{"action":"created","issue":{"url":"https://api.github.com/repos/alibaba/tengine/issues/1078","repository_url":"https://api.github.com/repos/alibaba/tengine","labels_url":"https://api.github.com/repos/alibaba/tengine/issues/1078/labels{/name}","comments_url":"https://api.github.com/repos/alibaba/tengine/issues/1078/comments","events_url":"https://api.github.com/repos/alibaba/tengine/issues/1078/events","html_url":"https://github.com/alibaba/tengine/issues/1078","id":346555609,"node_id":"MDU6SXNzdWUzNDY1NTU2MDk=","number":1078,"title":"当启用 OpenSSL 异步模式时 LuaJIT 出现 memory corruption","user":{"login":"tokers","id":10428333,"node_id":"MDQ6VXNlcjEwNDI4MzMz","avatar_url":"https://avatars1.githubusercontent.com/u/10428333?v=4","gravatar_id":"","url":"https://api.github.com/users/tokers","html_url":"https://github.com/tokers","followers_url":"https://api.github.com/users/tokers/followers","following_url":"https://api.github.com/users/tokers/following{/other_user}","gists_url":"https://api.github.com/users/tokers/gists{/gist_id}","starred_url":"https://api.github.com/users/tokers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tokers/subscriptions","organizations_url":"https://api.github.com/users/tokers/orgs","repos_url":"https://api.github.com/users/tokers/repos","events_url":"https://api.github.com/users/tokers/events{/privacy}","received_events_url":"https://api.github.com/users/tokers/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-08-01T11:14:19Z","updated_at":"2018-08-02T06:31:28Z","closed_at":null,"author_association":"NONE","body":"Tengine 团队，你们好！\r\n\r\n最近我们正在尝试在我们的 Nginx 服务里集成 QAT 加速的功能，我们发现在使用 QAT 服务的情况下（且同时使用 OpenSSL 异步模式），我们的 Nginx worker 进程经常会崩溃，比如出现以下的堆栈：\r\n\r\n![image](https://user-images.githubusercontent.com/10428333/43518277-237c1472-95be-11e8-956b-504f34c5c56e.png)\r\n\r\n经过一段时间的排查，我们发现问题似乎是因为 LuaJIT 和 OpenSSL 异步模式之间存在一些冲突（猜测），OpenSSL 异步模式下似乎使用了 `setjmp/longjmp` 和 `makecontext/swapcontext` 等函数实现控制流的切换，我不太清楚这些函数是否会干扰到 LuaJIT。\r\n\r\n禁用 OpenSSL 异步模式或者关闭 LuaJIT 的即时编译功能都能够修复该问题，不过代价对我们来说都比较昂贵。\r\n\r\n鉴于 Tengine 也集成了 ngx_lua，并且支持使用异步 SSL 模式，我想请教下是否你们也出现过这类问题，以及是否有合适的解决办法？\r\n\r\n* OpenSSL: 基于官方的 1.1.1-pre2\r\n* Nginx: 基于官方的 1.13.9\r\n* Linux Kernel: 4.9.0\r\n* LuaJIT: v2.1-20171103 \r\n\r\nBest Regards\r\nAlex Zhang\r\n"},"comment":{"url":"https://api.github.com/repos/alibaba/tengine/issues/comments/409821011","html_url":"https://github.com/alibaba/tengine/issues/1078#issuecomment-409821011","issue_url":"https://api.github.com/repos/alibaba/tengine/issues/1078","id":409821011,"node_id":"MDEyOklzc3VlQ29tbWVudDQwOTgyMTAxMQ==","user":{"login":"tokers","id":10428333,"node_id":"MDQ6VXNlcjEwNDI4MzMz","avatar_url":"https://avatars1.githubusercontent.com/u/10428333?v=4","gravatar_id":"","url":"https://api.github.com/users/tokers","html_url":"https://github.com/tokers","followers_url":"https://api.github.com/users/tokers/followers","following