib/core/fiber.c:478
#5 0x0000560611d52ed1 in fiber_yield_timeout (delay=3153600000) at /home/alex/p/tarantool-meta/r/t-2/src/lib/core/fiber.c:522
#6 0x0000560611d5b286 in fiber_cond_wait_timeout (c=0x5606122037a0 <log_std+96>, timeout=3153600000) at /home/alex/p/tarantool-meta/r/t-2/src/lib/core/fiber_cond.c:107
#7 0x0000560611d5b354 in fiber_cond_wait (c=0x5606122037a0 <log_std+96>) at /home/alex/p/tarantool-meta/r/t-2/src/lib/core/fiber_cond.c:117
#8 0x0000560611d50af4 in log_destroy (log=0x560612203740 <log_std>) at /home/alex/p/tarantool-meta/r/t-2/src/lib/core/say.c:1178
#9 0x0000560611d4e9d5 in say_logger_free () at /home/alex/p/tarantool-meta/r/t-2/src/lib/core/say.c:714
#10 0x0000560611c12fda in tarantool_free () at /home/alex/p/tarantool-meta/r/t-2/src/main.cc:639
#11 0x0000560611c138cd in main (argc=1, argv=0x560612859f18) at /home/alex/p/tarantool-meta/r/t-2/src/main.cc:864
Way to reproduce:
printf "log = require('log')\nbox.cfg{log = 'temp.log'}\nlog.rotate()\nos.exit()" > repr.lua
./tarantool repr.lua
Result:
Segmentation fault
code: SEGV_MAPERR
addr: 0x68
context: 0x7ffe639ac9c0
siginfo: 0x7ffe639acaf0
rax 0x0 0
rbx 0x0 0
rcx 0x56024afee480 94567848141952
rdx 0x47 71
rsi 0xe 14
rdi 0x5602490fb2f8 94567815688952
rsp 0x7ffe639ad070 140730569511024
rbp 0x7ffe639ad090 140730569511056
r8 0x7 7
r9 0x1 1
r10 0x8 8
r11 0x202 514
r12 0x560200000000 94566589923328
r13 0x0 0
r14 0x0 0
r15 0x0 0
rip 0x560248c0208e 94567810474126
eflags 0x10202 66050
cs 0x33 51
gs 0x0 0
fs 0x0 0
cr2 0x68 104
err 0x4 4
oldmask 0x0 0
trapno 0xe 14
Current time: 1591793154
Please file a bug at http://github.com/tarantool/tarantool/issues
Attempting backtrace... Note: since the server has already crashed,
this may fail as well
#0 0x560248c065a1 in print_backtrace+d
#1 0x560248aaaf82 in _ZL12sig_fatal_cbiP9siginfo_tPv+1eb
#2 0x7fe1817b33c0 in funlockfile+60
#3 0x560248c0208e in fiber_yield+80
#4 0x560248c02243 in fiber_yield_timeout+9e
#5 0x560248c0b018 in fiber_cond_wait_timeout+4f
#6 0x560248c0b0ea in fiber_cond_wait+28
#7 0x560248bff5d9 in log_destroy+46
#8 0x560248bfd47e in say_logger_free+1d
#9 0x560248aac120 in _Z14tarantool_freev+105
#10 0x560248aaca50 in main+735
#11 0x7fe180fa20b3 in __libc_start_main+f3
#12 0x560248aaa5fe in _start+2e
Aborted (core dumped)
The problem is that ev_break() is called before modules start destruction. Regardless of how you terminate tarantool - using os.exit(), or the script ended. tarantool_exit() is always called before tarantool_free(), and so ev_break(). It means, inside tarantool_free() it is not ok to use any scheduling related functionality - it relies on the loop being active.
Don't have a solution for it yet.
Reopened by #7643.