{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/coreclr/issues/5188","repository_url":"https://api.github.com/repos/dotnet/coreclr","labels_url":"https://api.github.com/repos/dotnet/coreclr/issues/5188/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/coreclr/issues/5188/comments","events_url":"https://api.github.com/repos/dotnet/coreclr/issues/5188/events","html_url":"https://github.com/dotnet/coreclr/issues/5188","id":156571227,"number":5188,"title":"SIGSEGV_libcoreclr.so!AllocateObject ","user":{"login":"schaabs","id":11322348,"avatar_url":"https://avatars.githubusercontent.com/u/11322348?v=3","gravatar_id":"","url":"https://api.github.com/users/schaabs","html_url":"https://github.com/schaabs","followers_url":"https://api.github.com/users/schaabs/followers","following_url":"https://api.github.com/users/schaabs/following{/other_user}","gists_url":"https://api.github.com/users/schaabs/gists{/gist_id}","starred_url":"https://api.github.com/users/schaabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schaabs/subscriptions","organizations_url":"https://api.github.com/users/schaabs/orgs","repos_url":"https://api.github.com/users/schaabs/repos","events_url":"https://api.github.com/users/schaabs/events{/privacy}","received_events_url":"https://api.github.com/users/schaabs/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dotnet/coreclr/labels/blocking-release","name":"blocking-release","color":"e11d21"},{"url":"https://api.github.com/repos/dotnet/coreclr/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/dotnet/coreclr/labels/GC","name":"GC","color":"d4c5f9"},{"url":"https://api.github.com/repos/dotnet/coreclr/labels/reliability","name":"reliability","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"janvorli","id":10758568,"avatar_url":"https://avatars.githubusercontent.com/u/10758568?v=3","gravatar_id":"","url":"https://api.github.com/users/janvorli","html_url":"https://github.com/janvorli","followers_url":"https://api.github.com/users/janvorli/followers","following_url":"https://api.github.com/users/janvorli/following{/other_user}","gists_url":"https://api.github.com/users/janvorli/gists{/gist_id}","starred_url":"https://api.github.com/users/janvorli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/janvorli/subscriptions","organizations_url":"https://api.github.com/users/janvorli/orgs","repos_url":"https://api.github.com/users/janvorli/repos","events_url":"https://api.github.com/users/janvorli/events{/privacy}","received_events_url":"https://api.github.com/users/janvorli/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/dotnet/coreclr/milestones/4","html_url":"https://github.com/dotnet/coreclr/milestones/1.0.0-rtm","labels_url":"https://api.github.com/repos/dotnet/coreclr/milestones/4/labels","id":1321405,"number":4,"title":"1.0.0-rtm","description":"2016 (https://github.com/aspnet/Home/wiki/Roadmap)","creator":{"login":"joshfree","id":1302850,"avatar_url":"https://avatars.githubusercontent.com/u/1302850?v=3","gravatar_id":"","url":"https://api.github.com/users/joshfree","html_url":"https://github.com/joshfree","followers_url":"https://api.github.com/users/joshfree/followers","following_url":"https://api.github.com/users/joshfree/following{/other_user}","gists_url":"https://api.github.com/users/joshfree/gists{/gist_id}","starred_url":"https://api.github.com/users/joshfree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshfree/subscriptions","organizations_url":"https://api.github.com/users/joshfree/orgs","repos_url":"https://api.github.com/users/joshfree/repos","events_url":"https://api.github.com/users/joshfree/events{/privacy}","received_events_url":"https://api.github.com/users/joshfree/received_events","type":"User","site_admin":false},"open_issues":34,"closed_issues":329,"state":"open","created_at":"2015-09-24T02:23:52Z","updated_at":"2016-05-30T15:14:21Z","due_on":"2016-06-30T07:00:00Z","closed_at":null},"comments":10,"created_at":"2016-05-24T18:00:08Z","updated_at":"2016-05-30T16:29:05Z","closed_at":null,"body":"**The