{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/corefx/issues/9574","repository_url":"https://api.github.com/repos/dotnet/corefx","labels_url":"https://api.github.com/repos/dotnet/corefx/issues/9574/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/corefx/issues/9574/comments","events_url":"https://api.github.com/repos/dotnet/corefx/issues/9574/events","html_url":"https://github.com/dotnet/corefx/issues/9574","id":161502901,"number":9574,"title":"Asp.net stress app crash due to memory corruption on Linux","user":{"login":"yuwaMSFT","id":16964440,"avatar_url":"https://avatars.githubusercontent.com/u/16964440?v=3","gravatar_id":"","url":"https://api.github.com/users/yuwaMSFT","html_url":"https://github.com/yuwaMSFT","followers_url":"https://api.github.com/users/yuwaMSFT/followers","following_url":"https://api.github.com/users/yuwaMSFT/following{/other_user}","gists_url":"https://api.github.com/users/yuwaMSFT/gists{/gist_id}","starred_url":"https://api.github.com/users/yuwaMSFT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yuwaMSFT/subscriptions","organizations_url":"https://api.github.com/users/yuwaMSFT/orgs","repos_url":"https://api.github.com/users/yuwaMSFT/repos","events_url":"https://api.github.com/users/yuwaMSFT/events{/privacy}","received_events_url":"https://api.github.com/users/yuwaMSFT/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dotnet/corefx/labels/tenet-reliability","name":"tenet-reliability","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"stephentoub","id":2642209,"avatar_url":"https://avatars.githubusercontent.com/u/2642209?v=3","gravatar_id":"","url":"https://api.github.com/users/stephentoub","html_url":"https://github.com/stephentoub","followers_url":"https://api.github.com/users/stephentoub/followers","following_url":"https://api.github.com/users/stephentoub/following{/other_user}","gists_url":"https://api.github.com/users/stephentoub/gists{/gist_id}","starred_url":"https://api.github.com/users/stephentoub/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stephentoub/subscriptions","organizations_url":"https://api.github.com/users/stephentoub/orgs","repos_url":"https://api.github.com/users/stephentoub/repos","events_url":"https://api.github.com/users/stephentoub/events{/privacy}","received_events_url":"https://api.github.com/users/stephentoub/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/dotnet/corefx/milestones/4","html_url":"https://github.com/dotnet/corefx/milestones/1.1.0","labels_url":"https://api.github.com/repos/dotnet/corefx/milestones/4/labels","id":1248719,"number":4,"title":"1.1.0","description":"Features associated with 1.1.0 unfortunately won't make it into the initial 1.0.0 RTM release.  We are tentatively planning on shipping them in the initial feature release after 1.0.0 RTM.\r\n\r\nNo calendar date is set.