Crash with singleton_pool in multithreaded mode

[philippeb8@…]

Hi,

I am making calls to singleton_pool::ordered_malloc() with 2 different threads and the application is crashing. The code can be found here: ​https://svn.boost.org/svn/boost/sandbox/block_ptr/libs/smart_ptr/example/thread_test.cpp

And I get the following backtrace:

#0 0x0000000000407766 in boost::simple_segregated_storage<unsigned long>::try_malloc_n (start=@0x40a30dd0, n=10, partition_size=8)

at /home/vnmr1/phil/boost_1_46_1/boost/pool/simple_segregated_storage.hpp:236

#1 0x000000000040781b in boost::simple_segregated_storage<unsigned long>::malloc_n (this=0x614ae8, n=11, partition_size=8)

at /home/vnmr1/phil/boost_1_46_1/boost/pool/simple_segregated_storage.hpp:260

#2 0x000000000040af4f in boost::pool<boost::default_user_allocator_new_delete>::ordered_malloc (this=0x614ae8, n=88)

at /home/vnmr1/phil/boost_1_46_1/boost/pool/pool.hpp:527

#3 0x000000000040b392 in boost::singleton_pool<boost::detail::sh::pool, 1u, boost::default_user_allocator_new_delete, boost::details::pool::pthread_mutex, 32u, 0u>::ordered_malloc (n=88)

at /home/vnmr1/phil/boost_1_46_1/boost/pool/singleton_pool.hpp:72

#4 0x000000000040d7ce in boost::detail::sh::pool::allocate (this=0x6148d0,

s=88) at ../../../boost/detail/block_base.hpp:130

#5 0x000000000040d83a in boost::detail::sh::block<std::pair<int, int> >::operator new (s=88) at ../../../boost/detail/block_base.hpp:271 #6 0x000000000040d85d in boost::detail::sh::make_block<std::pair<int, int>, std::pair<int, int> > (t0=@0x40a31030) at ../../../boost/block_ptr.hpp:480 #7 0x0000000000405e97 in worker (id=0) at thread_test.cpp:17 #8 0x0000000000408a20 in boost::_bi::list1<boost::_bi::value<int> >::operator()<void (*)(int), boost::_bi::list0> (this=0x1a0cf5b0, f=@0x1a0cf5a8,

a=@0x40a310cf) at /home/vnmr1/phil/boost_1_46_1/boost/bind/bind.hpp:253

#9 0x0000000000408a5e in boost::_bi::bind_t<void, void (*)(int), boost::_bi::list1<boost::_bi::value<int> > >::operator() (this=0x1a0cf5a8)

at /home/vnmr1/phil/boost_1_46_1/boost/bind/bind_template.hpp:20

#10 0x0000000000408a7c in boost::detail::thread_data<boost::_bi::bind_t<void, void (*)(int), boost::_bi::list1<boost::_bi::value<int> > > >::run (

this=0x1a0cf420) at /home/vnmr1/phil/boost_1_46_1/boost/thread/detail/thread.hpp:61

#11 0x00002b93700f9914 in thread_proxy ()

from /home/vnmr1/phil/lib/libboost_thread.so.1.46.1

#12 0x0000003906a06367 in start_thread () from /lib64/libpthread.so.0 #13 0x0000003905ed30ad in clone () from /lib64/libc.so.6

Thanks, -Phil

[philippeb8@…]

I added mutexes before the pool subroutines are called and I still get the crash. The new backtrace is: #0 0x00000000004071a4 in boost::simple_segregated_storage<unsigned long>::try_malloc_n (start=@0x42555dc0, n=10, partition_size=8)

at /home/vnmr1/phil/boost_1_46_1/boost/pool/simple_segregated_storage.hpp:236

#1 0x0000000000407259 in boost::simple_segregated_storage<unsigned long>::malloc_n (this=0x6136c8, n=11, partition_size=8)

at /home/vnmr1/phil/boost_1_46_1/boost/pool/simple_segregated_storage.hpp:260

#2 0x000000000040b3c3 in boost::pool<boost::default_user_allocator_new_delete>::ordered_malloc (this=0x6136c8, n=88)