notes in this bug refer to the Ubuntu.14.04 dump [wj3wzs5j](https://rapreqs.blob.core.windows.net/bryanar/BodyPart_4fa8883e-f6d9-47b1-9c02-2d1ce6156ddb?sv=2015-04-05&sr=b&sig=UZCJEECgbzT09rj4horT5AyCQWb%2FtHO87O0J7euBYbg%3D&st=2016-05-20T21%3A11%3A44Z&se=2017-05-20T21%3A11%3A44Z&sp=r).  Other dumps are available if needed.  To repro this issue you will likely have to disaable the oom killer, and dissable memory overcommit using the following directions**\r\n\r\n    Append these lines to /etc/sysctl.conf:\r\n    vm.oom-kill = 0 \r\n    vm.overcommit_memory = 2 \r\n\r\n**The issue here appears to be actually rooted in libcoreclr.so`WKS::GCHeap::Alloc.  It seems that GCHeap::Alloc is failing due to an OOM, however it does not return NULL after failing to allocate, instead it appears to return a bogus address which is not actually in the address space of the process.  This in turn causes calling code to SEGSIV**\r\n\r\n**Looking at the dump we can see we are in an EH path which is trying to allocate an exception.  This calls into libcoreclr.so!AllocateObject which fails due to a SEGSIV**\r\n\r\n    STOP_REASON:\r\n    SIGSEGV\r\n\r\n    FAULT_SYMBOL:\r\n    libcoreclr.so!AllocateObject\r\n\r\n    FAILURE_HASH:\r\n    SIGSEGV_libcoreclr.so!AllocateObject\r\n\r\n    FAULT_STACK:\r\n    libcoreclr.so!AllocateObject(MethodTable*)\r\n    libcoreclr.so!EEException::CreateThrowable()\r\n    libcoreclr.so!CreateCOMPlusExceptionObject(Thread*, _EXCEPTION_RECORD*, int)\r\n    libcoreclr.so!ExceptionTracker::GetOrCreateTracker(unsigned long, StackFrame, _EXCEPTION_RECORD*, _CONTEXT*, int, bool, ExceptionTracker::StackTraceState*)\r\n    libcoreclr.so!ProcessCLRException\r\n    libcoreclr.so!UnwindManagedExceptionPass1(PAL_SEHException&, _CONTEXT*)\r\n    libcoreclr.so!DispatchManagedException(PAL_SEHException&)\r\n    libcoreclr.so!HandleHardwareException(PAL_SEHException*)\r\n    libcoreclr.so!SEHProcessException(_EXCEPTION_POINTERS*)\r\n    libcoreclr.so!common_signal_handler(int, siginfo_t*, void*, int, ...)\r\n    libcoreclr.so!sigsegv_handler(int, siginfo_t*, void*)\r\n    libclrjit.so!sigsegv_handler(int, siginfo_t*, void*)\r\n    libpthread.so.0!__lll_unlock_wake\r\n    mscorlib.ni.dll!System.Reflection.Emit.DynamicMethod.GetMethodDescriptor()\r\n    mscorlib.ni.dll!System.Reflection.Emit.DynamicMethod.CreateDelegate(System.Type, System.Object)\r\n    System.Linq.Expressions.dll!System.Linq.Expressions.Compiler.LambdaCompiler.Compile(System.Linq.Expressions.LambdaExpression)\r\n    System.Linq.Expressions.dll!System.Linq.Expressions.Expression`1[[System.__Canon, mscorlib]].Compile(Boolean)\r\n    System.Linq.Queryable.dll!System.Linq.EnumerableExecutor`1[[System.Int32, mscorlib]].Execute()\r\n    System.Linq.Queryable.dll!DomainBoundILStubClass.IL_STUB_InstantiatingStub(System.Linq.Expressions.Expression)\r\n    System.Linq.Queryable.dll!System.Linq.Queryable.Count[[System.__Canon, mscorlib]](System.Linq.IQueryable`1<System.__Canon>)\r\n    System.Linq.Queryable.Tests.dll!System.Linq.Tests.GroupByTests.GroupBy3()\r\n    24117-00_0003.exe!stress.generated.UnitTests.UT5C()\r\n    stress.execution.dll!stress.execution.UnitTest.Execute()\r\n    stress.execution.dll!stress.execution.DedicatedThreadWorkerStrategy.RunWorker(stress.execution.ITestPattern, System.Threading.CancellationToken)\r\n    stress.execution.dll!stress.execution.DedicatedThreadWorkerStrategy+<>c__DisplayClass1_0.