\r\n\r\nhttps://github.com/aspnet/Home/wiki/Roadmap","creator":{"login":"joshfree","id":1302850,"avatar_url":"https://avatars.githubusercontent.com/u/1302850?v=3","gravatar_id":"","url":"https://api.github.com/users/joshfree","html_url":"https://github.com/joshfree","followers_url":"https://api.github.com/users/joshfree/followers","following_url":"https://api.github.com/users/joshfree/following{/other_user}","gists_url":"https://api.github.com/users/joshfree/gists{/gist_id}","starred_url":"https://api.github.com/users/joshfree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshfree/subscriptions","organizations_url":"https://api.github.com/users/joshfree/orgs","repos_url":"https://api.github.com/users/joshfree/repos","events_url":"https://api.github.com/users/joshfree/events{/privacy}","received_events_url":"https://api.github.com/users/joshfree/received_events","type":"User","site_admin":false},"open_issues":459,"closed_issues":812,"state":"open","created_at":"2015-08-10T18:04:00Z","updated_at":"2016-06-22T05:15:39Z","due_on":"2016-11-30T08:00:00Z","closed_at":null},"comments":7,"created_at":"2016-06-21T18:06:12Z","updated_at":"2016-06-22T15:09:06Z","closed_at":null,"body":"Saw two crashes on Linux with an Asp.net stress app after ~10 hours.\r\n\r\n**1. Seems around invalid curlhandler**\r\n```\r\nNative stack:\r\n* thread #1: tid = 0, 0x00007ffd544271b9 libcurl.so.4`??? + 41, name = 'dotnet', stop reason = signal SIGSEGV\r\n  * frame #0: 0x00007ffd544271b9 libcurl.so.4`??? + 41\r\n    frame #1: 0x00007ffd5442747d libcurl.so.4`??? + 29\r\n    frame #2: 0x00007ffd543fc4ff libcurl.so.4`??? + 223\r\n    frame #3: 0x00007ffd543fff72 libcurl.so.4`??? + 322\r\n    frame #4: 0x00007ffd5440efa4 libcurl.so.4`curl_multi_remove_handle + 260\r\n    frame #5: 0x00007fff7fa1a155\r\n    frame #6: 0x00007fff7ddeee6b\r\n    frame #7: 0x00007fff7ddef16b\r\n    frame #8: 0x00007fff7ddee275\r\n    frame #9: 0x00007fff7ddede74\r\n    frame #10: 0x00007fff7ddedbb3\r\n    frame #11: 0x00007fff7ddf3e29\r\n    frame #12: 0x00007fff7c96e691\r\n    frame #13: 0x00007fff7c9cdfc1\r\n    frame #14: 0x00007fff7c9cdd28\r\n    frame #15: 0x00007fff7c96e691\r\n    frame #16: 0x00007ffff6210ec7 libcoreclr.so`CallDescrWorkerInternal + 124\r\n    frame #17: 0x00007ffff612aaee libcoreclr.so`MethodDescCallSite::CallTargetWorker(unsigned long const*) + 862\r\n    frame #18: 0x00007ffff6135a8a libcoreclr.so`ThreadNative::KickOffThread_Worker(void*) + 474\r\n    frame #19: 0x00007ffff60fb0ee libcoreclr.so`ManagedThreadBase_DispatchOuter(ManagedThreadCallState*) + 430\r\n    frame #20: 0x00007ffff60fb846 libcoreclr.so`ManagedThreadBase::KickOff(ADID, void (*)(void*), void*) + 70\r\n    frame #21: 0x00007ffff6135c9b libcoreclr.so`ThreadNative::KickOffThread(void*) + 331\r\n    frame #22: 0x00007ffff6494129 libcoreclr.so`CorUnix::CPalThread::ThreadEntry(void*) + 297\r\n    frame #23: 0x00007ffff79c0182 libpthread.so.0`start_thread + 194\r\n    frame #24: 0x00007ffff6ecd47d libc.so.6`clone + 109\r\n\r\nManaged stack:\r\n        Child SP               IP Call Site\r\n00007FFD5C3B7428 00007ffd544271b9 [InlinedCallFrame: 00007ffd5c3b7428] Interop+Http.MultiRemoveHandle(SafeCurlMultiHandle, SafeCurlHandle)\r\n00007FFD5C3B7428 00007fff7fa1a155 [InlinedCallFrame: 00007ffd5c3b7428] Interop+Http.MultiRemoveHandle(SafeCurlMultiHandle, SafeCurlHandle)\r\n00007FFD5C3B7410 00007FFF7FA1A155 DomainBoundILStubClass.