Bug 1358845

Reproduced on an f24 box:

# rpm -qa libev\* \*nghttp\* | sort -V
libev-4.20-2.fc24.armv7hl
libev-debuginfo-4.20-2.fc24.armv7hl
libev-devel-4.20-2.fc24.armv7hl
libnghttp2-1.13.0-1.fc24.armv7hl
libnghttp2-devel-1.13.0-1.fc24.armv7hl
nghttp2-1.13.0-1.fc24.armv7hl
nghttp2-debuginfo-1.13.0-1.fc24.armv7hl

(gdb) bt
#0  0x7f62ebc4 in std::__invoke_impl<int, int (shrpx::ClientHandler::* const&)(), shrpx::ClientHandler&> (__t=..., __f=<optimized out>) at /usr/include/c++/6.1.1/functional:226
#1  std::__invoke<int (shrpx::ClientHandler::* const&)(), shrpx::ClientHandler&> (__fn=<optimized out>) at /usr/include/c++/6.1.1/functional:260
#2  std::_Mem_fn_base<int (shrpx::ClientHandler::*)(), true>::operator()<shrpx::ClientHandler&> (this=<optimized out>) at /usr/include/c++/6.1.1/functional:613
#3  std::_Function_handler<int (shrpx::ClientHandler&), int (shrpx::ClientHandler::*)()>::_M_invoke(std::_Any_data const&, shrpx::ClientHandler&) (__functor=..., __args#0=...) at /usr/include/c++/6.1.1/functional:1788
#4  0x7f6295b0 in std::function<int (shrpx::ClientHandler&)>::operator()(shrpx::ClientHandler&) const (__args#0=..., this=0x7fadce8c) at /usr/include/c++/6.1.1/functional:2136
#5  shrpx::ClientHandler::do_read (this=0x7fadcc60) at shrpx_client_handler.cc:615
#6  shrpx::(anonymous namespace)::readcb (loop=<optimized out>, w=<optimized out>, revents=<optimized out>) at shrpx_client_handler.cc:94
#7  0xb6e9893c in ev_invoke_pending (loop=0xb6eb0358 <default_loop_struct>) at ev.c:3155
#8  0xb6e9bc18 in ev_run (loop=0xb6eb0358 <default_loop_struct>, loop@entry=0x0, flags=-1226195944, flags@entry=0) at ev.c:3555
#9  0x7f618f30 in shrpx::worker_process_event_loop (wpconf=0x0) at shrpx_worker_process.cc:537
#10 0x7f5bf524 in shrpx::(anonymous namespace)::fork_worker_process (ssv=0xbeaf1c8c) at shrpx.cc:884
#11 shrpx::(anonymous namespace)::event_loop () at shrpx.cc:966
#12 0x7f5b9678 in shrpx::main (argc=6, argv=0xbeaf45b4) at shrpx.cc:3113
#13 0x7f5c1b58 in std::function<int (int, char**)>::operator()(int, char**) const (__args#1=<optimized out>, __args#0=<optimized out>, this=<optimized out>) at /usr/include/c++/6.1.1/functional:2136
#14 nghttp2::run_app(std::function<int (int, char**)>, int, char**) (app=..., argc=<optimized out>, argv=<optimized out>) at template.h:542
#15 0x7f5b7c90 in main (argc=<optimized out>, argv=<optimized out>) at shrpx.cc:3126

If I rebuild/reinstall libev from SRPM locally (the same NVR), nghttpx stops crashing but HTTP/2 curl's tests fail anyway after a while of hanging.

> If I rebuild/reinstall libev from SRPM locally (the same NVR), nghttpx stops
> crashing but HTTP/2 curl's tests fail anyway after a while of hanging.

Actually, only the first test hangs whereas the subsequent tests still crash the nghttpx worker.  It is reproducible also with libev-4.22-1.fc25 rebuilt for f24.

Here is another backtrace caught with the updated libev:

(gdb) bt
#0  0x00000000 in ?? ()
#1  std::function<int (shrpx::ClientHandler&)>::operator()(shrpx::ClientHandler&) const (__args#0=..., this=0x81188e8c) at /usr/include/c++/6.1.1/functional:2136
#2  shrpx::ClientHandler::do_read (this=0x81188c60) at shrpx_client_handler.cc:615
#3  shrpx::(anonymous namespace)::readcb (loop=<optimized out>, w=<optimized out>, revents=<optimized out>) at shrpx_client_handler.cc:94
#4  ev_invoke_pending (loop=0xb6f51358 <default_loop_struct>) at ev.c:3288
#5  ev_run (loop=0xb6f51358 <default_loop_struct>, loop@entry=0x0, flags=-1225536504, flags@entry=0) at ev.c:3688
#6  shrpx::worker_process_event_loop (wpconf=0x0) at shrpx_worker_process.cc:537
#7  shrpx::(anonymous namespace)::fork_worker_process (ssv=0xbeb99c8c) at shrpx.cc:884
#8  shrpx::(anonymous namespace)::event_loop () at shrpx.cc:966
#9  shrpx::main (argc=6, argv=0xbeb9c5b4) at shrpx.cc:3113
#10 std::function<int (int, char**)>::operator()(int, char**) const (__args#1=<optimized out>, __args#0=<optimized out>, this=<optimized out>) at /usr/include/c++/6.1.1/functional:2136
#11 nghttp2::run_app(std::function<int (int, char**)>, int, char**) (app=..., argc=<optimized out>, argv=<optimized out>) at template.h:542
#12 main (argc=<optimized out>, argv=<optimized out>) at shrpx.cc:3126

Rebuilding nghttp2 with -O1 in CXXFLAGS prevents nghttpx from crashing.

-- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -156,8 +156,12 @@ endif # HAVE_MRUBY
 noinst_LIBRARIES = libnghttpx.a
 libnghttpx_a_SOURCES = ${NGHTTPX_SRCS}
 libnghttpx_a_CPPFLAGS = ${AM_CPPFLAGS}

+# needed for shrpx_client_handler.cc and shrpx_http_downstream_connection.cc
+# on armv7hl -- see https://bugzilla.redhat.com/1358845 for details
+libnghttpx_a_CXXFLAGS = -fno-strict-aliasing
+
 nghttpx_SOURCES = shrpx.cc shrpx.h
 nghttpx_CPPFLAGS = ${libnghttpx_a_CPPFLAGS}
 nghttpx_LDADD = libnghttpx.a ${LDADD}

This bug appears to have been reported against 'rawhide' during the Fedora 25 development cycle.
Changing version to '25'.

Created attachment 1184185 [details]
[PATCH] nghttpx: avoid using std::function to fix crash on armv7hl

There seems to be some problem with nghttp's use of std::function.  The attached patch makes the crashes go away.  I am not familiar with std::function myself, so it is not clear to me whether it is a bug of nghttp or a gcc bug.

Reported as gcc bug #1360319 with minimal example: attachment #1184246 [details]

Reported to nghttp2 upstream: https://github.com/nghttp2/nghttp2/issues/635

curl now builds on armv7hl without any workaround in place:

http://koji.fedoraproject.org/koji/buildinfo?buildID=785581