<SpawnWorker>b__0()\r\n    mscorlib.ni.dll!System.Threading.Tasks.Task.Execute()\r\n    mscorlib.ni.dll!System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)\r\n    mscorlib.ni.dll!System.Threading.Tasks.Task.ExecuteWithThreadLocal(System.Threading.Tasks.Task ByRef)\r\n    mscorlib.ni.dll!System.Threading.Tasks.Task.ExecuteEntry(Boolean)\r\n    mscorlib.ni.dll!System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)\r\n\r\n    FAULT_THREAD:\r\n    thread #1: tid = 9146, 0x00007ff7fe103318 libcoreclr.so`AllocateObject(MethodTable*) + 184, name = 'corerun', stop reason = signal SIGSEGV\r\n\r\n    LAST_EXCEPTION:\r\n    There is no current managed exception on this thread\r\n\r\n    \r\n**Dissasembling libcoreclr.so!AllocateObject shows that we are calling into libcoreclr.so!WKS::GCHeap::Alloc which actually returns a non NULL address in (stored in r15).  However the address doesn't appear to be in the address space of the process, so when we derefernce it we SEGSIV.**\r\n\r\n    (lldb) disassemble -F intel\r\n    libcoreclr.so`AllocateObject:\r\n        0x7ff7fe103260 <+0>:   push   rbp\r\n        0x7ff7fe103261 <+1>:   mov    rbp, rsp\r\n        0x7ff7fe103264 <+4>:   push   r15\r\n        0x7ff7fe103266 <+6>:   push   r14\r\n        0x7ff7fe103268 <+8>:   push   r13\r\n        0x7ff7fe10326a <+10>:  push   r12\r\n        0x7ff7fe10326c <+12>:  push   rbx\r\n        0x7ff7fe10326d <+13>:  sub    rsp, 0x48\r\n        0x7ff7fe103271 <+17>:  mov    r14, rdi\r\n        0x7ff7fe103274 <+20>:  mov    rax, qword ptr fs:[0x28]\r\n        0x7ff7fe10327d <+29>:  mov    qword ptr [rbp - 0x30], rax\r\n        0x7ff7fe103281 <+33>:  lea    rax, [rip + 0x7012a8]     ; g_IBCLogger\r\n        0x7ff7fe103288 <+40>:  cmp    dword ptr [rax], 0x0\r\n        0x7ff7fe10328b <+43>:  je     0x7ff7fe103295            ; <+53>\r\n        0x7ff7fe10328d <+45>:  mov    rdi, r14\r\n        0x7ff7fe103290 <+48>:  call   0x7ff7fe0262f0            ; IBCLogger::LogMethodTableAccessStatic(void const*)\r\n        0x7ff7fe103295 <+53>:  lea    rdi, [rip + 0x6f0be3]     ;  + 296\r\n        0x7ff7fe10329d <+61>:  call   0x7ff7fdfe56e0            ; symbol stub for: __tls_get_addr\r\n        0x7ff7fe1032a5 <+69>:  mov    rax, qword ptr [rax]\r\n        0x7ff7fe1032a8 <+72>:  mov    qword ptr [rax + 0x98], r14\r\n        0x7ff7fe1032af <+79>:  mov    ebx, dword ptr [r14]\r\n        0x7ff7fe1032b2 <+82>:  test   ebx, 0x8000000\r\n        0x7ff7fe1032b8 <+88>:  je     0x7ff7fe1032c7            ; <+103>\r\n        0x7ff7fe1032ba <+90>:  xor    esi, esi\r\n        0x7ff7fe1032bc <+92>:  mov    rdi, r14\r\n        0x7ff7fe1032bf <+95>:  call   0x7ff7fe0ea280            ; PrepareCriticalFinalizerObject(MethodTable*, Module*)\r\n        0x7ff7fe1032c4 <+100>: mov    ebx, dword ptr [r14]\r\n        0x7ff7fe1032c7 <+103>: mov    r12d, dword ptr [r14 + 0x4]\r\n        0x7ff7fe1032cb <+107>: lea    rax, [rip + 0x6fbab6]     ; g_pGCHeap\r\n        0x7ff7fe1032d2 <+114>: mov    r15, qword ptr [rax]\r\n        0x7ff7fe1032d5 <+117>: mov    eax, ebx\r\n        0x7ff7fe1032d7 <+119>: shr    eax, 0x17\r\n        0x7ff7fe1032da <+122>: and    eax, 0x2\r\n        0x7ff7fe1032dd <+125>: shr    ebx, 0x14\r\n        0x7ff7fe1032e0 <+128>: and    ebx, 0x1\r\n        0x7ff7fe1032e3 <+131>: or     ebx, eax\r\n        0x7ff7fe1032e5 <+133>: mov    r13, qword ptr [r15]\r\n        0x7ff7fe1032e8 <+136>: lea    rdi, [rip + 0x6f0b90]     ;  + 296\r\n        0x7ff7fe1032f0 <+144>: call   0x7ff7fdfe56e0            ; symbol