(SafeCurlMultiHandle, SafeCurlHandle)\r\n00007FFD5C3B74D0 00007FFF7DDEEE6B System.Net.Http.CurlHandler+MultiAgent.DeactivateActiveRequest(ActiveRequest, IntPtr)\r\n00007FFD5C3B7500 00007FFF7DDEF16B System.Net.Http.CurlHandler+MultiAgent.FindFailAndCleanupActiveRequest(EasyRequest, System.Exception)\r\n00007FFD5C3B75C0 00007FFF7DDEE275 System.Net.Http.CurlHandler+MultiAgent.HandleIncomingRequests()\r\n00007FFD5C3B7640 00007FFF7DDEDE74 System.Net.Http.CurlHandler+MultiAgent.WorkerBodyLoop()\r\n00007FFD5C3B7720 00007FFF7DDEDBB3 System.Net.Http.CurlHandler+MultiAgent.WorkerBody()\r\n00007FFD5C3B7780 00007FFF7DDF3E29 System.Net.Http.CurlHandler+MultiAgent+<>c.<EnsureWorkerIsRunning>b__19_0(System.Object)\r\n00007FFD5C3B7790 00007FFF7C9CDA06 System.Threading.Tasks.Task.Execute()\r\n00007FFD5C3B77C0 00007FFF7C96E691 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)\r\n00007FFD5C3B7810 00007FFF7C9CDFC1 System.Threading.Tasks.Task.ExecuteWithThreadLocal(System.Threading.Tasks.Task ByRef)\r\n00007FFD5C3B78C0 00007FFF7C9CDD28 System.Threading.Tasks.Task.ExecuteEntry(Boolean)\r\n00007FFD5C3B78E0 00007FFF7C96E691 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)\r\n00007FFD5C3B7B10 00007ffff6210ec7 [GCFrame: 00007ffd5c3b7b10]\r\n00007FFD5C3B7CF0 00007ffff6210ec7 [DebuggerU2MCatchHandlerFrame: 00007ffd5c3b7cf0]\r\n\r\n(lldb) sos DumpObj 00007ffe5c6c6570\r\nName:        Interop+Http+SafeCurlMultiHandle\r\nMethodTable: 00007fff7fbfd700\r\nEEClass:     00007fff7fbeced0\r\nSize:        32(0x20) bytes\r\nFile:        /home/azureuser/.dotnet/shared/Microsoft.NETCore.App/1.0.0/System.Net.Http.dll\r\nFields:\r\n              MT    Field   Offset                 Type VT     Attr            Value Name\r\n00007fff7cc80428  40002a4        8        System.IntPtr  1 instance 0000000000A506C0 handle\r\n00007fff7cc705f8  40002a5       10         System.Int32  1 instance               12 _state\r\n00007fff7cc58240  40002a6       14       System.Boolean  1 instance                1 _ownsHandle\r\n00007fff7cc58240  40002a7       15       System.Boolean  1 instance                1 _fullyInitialized\r\n\r\n(lldb) sos DumpVC 00007fff7cc80428 0000000000A506C0\r\nName:        System.IntPtr\r\nMethodTable: 00007fff7cc80428\r\nEEClass:     00007fff7c5a9528\r\nSize:        24(0x18) bytes\r\nFile:        /home/azureuser/.dotnet/shared/Microsoft.NETCore.App/1.0.0/System.Private.CoreLib.ni.dll\r\nFields:\r\n              MT    Field   Offset                 Type VT     Attr            Value Name\r\n00007fff7cc8d060  4000950        0                  PTR  0 instance 00000000000bab1e m_value\r\n00007fff7cc80428  4000951      710        System.IntPtr  1   shared           static Zero\r\n\r\n(lldb) sos DumpVC 00007fff7cc8d060 00000000000bab1e\r\nName:        System.UIntPtr\r\nMethodTable: 00007fff7cc8d060\r\nEEClass:     00007fff7c5ad8c0\r\nSize:        24(0x18) bytes\r\nFile:        /home/azureuser/.dotnet/shared/Microsoft.NETCore.App/1.0.0/System.Private.CoreLib.ni.dll\r\nFields:\r\n              MT    Field   Offset                 Type VT     Attr            Value Name\r\n00007fff7cc8d060  400120e        0                  PTR  0 instance  m_value\r\n00007fff7cc8d060  400120f      730       System.UIntPtr  1   shared           static Zero\r\n````\r\n\r\n**2. Seems about invalid handle on SSL