at /home/vnmr1/phil/boost_1_46_1/boost/pool/pool.hpp:527

#3 0x000000000040b87c in boost::singleton_pool<boost::detail::sh::pool, 1u, boost::default_user_allocator_new_delete, boost::details::pool::pthread_mutex, 32u, 0u>::ordered_malloc (n=88)

at /home/vnmr1/phil/boost_1_46_1/boost/pool/singleton_pool.hpp:72

#4 0x000000000040cc7a in boost::detail::sh::pool::allocate (s=88)

at ../../../boost/detail/block_base.hpp:131

#5 0x000000000040cd09 in boost::detail::sh::block<std::pair<int, int> >::operator new (s=88) at ../../../boost/detail/block_base.hpp:274 #6 0x000000000040cd2d in boost::detail::sh::make_block<std::pair<int, int>, std::pair<int, int> > (t0=@0x42556030) at ../../../boost/block_ptr.hpp:492 #7 0x00000000004059ff in worker (id=1) at thread_test.cpp:17 #8 0x00000000004083ba in boost::_bi::list1<boost::_bi::value<int> >::operator()<void (*)(int), boost::_bi::list0> (this=0xf2e3610, f=@0xf2e3608,

a=@0x425560cf) at /home/vnmr1/phil/boost_1_46_1/boost/bind/bind.hpp:253

#9 0x00000000004083f8 in boost::_bi::bind_t<void, void (*)(int), boost::_bi::list1<boost::_bi::value<int> > >::operator() (this=0xf2e3608)

at /home/vnmr1/phil/boost_1_46_1/boost/bind/bind_template.hpp:20

#10 0x0000000000408416 in boost::detail::thread_data<boost::_bi::bind_t<void, void (*)(int), boost::_bi::list1<boost::_bi::value<int> > > >::run (

this=0xf2e3480) at /home/vnmr1/phil/boost_1_46_1/boost/thread/detail/thread.hpp:61

#11 0x00002b1169e3d914 in thread_proxy ()

from /home/vnmr1/phil/lib/libboost_thread.so.1.46.1

#12 0x0000003906a06367 in start_thread () from /lib64/libpthread.so.0 #13 0x0000003905ed30ad in clone () from /lib64/libc.so.6

Thanks, -Phil

[anonymous]

I think the crash in Pool is the sympton not the cause - if I remove all the thread code, and just call worker() directly in your test program, then I still get a crash, and Pool isn't mentioned at all:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb74d1940 (LWP 6630)]
0x0804fa86 in boost::numeric::in<long, boost::numeric::interval_lib::policies<boost::numeric::interval_lib::rounded_math<long>, boost::numeric::interval_lib::checking_strict<long> > > (x=@0xbfd81920, y=@0xb7452700)
    at /home/john/boost/Trunk/boost/numeric/interval/utility.hpp:121
121	  return y.lower() <= x && x <= y.upper();
(gdb) bt
#0  0x0804fa86 in boost::numeric::in<long, boost::numeric::interval_lib::policies<boost::numeric::interval_lib::rounded_math<long>, boost::numeric::interval_lib::checking_strict<long> > > (x=@0xbfd81920, y=@0xb7452700)
    at /home/john/boost/Trunk/boost/numeric/interval/utility.hpp:121
#1  0x0804e29d in boost::detail::sh::pool::deallocate (p=0x806605c, s=52)
    at ../../../boost/detail/block_base.hpp:172
#2  0x08051c57 in boost::detail::sh::block<std::pair<int, int> >::operator delete (p=0x806605c) at ../../../boost/detail/block_base.hpp:309
#3  0x08054b4c in ~block (this=0x806605c)
    at ../../../boost/detail/block_base.hpp:258
#4  0x0804d286 in boost::detail::sp_counted_base::destroy (this=0x806605c)
    at /home/john/boost/Trunk/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:126
#5  0x0804d348 in boost::detail::sp_counted_base::weak_release (this=0x806605c)
    at /home/john/boost/Trunk/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:159
#6  0x0804d2fd in boost::detail::sp_counted_base::release (this=0x806605c)
    at /home/john/boost/Trunk/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:146
#7  0x0805320a in boost::detail::sh::block_ptr_common<std::pair<int, int> >::reset (this=0x8064bc4, p=0x0) at ../../../boost/detail/block_ptr_base.hpp:124
#8  0x08051d9b in boost::detail::sh::block_ptr<std::pair<int, int> >::release (
    this=0x8064bc4, d=true) at ../../../boost/block_ptr.hpp:445
---Type <return> to continue, or q <return> to quit---
#9  0x080500cf in ~block_ptr (this=0x8064bc4)
    at ../../../boost/block_ptr.hpp:405
#10 0xb7500084 in exit () from /lib/tls/i686/cmov/libc.so.6
#11 0xb74e8458 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6
#12 0x0804c531 in _start ()