_url":"https://api.github.com/users/tokers/following{/other_user}","gists_url":"https://api.github.com/users/tokers/gists{/gist_id}","starred_url":"https://api.github.com/users/tokers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tokers/subscriptions","organizations_url":"https://api.github.com/users/tokers/orgs","repos_url":"https://api.github.com/users/tokers/repos","events_url":"https://api.github.com/users/tokers/events{/privacy}","received_events_url":"https://api.github.com/users/tokers/received_events","type":"User","site_admin":false},"created_at":"2018-08-02T06:31:28Z","updated_at":"2018-08-02T06:31:28Z","author_association":"NONE","body":"补充：\r\n\r\n发现另外一种崩溃时的堆栈：\r\n\r\n```\r\n#0  0x00007f547ee5c1bc in snapshot_framelinks (topslot=0x415c3f6d \" \\v\", J=0x416e7558, map=0x41396700) at lj_snap.c:124\r\n#1  snapshot_stack (nsnapmap=431, snap=0x415c3f68, J=0x416e7558) at lj_snap.c:163\r\n#2  lj_snap_add (J=0x416e7558) at lj_snap.c:191\r\n#3  0x00007f547ee614df in lj_record_ins (J=0x416e7558) at lj_record.c:2023\r\n#4  0x00007f547ee77495 in trace_state (L=0x416e7378, dummy=<optimized out>, ud=0x416e7558) at lj_trace.c:670\r\n#5  0x00007f547ee38f56 in lj_vm_cpcall () from /usr/local/marco/luajit/lib/libluajit-5.1.so.2\r\n#6  0x00007f547ee765df in lj_trace_ins (J=0x416e7558, pc=<optimized out>) at lj_trace.c:729\r\n#7  0x00007f547ee42b0a in lj_dispatch_call (L=0x416e7378, pc=0x4156e0ec) at lj_dispatch.c:493\r\n#8  0x00007f547ee3a5ca in lj_vm_hotcall () from /usr/local/marco/luajit/lib/libluajit-5.1.so.2\r\n#9  0x00007f547ee4807d in lua_pcall (L=<optimized out>, nargs=<optimized out>, nresults=<optimized out>, errfunc=<optimized out>) at lj_api.c:1129\r\n#10 0x0000000000555f2e in ngx_http_lua_cache_load_code (log=0x543b2d8, L=0x416e7378, key=0x1687448 \"nhli_fff835480c574b40e7fa56e821097732\")\r\n    at /root/alex/marco/deps/lua-nginx-module-0.10.11h/src/ngx_http_lua_cache.c:56\r\n#11 0x0000000000556105 in ngx_http_lua_cache_loadbuffer (log=0x543b2d8, L=0x416e7378, src=0x16873e8 \"\\n    if not ngx.is_subrequest then\\n        return \\\"1\\\"\\n    end\\n\",\r\n    src_len=62, cache_key=0x1687448 \"nhli_fff835480c574b40e7fa56e821097732\", name=0x6c613b \"=set_by_lua\")\r\n    at /root/alex/marco/deps/lua-nginx-module-0.10.11h/src/ngx_http_lua_cache.c:148\r\n#12 0x000000000054b7aa in ngx_http_lua_filter_set_by_lua_inline (r=0x5411050, val=0x7ffc50cff4e0, v=0x541fae8, data=0x1687428)\r\n```\r\n\r\n![image](https://user-images.githubusercontent.com/10428333/43566150-019d6188-9660-11e8-9de5-1cceb6f2e756.png)\r\n\r\n```c\r\n#define frame_prevl(f)      ((f) - (1+LJ_FR2+bc_a(frame_pc(f)[-1])))\r\n#define frame_pc(f)     (mref((f)->fr.tp.pcr, const BCIns))\r\n#define mref(r, t)  ((t *)(void *)(uintptr_t)(r).ptr32)\r\n```\r\n\r\n```\r\n(gdb) p frame.fr.tp.pcr\r\n$7 = {ptr32 = 4294967284}\r\n```\r\n貌似这个值被写乱了？"}}
{"actor":{"display_login":"tokers"}}