[BRLTTY] Crash of BRLTTY in X session

Wed Nov 13 18:54:34 UTC 2024

Hi

Samuel Thibault schrieb am 06.11.2024,  1:30 +0100:
>Sebastian Humenda, le mar. 05 nov. 2024 10:52:19 +0100, a ecrit:
>> With BRLTTY 6.7, BRLTTY crashed while I was using Orca in the X session. The
>> back trace is below.
>
>> Thread 1 (Thread 0x7f2092ffe6c0 (LWP 589460)):
>> #5  0x00007f20963ec7ba in malloc_printerr (str=str at entry=0x7f20964ef0b1 "free(): invalid pointer") at ./malloc/malloc.c:5660
>> #6  0x00007f20963ee544 in _int_free (av=<optimized out>, p=<optimized out>, have_lock=have_lock at entry=0) at ./malloc/malloc.c:4435
>> #7  0x00007f20963f0e9f in __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3385
>> #8  0x00005637596a87bc in freeKeyrangeList (l=l at entry=0x7f2084025ce0) at ../../Programs/brlapi_keyranges.c:65
>> #9  0x00005637596a12c6 in doLeaveTty (c=c at entry=0x7f2084025c50) at ../../Programs/brlapi_server.c:993
>
>So it'd either be a concurrent operation on c->acceptedKeys, or a memory
>corruption from somewhere else. This code has not really changed since
>6.6, so it seems unlikely to me (and I have re-proofread it), so I'd
>tend to think about "somewhere else". Ideally you could run it through
>valgrind, but that'd probably be way too heavy. Perhaps you can
>recompile with CFLAGS=-fsanitize=address LDFLAGS=-fsanitize=address ?

I'm not sure whether it worked, as I did

CFLAGS += ...
export CFLAGS

in the debian/rules Makefile of the Debian packaging, and am hoping that the
flags got picked up.
The backtrace is below.
How would the backtraces change if the sanitizer is active?

Thanks!
Sebastian
===

Reading symbols from /bin/brltty...
Reading symbols from /usr/lib/debug/.build-id/f6/7bbfdcda035647641287f694787153d6919f19.debug...
[New LWP 995792]
[New LWP 995785]
[New LWP 995793]
[New LWP 995794]
[New LWP 1168124]
[New LWP 1168125]
[New LWP 995791]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/bin/brltty --no-daemon -s sd'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo at entry=6, no_tid=no_tid at entry=0) at ./nptl/pthread_kill.c:44
44	./nptl/pthread_kill.c: Datei oder Verzeichnis nicht gefunden.
[Current thread is 1 (Thread 0x7f4688dfe6c0 (LWP 995792))]
(gdb) thread apply all bt