[anonymous]

I also encountered the same problem.

[anonymous]

I also encountered the same problem.

segment falut.

#0 0x0000000000479141 in boost::simple_segregated_storage<unsigned long>::malloc (this=0x6f5048) at /usr/include/boost/pool/simple_segregated_storage.hpp:104 104 first = nextof(first); (gdb) bt #0 0x0000000000479141 in boost::simple_segregated_storage<unsigned long>::malloc (this=0x6f5048) at /usr/include/boost/pool/simple_segregated_storage.hpp:104 #1 0x0000000000479edf in boost::pool<boost::default_user_allocator_new_delete>::malloc (this=0x6f5048) at /usr/include/boost/pool/pool.hpp:221 #2 0x0000000000479f24 in boost::singleton_pool<obt::ipmsg, 1056u, boost::default_user_allocator_new_delete, boost::details::pool::pthread_mutex, 32u>::malloc ()

at /usr/include/boost/pool/singleton_pool.hpp:59

#3 0x00000000004acbec in obt::send_handler_impl::send_task_msg (this=0x1edfad40, tsk=0x22942ad8, buf=0x2aaafbcca24e "o\002\003?@hKi!", len=964)

at /home/OpenIPTV/trunk/p2pcore/server/dataserver/main/sender.cpp:103

#4 0x00000000004acfb5 in obt::send_handler_impl::svc (this=0x1edfad40) at /home/OpenIPTV/trunk/p2pcore/server/dataserver/main/sender.cpp:183 #5 0x00000000004adfc4 in boost::_mfi::mf0<int, obt::send_handler_impl>::operator() (this=0x1edfa8a0, p=0x1edfad40) at /usr/include/boost/bind/mem_fn_template.hpp:45 #6 0x00000000004ae032 in boost::_bi::list1<boost::_bi::value<obt::send_handler_impl*> >::operator()<int, boost::_mfi::mf0<int, obt::send_handler_impl>, boost::_bi::list0> (

this=0x1edfa8b0, f=@0x1edfa8a0, a=@0x429eb04f) at /usr/include/boost/bind.hpp:220

#7 0x00000000004ae070 in boost::_bi::bind_t<int, boost::_mfi::mf0<int, obt::send_handler_impl>, boost::_bi::list1<boost::_bi::value<obt::send_handler_impl*> > >::operator() (

this=0x1edfa8a0) at /usr/include/boost/bind/bind_template.hpp:20

#8 0x00000000004ae08f in boost::detail::function::function_obj_invoker0<boost::_bi::bind_t<int, boost::_mfi::mf0<int, obt::send_handler_impl>, boost::_bi::list1<boost::_bi::value<obt::send_handler_impl*> > >, int>::invoke (function_obj_ptr={obj_ptr = 0x1edfa8a0, const_obj_ptr = 0x1edfa8a0, func_ptr = 0x1edfa8a0, data = "?"})

at /usr/include/boost/function/function_template.hpp:119

#9 0x000000000047ff6c in boost::function0<int, std::allocator<void> >::operator() (this=0x1edfade8) at /usr/include/boost/function/function_template.hpp:576 #10 0x000000000047ff95 in obt::thread::svc (arg=0x1edfadd8) at /home/OpenIPTV/trunk/p2pcore/server/dataserver/../../include/obt/thread.h:23 #11 0x000000363ec064a7 in start_thread () from /lib64/libpthread.so.0 #12 0x000000363e0d3c2d in clone () from /lib64/libc.so.6 (gdb) quit