h.b.furuseth@usit.uio.no wrote:

Full_Name: Hallvard B Furuseth Version: HEAD OS: Linux x86_64 URL: Submission from: (NULL) (193.157.198.89) Submitted by: hallvard

Core dump in back-monitor with LDAP_THREAD_DEBUG when I hit ^C:

ASSERT_OWNER( mutex, "ldap_pvt_thread_mutex_unlock" );

I see this too. The Abandon loop's logic is backwards. It's looping from the current entry to the end of the list and releasing those entries, when it should only be reasling from the head of the list to the current entry. (I.e., everything on the tail of the list has not yet been locked by this thread.)

I'll commit a fix shortly.

#2 ldap_pvt_thread_mutex_unlock (mutex=0x1a526c0) at thr_debug.c:1031 #3 monitor_cache_release (mi=0x92c8c0, e=0x19ec7f8) at cache.c:389 #4 monitor_send_children (op=0x236bcb0, rs=0x7f54ce4eea40, e_parent=0x19ec758, sub=1) at search.c:97 #5 monitor_back_search (op=0x236bcb0, rs=0x7f54ce4eea40) at search.c:245 #6 fe_op_search (op=0x236bcb0, rs=0x7f54ce4eea40) at search.c:372

That's the o_abandon branch in monitor_send_children().

I copied the loop out of the o_abandon branch. test036 crashed with what I assume is the same problem. No need to hit ^C at the right time:

Index: back-monitor/search.c @@ -89,2 +89,9 @@ monitor_send_children(

• if ( nonvolatile == 0&&  (e_tmp = e) != NULL ) {
  

• 	do {
  

• 		mp = e_tmp->e_private;
  

• 		LDAP_PVT_THREAD_ASSERT_MUTEX_OWNER(&mp->mp_mutex );
  

• 	} while ( (e_tmp = mp->mp_next)&&  e_tmp != e_nonvolatile );
  

• }
  

• if ( op->o_abandon ) {

There is a similar loop further down, I didn't look at that one.

Variables at the crash:

e == e_nonvolatile e_tmp == ((monitor_entry_t *) e->e_private)->mp_next

*(monitor_entry_t *) e->e_private == { mp_mutex = {...}, mp_next = 0x261b2a8, mp_children = 0x261b668, mp_info = 0x8f21c0, mp_flags = 32, mp_cb = 0x0 }

*(monitor_entry_t *) e_tmp->e_private == { mp_mutex = {...}, mp_next = 0x261b2f8, mp_children = 0x261ba28, mp_info = 0x8f2258, mp_flags = 128, mp_cb = 0x0 }