cleanup:**\r\n```\r\nNative stack:\r\n(gdb) bt\r\n#0  0x00007ffff71a92e6 in ?? () from /lib/x86_64-linux-gnu/libgcc_s.so.1\r\n#1  0x00007ffff6f08c1c in __GI___dl_iterate_phdr (callback=0x7ffff71a8ec0, data=0x7ffd48becbb0) at dl-iteratephdr.c:76\r\n#2  0x00007ffff71aa253 in _Unwind_Find_FDE () from /lib/x86_64-linux-gnu/libgcc_s.so.1\r\n#3  0x00007ffff71a7507 in ?? () from /lib/x86_64-linux-gnu/libgcc_s.so.1\r\n#4  0x00007ffff71a86d8 in _Unwind_Backtrace () from /lib/x86_64-linux-gnu/libgcc_s.so.1\r\n#5  0x00007ffff6edde26 in __GI___backtrace (array=<optimized out>, size=64) at ../sysdeps/x86_64/backtrace.c:109\r\n#6  0x00007ffff6df2e56 in backtrace_and_maps (do_abort=-152183259, do_abort@entry=3, written=117, fd=261) at ../sysdeps/unix/sysv/linux/libc_fatal.c:49\r\n#7  0x00007ffff6e4638f in __libc_message (do_abort=do_abort@entry=3, fmt=fmt@entry=0x7ffff6f54b28 \"*** Error in `%s': %s: 0x%s ***\\n\") at ../sysdeps/posix/libc_fatal.c:172\r\n#8  0x00007ffff6e51c12 in malloc_printerr (ptr=0x100d840, str=0x7ffff6f50bfc \"corrupted double-linked list\", action=3) at malloc.c:4996\r\n#9  malloc_consolidate (av=av@entry=0x7ffff7191760 <main_arena>) at malloc.c:4157\r\n#10 0x00007ffff6e54f36 in _int_free (have_lock=1, p=0x6feeb30, av=0x7ffff7191760 <main_arena>) at malloc.c:4057\r\n#11 free_check (mem=<optimized out>, caller=<optimized out>) at hooks.c:307\r\n#12 0x00007ffd54be9fcd in CRYPTO_free () from /lib/x86_64-linux-gnu/libcrypto.so.1.0.0\r\n#13 0x00007ffd5496246a in SSL_CTX_free () from /lib/x86_64-linux-gnu/libssl.so.1.0.0\r\n#14 0x00007ffd5496505c in SSL_free () from /lib/x86_64-linux-gnu/libssl.so.1.0.0\r\n#15 0x00007fff7d4e971a in ?? ()\r\n#16 0x00000000c127e842 in ?? ()\r\n#17 0x00007ffff68466b0 in vtable for InlinedCallFrame () from /home/azureuser/.dotnet/shared/Microsoft.NETCore.App/1.0.0/libcoreclr.so\r\n#18 0x00007ffd48bedab8 in ?? ()\r\n#19 0x00007fff7feb9608 in ?? ()\r\n#20 0x00007fff7feb9608 in ?? ()\r\n#21 0x00007ffd48bed960 in ?? ()\r\n#22 0x00007fff7d4e971a in ?? ()\r\n#23 0x00007ffd48bed9d0 in ?? ()\r\n#24 0x00007fff7feb9608 in ?? ()\r\n#25 0x00007ffe640f4ba8 in ?? ()\r\n#26 0x0000000000000000 in ?? ()\r\n\r\nManaged stack:\r\nOS Thread Id: 0xd782 (68)\r\n        Child SP               IP Call Site\r\n00007FFD48BED968 00007ffff71a92e6 [InlinedCallFrame: 00007ffd48bed968] Interop+Ssl.SslDestroy(IntPtr)\r\n00007FFD48BED968 00007fff7d4e971a [InlinedCallFrame: 00007ffd48bed968] Interop+Ssl.SslDestroy(IntPtr)\r\n00007FFD48BED960 00007FFF7D4E971A DomainBoundILStubClass.(IntPtr)\r\n00007FFD48BED9E0 00007FFF7E1201BE Microsoft.Win32.SafeHandles.SafeSslHandle.ReleaseHandle()\r\n00007FFD48BEDAB8 00007ffff6210ec7 [GCFrame: 00007ffd48bedab8]\r\n00007FFD48BEE1D0 00007ffff6210ec7 [HelperMethodFrame_1OBJ: 00007ffd48bee1d0] System.Runtime.InteropServices.SafeHandle.DangerousRelease()\r\n\r\nName:        Microsoft.Win32.SafeHandles.SafeSslHandle\r\nMethodTable: 00007fff7febabb8\r\nEEClass:     00007fff7fec48d8\r\nSize:        56(0x38) bytes\r\nFile:        /home/azureuser/.dotnet/shared/Microsoft.NETCore.App/1.0.0/System.Net.Security.dll\r\nFields:\r\n              MT    Field   Offset                 Type VT     Attr            Value Name\r\n00007fff7cc6b428  