[jira] [Created] (TS-4830) Http2 write_vio.reenable crash

["Susan Hinrichs (JIRA)" <ji...@apache.org>]

Susan Hinrichs created TS-4830:
----------------------------------

             Summary: Http2 write_vio.reenable crash
                 Key: TS-4830
                 URL: https://issues.apache.org/jira/browse/TS-4830
             Project: Traffic Server
          Issue Type: Bug
          Components: HTTP/2
            Reporter: Susan Hinrichs


We were seeing crashes with following stack.

{code}
gdb) bt
#0  0x000000368400f807 in ?? () from /lib64/libgcc_s.so.1
#1  0x00000036840100b9 in _Unwind_Backtrace () from /lib64/libgcc_s.so.1
#2  0x00000036820fe936 in backtrace () from /lib64/libc.so.6
#3  0x00002b3543897af7 in ink_stack_trace_dump () at ink_stack_trace.cc:60
#4  0x00002b3543899cd4 in signal_crash_handler (signo=11) at signals.cc:183
#5  0x0000000000512b5c in crash_logger_invoke (signo=11, info=0x2b354ce0a4f0, ctx=0x2b354ce0a3c0) at Crash.cc:169
#6  <signal handler called>
#7  0x0000000200000000 in ?? ()
#8  0x0000000000515a0f in VIO::reenable (this=0x2b36e8020228) at ../iocore/eventsystem/P_VIO.h:112
#9  0x000000000064cbc9 in Http2ClientSession::write_reenable (this=0x2b36ad35ed10) at Http2ClientSession.h:195
#10 0x000000000064b0e5 in Http2ClientSession::main_event_handler (this=0x2b36ad35ed10, event=2254, 
    edata=0x2b354ce0c980) at Http2ClientSession.cc:298
#11 0x00000000005159c8 in Continuation::handleEvent (this=0x2b36ad35ed10, event=2254, data=0x2b354ce0c980)
    at ../iocore/eventsystem/I_Continuation.h:150
#12 0x00000000006508c1 in Http2ConnectionState::send_data_frame (this=0x2b36ad35ef50, stream=0x2b362cfc1120)
    at Http2ConnectionState.cc:977
#13 0x000000000065360b in Http2Stream::do_io_close (this=0x2b362cfc1120) at Http2Stream.cc:293
#14 0x00000000005f5900 in HttpSM::tunnel_handler_ua (this=0x2b369a1b6750, event=103, c=0x2b369a1b7c38)
    at HttpSM.cc:3370
#15 0x000000000063f3f6 in HttpTunnel::consumer_handler (this=0x2b369a1b7bf8, event=103, c=0x2b369a1b7c38)
    at HttpTunnel.cc:1326
#16 0x000000000063fbbd in HttpTunnel::main_handler (this=0x2b369a1b7bf8, event=103, data=0x2b362cfc14a0)
    at HttpTunnel.cc:1576
#17 0x00000000005159c8 in Continuation::handleEvent (this=0x2b369a1b7bf8, event=103, data=0x2b362cfc14a0)
    at ../iocore/eventsystem/I_Continuation.h:150
#18 0x0000000000652b7b in Http2Stream::main_event_handler (this=0x2b362cfc1120, event=103, edata=0x2b36840c0910)
    at Http2Stream.cc:85
#19 0x00000000005159c8 in Continuation::handleEvent (this=0x2b362cfc1120, event=103, data=0x2b36840c0910)
    at ../iocore/eventsystem/I_Continuation.h:150
#20 0x00000000007a79ee in EThread::process_event (this=0x2b35468af010, e=0x2b36840c0910, calling_code=103)
    at UnixEThread.cc:145
#21 0x00000000007a7d8d in EThread::execute_regular (this=0x2b35468af010) at UnixEThread.cc:212
#22 0x00000000007a8164 in EThread::execute (this=0x2b35468af010) at UnixEThread.cc:304
#23 0x00000000007a6d1d in spawn_thread_internal (a=0x1775a60) at Thread.cc:85
#24 0x00002b35444b3aa1 in start_thread () from /lib64/libpthread.so.0
#25 0x00000036820e893d in clone () from /lib64/libc.so.6
{code}

Digging in to the data structures it looks like the client has already sent an EOS.  Http2ClientSession.client_vc is NULL.  But a write_vio lingers (with cont and nbytes set to 0 but buffer non-NULL).  I would assume we shouldn't be doing a final write in this case if the client has initiated the shutdown.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)