stub for: __tls_get_addr\r\n        0x7ff7fe1032f8 <+152>: mov    rsi, qword ptr [rax]\r\n        0x7ff7fe1032fb <+155>: add    rsi, 0x60\r\n        0x7ff7fe1032ff <+159>: mov    rdi, r15\r\n        0x7ff7fe103302 <+162>: mov    rdx, r12\r\n        0x7ff7fe103305 <+165>: mov    ecx, ebx\r\n        0x7ff7fe103307 <+167>: call   qword ptr [r13 + 0x98]   //CALL TO libcoreclr.so`WKS::GCHeap::Alloc\r\n        0x7ff7fe10330e <+174>: mov    r15, rax                 //Return from libcoreclr.so`WKS::GCHeap::Alloc is stored in r15\r\n        0x7ff7fe103311 <+177>: cmp    r12, 0x14c08\r\n    ->  0x7ff7fe103318 <+184>: mov    qword ptr [r15], r14     //SEGSIV when dereferencing r15\r\n\r\n    (lldb) register read r15\r\n         r15 = 0x00007ff768d38068\r\n         \r\n    (lldb) memory read -f x -s 8 -c 8 0x00007ff768d38068\r\n    error: core file does not contain 0x7ff768d38068"},"comment":{"url":"https://api.github.com/repos/dotnet/coreclr/issues/comments/222524380","html_url":"https://github.com/dotnet/coreclr/issues/5188#issuecomment-222524380","issue_url":"https://api.github.com/repos/dotnet/coreclr/issues/5188","id":222524380,"user":{"login":"janvorli","id":10758568,"avatar_url":"https://avatars.githubusercontent.com/u/10758568?v=3","gravatar_id":"","url":"https://api.github.com/users/janvorli","html_url":"https://github.com/janvorli","followers_url":"https://api.github.com/users/janvorli/followers","following_url":"https://api.github.com/users/janvorli/following{/other_user}","gists_url":"https://api.github.com/users/janvorli/gists{/gist_id}","starred_url":"https://api.github.com/users/janvorli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/janvorli/subscriptions","organizations_url":"https://api.github.com/users/janvorli/orgs","repos_url":"https://api.github.com/users/janvorli/repos","events_url":"https://api.github.com/users/janvorli/events{/privacy}","received_events_url":"https://api.github.com/users/janvorli/received_events","type":"User","site_admin":false},"created_at":"2016-05-30T16:29:05Z","updated_at":"2016-05-30T16:29:05Z","body":"And one more thing - the heap had this problem even before we tried to allocate the throwable. Looking at the hardware exception that was just being handled, it was a sigsegv due to an attempt to access a heap object at 0x00007ff768d36700, which is very close to the failure address 0x00007ff768d38068 that the allocator has allocated for the throwable.\r\nInterestingly, in the frame of System.Reflection.Emit.DynamicMethod.CreateDelegate, I can see this:\r\n```asm\r\n00007ff784a6762b 488bfb               mov     rdi, rbx\r\n00007ff784a6762e e86d000000           call    0x7ff784a676a0 (System.Reflection.Emit.DynamicMethod.GetMethodDescriptor(), mdToken: 0000000006001911)\r\n00007ff784a67633 488b7b10             mov     rdi, qword ptr [rbx + 0x10]\r\n00007ff784a67637 e84c5ebfff           call    0x7ff78465d488 (System.Runtime.CompilerServices.RuntimeHelpers._CompileMethod(System.IRuntimeMethodInfo), mdToken: 0000000006000568)\r\n00007ff784a6763c 488bfb               mov     rdi, rbx\r\n00007ff784a6763f e85c000000           call    0x7ff784a676a0 (System.Reflection.Emit.DynamicMethod.GetMethodDescriptor(), mdToken: 0000000006001911)\r\n>>> 00007ff784a67644 488945e0             mov     qword ptr [rbp - 0x20], rax\r\n```\r\nAs you can see, the GetMethodDescriptor() was called just few instructions before the failing call for the same object that the failing call got as a parameter and it has passed, so the object must have been valid at that time. So it is yet another pointer to a fact that the heap somehow got unmapped. "}}
{"actor":{"display_login":"janvorli"}}