40002a4        8        System.IntPtr  1 instance 0000000014ED03C0 handle\r\n00007fff7cc5b5f8  40002a5       10         System.Int32  1 instance                3 _state        --------------------------------- we set as closed and disposed\r\n00007fff7cc43240  40002a6       14       System.Boolean  1 instance                1 _ownsHandle\r\n00007fff7cc43240  40002a7       15       System.Boolean  1 instance                1 _fullyInitialized\r\n00007fff7febac98  4000001       18 ...les.SafeBioHandle  0 instance 00007ffe640f4b68 _readBio\r\n00007fff7febac98  4000002       20 ...les.SafeBioHandle  0 instance 00007ffe640f4b88 _writeBio\r\n00007fff7cc43240  4000003       28       System.Boolean  1 instance                1 _isServer------------------------------------this is server side\r\n00007fff7cc43240  4000004       29       System.Boolean  1 instance                1 _handshakeCompleted\r\n\r\n(lldb) sos DumpVC 00007fff7cc6b428 0000000014ED03C0\r\nName:        System.IntPtr\r\nMethodTable: 00007fff7cc6b428\r\nEEClass:     00007fff7c594528\r\nSize:        24(0x18) bytes\r\nFile:        /home/azureuser/.dotnet/shared/Microsoft.NETCore.App/1.0.0/System.Private.CoreLib.ni.dll\r\nFields:\r\n              MT    Field   Offset                 Type VT     Attr            Value Name\r\n00007fff7cc78060  4000950        0                  PTR  0 instance 0000200000000303 m_value\r\n00007fff7cc6b428  4000951      710        System.IntPtr  1   shared           static Zero\r\n                                 >> Domain:Value  00000000006549e0:NotInit  <<\r\n\r\n(lldb) memory read 0x0000200000000303\r\nerror: core file does not contain 0x200000000303\r\n\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/dotnet/corefx/issues/comments/227774765","html_url":"https://github.com/dotnet/corefx/issues/9574#issuecomment-227774765","issue_url":"https://api.github.com/repos/dotnet/corefx/issues/9574","id":227774765,"user":{"login":"bartonjs","id":10642668,"avatar_url":"https://avatars.githubusercontent.com/u/10642668?v=3","gravatar_id":"","url":"https://api.github.com/users/bartonjs","html_url":"https://github.com/bartonjs","followers_url":"https://api.github.com/users/bartonjs/followers","following_url":"https://api.github.com/users/bartonjs/following{/other_user}","gists_url":"https://api.github.com/users/bartonjs/gists{/gist_id}","starred_url":"https://api.github.com/users/bartonjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bartonjs/subscriptions","organizations_url":"https://api.github.com/users/bartonjs/orgs","repos_url":"https://api.github.com/users/bartonjs/repos","events_url":"https://api.github.com/users/bartonjs/events{/privacy}","received_events_url":"https://api.github.com/users/bartonjs/received_events","type":"User","site_admin":false},"created_at":"2016-06-22T15:09:06Z","updated_at":"2016-06-22T15:09:06Z","body":"This one *does* sound a little different, because we need to change the state from Owner to SharedOwner, which I don't think we've done before.  But I agree that the current model is backwards compared to how the rest of the libcrypto/libssl interop memory management works."}}
{"actor":{"display_login":"bartonjs"}}