Thread 7 (Thread 0x7f46895ff6c0 (LWP 995791)):
#0  0x00007f468c18a1df in __GI___poll (fds=0x7f46895febb0, nfds=1, timeout=timeout at entry=1000000) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00005626262c45be in poll (__timeout=1000000, __nfds=<optimized out>, __fds=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/poll2.h:39
#2  awaitMonitors (monitors=0x7f46895febd0, timeout=1000000) at ../../Programs/async_io.c:360
#3  asyncExecuteIoCallback (iod=<optimized out>, timeout=1000000) at ../../Programs/async_io.c:750
#4  0x00005626262c30ca in awaitAction (timeout=<optimized out>) at ../../Programs/async_wait.c:128
#5  asyncAwaitCondition (timeout=timeout at entry=1000000, testCondition=testCondition at entry=0x5626262f6020 <testTuneThreadStopping>, data=data at entry=0x0) at ../../Programs/async_wait.c:159
#6  0x00005626262c3210 in asyncWaitFor (testCondition=testCondition at entry=0x5626262f6020 <testTuneThreadStopping>, data=data at entry=0x0) at ../../Programs/async_wait.c:173
#7  0x00005626262f6276 in runTuneThread (argument=<optimized out>) at ../../Programs/tune.c:347
#8  0x00005626262c5d3f in runThread (argument=0x562632df3220) at ../../Programs/thread.c:46
#9  0x00007f468c1171c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#10 0x00007f468c19785c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 6 (Thread 0x7f4680ff96c0 (LWP 1168125)):
#0  __GI___libc_read (nbytes=1, buf=0x7f466c002ea3, fd=29) at ../sysdeps/unix/sysv/linux/read.c:26
#1  __GI___libc_read (fd=29, buf=0x7f466c002ea3, nbytes=1) at ../sysdeps/unix/sysv/linux/read.c:24
#2  0x00007f468c11016e in _IO_new_file_underflow (fp=0x7f466c002e20) at ./libio/libioP.h:947
#3  0x00007f468c104e78 in __GI___getdelim (lineptr=lineptr at entry=0x7f4680ff8c38, n=n at entry=0x7f4680ff8c28, delimiter=delimiter at entry=10, fp=0x7f466c002e20) at ./libio/iogetdelim.c:73
#4  0x00007f4689d406ca in getline (__stream=<optimized out>, __n=0x7f4680ff8c28, __lineptr=0x7f4680ff8c38) at /usr/include/x86_64-linux-gnu/bits/stdio.h:120
#5  get_reply (connection=connection at entry=0x7f466c0039b0) at ./src/api/c/libspeechd.c:1813
#6  0x00007f4689d40a60 in spd_events_handler (conn=0x7f466c0039b0) at ./src/api/c/libspeechd.c:1855
#7  0x00007f468c1171c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#8  0x00007f468c19785c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 5 (Thread 0x7f46817fa6c0 (LWP 1168124)):
#0  0x00007f468c18a1df in __GI___poll (fds=0x7f46817f9ba0, nfds=1, timeout=timeout at entry=453037) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00005626262c45be in poll (__timeout=453037, __nfds=<optimized out>, __fds=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/poll2.h:39
#2  awaitMonitors (monitors=0x7f46817f9bc0, timeout=453037) at ../../Programs/async_io.c:360
#3  asyncExecuteIoCallback (iod=<optimized out>, timeout=453037) at ../../Programs/async_io.c:750
#4  0x00005626262c30ca in awaitAction (timeout=<optimized out>) at ../../Programs/async_wait.c:128
#5  asyncAwaitCondition (timeout=timeout at entry=1000000, testCondition=testCondition at entry=0x562626310630 <testSpeechDriverThreadStopping>, data=data at entry=0x562632e4b250) at ../../Programs/async_wait.c:159
#6  0x00005626262c3210 in asyncWaitFor (testCondition=testCondition at entry=0x562626310630 <testSpeechDriverThreadStopping>, data=data at entry=0x562632e4b250) at ../../Programs/async_wait.c:173
#7  0x0000562626310ef8 in runSpeechDriverThread (argument=0x562632e4b250) at ../../Programs/spk_thread.c:835
#8  0x00005626262c5d3f in runThread (argument=0x562632e04090) at ../../Programs/thread.c:46
#9  0x00007f468c1171c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#10 0x00007f468c19785c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 4 (Thread 0x7f46837fe6c0 (LWP 995794)):
#0  0x00007f468c18a1df in __GI___poll (fds=0x7f467c01d550, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f468c5069ae in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f468c506cef in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f468c7627c6 in ?? () from /lib/x86_64-linux-gnu/libgio-2.0.so.0
#4  0x00007f468c530cfd in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007f468c1171c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#6  0x00007f468c19785c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 3 (Thread 0x7f4683fff6c0 (LWP 995793)):
#0  0x00007f468c18a1df in __GI___poll (fds=0x7f467c005e50, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f468c5069ae in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f468c506acc in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f468c506b11 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007f468c530cfd in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007f468c1171c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#6  0x00007f468c19785c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 2 (Thread 0x7f4689d7c900 (LWP 995785)):
#0  0x00007f468c18a1df in __GI___poll (fds=0x7ffe0849f3d0, nfds=8, timeout=timeout at entry=683) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00005626262c45be in poll (__timeout=683, __nfds=<optimized out>, __fds=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/poll2.h:39
#2  awaitMonitors (monitors=0x7ffe0849f420, timeout=683) at ../../Programs/async_io.c:360
#3  asyncExecuteIoCallback (iod=<optimized out>, timeout=683) at ../../Programs/async_io.c:750
#4  0x00005626262c30ca in awaitAction (timeout=<optimized out>) at ../../Programs/async_wait.c:128
#5  asyncAwaitCondition (timeout=timeout at entry=2147483647, testCondition=testCondition at entry=0x5626262b3a80 <checkUnmonitoredConditions>, data=data at entry=0x7ffe0849f520) at ../../Programs/async_wait.c:159
#6  0x00005626262b6254 in brlttyWait (duration=duration at entry=2147483647) at ../../Programs/core.c:1406
#7  0x00005626262b380a in brlttyRun () at ../../Programs/brltty.c:34
#8  main (argc=<optimized out>, argv=<optimized out>) at ../../Programs/brltty.c:255

Thread 1 (Thread 0x7f4688dfe6c0 (LWP 995792)):
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo at entry=6, no_tid=no_tid at entry=0) at ./nptl/pthread_kill.c:44
#1  0x00007f468c118f1f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  0x00007f468c0c9fb2 in __GI_raise (sig=sig at entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f468c0b4472 in __GI_abort () at ./stdlib/abort.c:79
#4  0x00007f468c10d430 in __libc_message (action=action at entry=do_abort, fmt=fmt at entry=0x7f468c227459 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#5  0x00007f468c12283a in malloc_printerr (str=str at entry=0x7f468c2250b1 "free(): invalid pointer") at ./malloc/malloc.c:5660
#6  0x00007f468c1245c4 in _int_free (av=<optimized out>, p=<optimized out>, have_lock=have_lock at entry=0) at ./malloc/malloc.c:4435
#7  0x00007f468c126f1f in __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3385
#8  0x00005626263142e0 in freeBrailleWindow (brailleWindow=0x7f467c025da0) at ../../Programs/brlapi_server.c:607
#9  doLeaveTty (c=c at entry=0x7f467c025d60) at ../../Programs/brlapi_server.c:994
#10 0x000056262631871f in processRequest (handlers=<optimized out>, c=0x7f467c025d60) at ../../Programs/brlapi_server.c:2750
#11 handleTtyFds (fds=fds at entry=0x7f4688dfcb30, currentTime=currentTime at entry=1731512927, tty=0x7f467c01b590) at ../../Programs/brlapi_server.c:3598
#12 0x000056262631885a in handleTtyFds (fds=fds at entry=0x7f4688dfcb30, currentTime=1731512927, tty=tty at entry=0x562626367ee0 <ttys>) at ../../Programs/brlapi_server.c:3616
#13 0x00005626263192e2 in runServer (argument=<optimized out>) at ../../Programs/brlapi_server.c:3943
#14 0x00005626262c5d3f in runThread (argument=0x562632e0aca0) at ../../Programs/thread.c:46
#15 0x00007f468c1171c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#16 0x00007f468c19785c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://brltty.app/pipermail/brltty/attachments/20241113/ac5ab8f4/attachment.sig>