Re: [Opalvoip-devel] SIP MESSAGE handling bug / race

[Robert J. <ro...@vo...>]

I have looked at the code and I am at a total loss how GetSize() can be non-zero but GetAt(0) then returns NULL.

 

Really the only way that can happen is if the object is removed in another thread between the two lines of code. While this is possible, it is extremely unlikely!

 

Next time it happens, can you send ALL of the threads? And the trace log too.

 

 

Robert Jongbloed

OPAL/OpenH323 Architect and Co-founder.

 

From: opa...@li... [mailto:opa...@li...] On Behalf Of Stefano Picerno
Sent: Thursday, 10 July 2008 3:13 AM
To: opa...@li...
Subject: [Opalvoip-devel] SIP MESSAGE handling bug / race

 

Hi,
  I tryed to send many "SIP MESSAGE" packets with opal, but sometimes a NULL pointer assert is triggered in SIPHandler::CollapseFork
Sometimes the application works, sometimes an assert is triggered

Sample test code I added to simpleopal:

          cout << "Starting send.\n";
         for(int i = 0; i< 1000; i++)
         {
            sipEP->Message("sip:791@192.168.33.119 <mailto:sip%3A791@192.168.33.119> ", "FooBar");
         }
          cout << "Completed send.\n";


The assertion is triggered here (handlers.cxx line 359):

void SIPHandler::CollapseFork(SIPTransaction & transaction)
{
  //
  // Take this transaction out and kill all the rest
  transactions.Remove(&transaction);
  while (transactions.GetSize() > 0) {
    PSafePtr<SIPTransaction> transToGo = transactions.GetAt(0);
    transactions.Remove(transToGo);
    transToGo->Abort(); //  transToGo safeptr contains a null pointer !! assertion fails
  }

  // And end connect mode on the transport
  transport->SetInterface(transaction.GetInterface());
}

As a quick and dirty workaround, I added an " if (transToGo) " before the Abort call, but I'm sure it's not a proper fix, as it leaves transaction objects in the transactions list.
Any idea ?

Bye 
 Stefano

PS: Here's the full stacktrace

>   simpleOPAL.exe!PAssertFunc(const char * msg=0x04c803c0)  Line 321    C++
     simpleOPAL.exe!PAssertFunc(const char * file=0x00f5160c, int line=701, const char * className=0x00000000, const char * msg=0x00fde6c4)  Line 140 + 0x3b bytes    C++
     simpleOPAL.exe!PAssertFunc(const char * file=0x00f5160c, int line=701, const char * className=0x00000000, PStandardAssertMessage msg=PNullPointerReference)  Line 117 + 0x18 bytes    C++
     simpleOPAL.exe!PSafePtr<SIPTransaction>::operator->()  Line 701 + 0x33 bytes    C++
     simpleOPAL.exe!SIPHandler::CollapseFork(SIPTransaction & transaction={...})  Line 359 + 0x8 bytes    C++
     simpleOPAL.exe!SIPHandler::OnReceivedOK(SIPTransaction & transaction={...}, SIP_PDU & __formal={...})  Line 348    C++
     simpleOPAL.exe!SIPEndPoint::OnReceivedOK(SIPTransaction & transaction={...}, SIP_PDU & response={...})  Line 673    C++
     simpleOPAL.exe!SIPEndPoint::OnReceivedResponse(SIPTransaction & transaction={...}, SIP_PDU & response={...})  Line 518    C++
     simpleOPAL.exe!SIPTransaction::OnReceivedResponse(SIP_PDU & response={...})  Line 2278    C++
     simpleOPAL.exe!SIPEndPoint::OnReceivedConnectionlessPDU(OpalTransport & transport={...}, SIP_PDU * pdu=0x0498d038)  Line 431    C++
     simpleOPAL.exe!SIPEndPoint::OnReceivedPDU(OpalTransport & transport={...}, SIP_PDU * pdu=0x0498d038)  Line 419 + 0x18 bytes    C++
     simpleOPAL.exe!SIPEndPoint::HandlePDU(OpalTransport & transport={...})  Line 248 + 0x18 bytes    C++
     simpleOPAL.exe!SIPEndPoint::NewIncomingConnection(OpalTransport * transport=0x04963868)  Line 138    C++
     simpleOPAL.exe!OpalEndPoint::ListenerCallback(PThread & __formal={...}, int param=76953704)  Line 282 + 0x11 bytes    C++
     simpleOPAL.exe!OpalEndPoint::ListenerCallback_PNotifier::Call(PObject & note={...}, int extra=76953704)  Line 173 + 0x27 bytes    C++
     simpleOPAL.exe!PNotifier::operator()(PObject & notifier={...}, int extra=76953704)  Line 96    C++
     simpleOPAL.exe!OpalListener::ListenForConnections(PThread & thread={...}, int __formal=0)  Line 456    C++
     simpleOPAL.exe!OpalListener::ListenForConnections_PNotifier::Call(PObject & note={...}, int extra=0)  Line 350 + 0x27 bytes    C++
     simpleOPAL.exe!PNotifier::operator()(PObject & notifier={...}, int extra=0)  Line 96    C++
     simpleOPAL.exe!PSimpleThread::Main()  Line 1894    C++
     simpleOPAL.exe!PThread::MainFunction(void * threadPtr=0x0238bf60)  Line 708    C++
     msvcr80d.dll!_callthreadstartex()  Line 348 + 0xf bytes    C
     msvcr80d.dll!_threadstartex(void * ptd=0x0238c7f8)  Line 331    C