Bug 1005495 - [abrt] qemu-system-x86-1.6.0-6.fc20: object_dynamic_cast_assert: Process /usr/bin/qemu-system-x86_64 was killed by signal 6 (SIGABRT)
[abrt] qemu-system-x86-1.6.0-6.fc20: object_dynamic_cast_assert: Process /usr...
Product: Fedora
Classification: Fedora
Component: qemu (Show other bugs)
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Fedora Virtualization Maintainers
Fedora Extras Quality Assurance
Depends On:
Blocks: 1007325
  Show dependency treegraph
Reported: 2013-09-07 11:55 EDT by Joachim Frieben
Modified: 2013-09-30 22:17 EDT (History)
13 users (show)

See Also:
Fixed In Version: qemu-1.6.0-8.fc20
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1007325 (view as bug list)
Last Closed: 2013-09-30 22:17:50 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
File: backtrace (25.57 KB, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
File: cgroup (159 bytes, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
File: core_backtrace (12.12 KB, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
File: dso_list (13.67 KB, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
File: environ (180 bytes, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
File: limits (1.29 KB, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
File: maps (67.44 KB, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
File: open_fds (1.62 KB, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
File: proc_pid_status (929 bytes, text/plain)
2013-09-07 11:56 EDT, Joachim Frieben
no flags Details
[PATCH] ehci: Fix crash with isoc usb packets (1.10 KB, patch)
2013-09-09 04:23 EDT, Hans de Goede
no flags Details | Diff
[PATCH v2] ehci: save device pointer in EHCIState (2.27 KB, patch)
2013-09-09 06:52 EDT, Hans de Goede
no flags Details | Diff

  None (edit)
Description Joachim Frieben 2013-09-07 11:55:55 EDT
Version-Release number of selected component:

Additional info:
reporter:       libreport-2.1.6
backtrace_rating: 4
cmdline:        /usr/bin/qemu-system-x86_64 -machine accel=kvm -name boxes-unknown -S -machine pc-i440fx-1.6,accel=kvm,usb=off -cpu Penryn,+osxsave,+xsave,+pdcm,+xtpr,+tm2,+est,+smx,+vmx,+ds_cpl,+monitor,+dtes64,+pbe,+tm,+ht,+ss,+acpi,+ds,+vme -m 1054 -realtime mlock=off -smp 2,sockets=1,cores=2,threads=1 -uuid 8d32e017-7756-400a-871f-e5a604a4e1fc -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/home/frieben/.config/libvirt/qemu/lib/boxes-unknown.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -no-kvm-pit-reinjection -no-shutdown -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x5.0x7 -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x5 -device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x5.0x1 -device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x5.0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x6 -device usb-ccid,id=ccid0 -drive file=/home/frieben/.local/share/gnome-boxes/images/boxes-unknown,if=none,id=drive-ide0-0-0,format=qcow2,cache=none -device ide-hd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1 -drive file=/home/frieben/Downloads/iso/ReactOS/ReactOS-BootCD.iso,if=none,id=drive-ide0-1-0,readonly=on,format=raw -device ide-cd,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 -netdev user,id=hostnet0 -device rtl8139,netdev=hostnet0,id=net0,mac=52:54:00:f5:fb:e9,bus=pci.0,addr=0x3 -chardev spicevmc,id=charsmartcard0,name=smartcard -device ccid-card-passthru,chardev=charsmartcard0,id=smartcard0,bus=ccid0.0 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -device usb-tablet,id=input0 -spice port=5900,addr=,disable-ticketing,image-compression=off,seamless-migration=on -device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,bus=pci.0,addr=0x2 -device AC97,id=sound0,bus=pci.0,addr=0x4 -chardev spicevmc,id=charredir0,name=usbredir -device usb-redir,chardev=charredir0,id=redir0 -chardev spicevmc,id=charredir1,name=usbredir -device usb-redir,chardev=charredir1,id=redir1 -chardev spicevmc,id=charredir2,name=usbredir -device usb-redir,chardev=charredir2,id=redir2 -chardev spicevmc,id=charredir3,name=usbredir -device usb-redir,chardev=charredir3,id=redir3 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x7
crash_function: object_dynamic_cast_assert
executable:     /usr/bin/qemu-system-x86_64
kernel:         3.11.0-3.fc20.x86_64
runlevel:       5 3
uid:            1001

Truncated backtrace:
Thread no. 1 (10 frames)
 #2 object_dynamic_cast_assert at qom/object.c:456
 #3 ehci_process_itd at hw/usb/hcd-ehci.c:1489
 #4 ehci_state_fetchitd at hw/usb/hcd-ehci.c:1759
 #5 ehci_advance_state at hw/usb/hcd-ehci.c:2096
 #6 ehci_advance_periodic_state at hw/usb/hcd-ehci.c:2251
 #7 ehci_frame_timer at hw/usb/hcd-ehci.c:2333
 #8 qemu_run_timers at qemu-timer.c:394
 #10 qemu_run_all_timers at qemu-timer.c:452
 #11 main_loop_wait at main-loop.c:471
 #12 main_loop at vl.c:2090
Comment 1 Joachim Frieben 2013-09-07 11:56:04 EDT
Created attachment 795139 [details]
File: backtrace
Comment 2 Joachim Frieben 2013-09-07 11:56:09 EDT
Created attachment 795140 [details]
File: cgroup
Comment 3 Joachim Frieben 2013-09-07 11:56:15 EDT
Created attachment 795141 [details]
File: core_backtrace
Comment 4 Joachim Frieben 2013-09-07 11:56:21 EDT
Created attachment 795142 [details]
File: dso_list
Comment 5 Joachim Frieben 2013-09-07 11:56:27 EDT
Created attachment 795143 [details]
File: environ
Comment 6 Joachim Frieben 2013-09-07 11:56:34 EDT
Created attachment 795144 [details]
File: limits
Comment 7 Joachim Frieben 2013-09-07 11:56:42 EDT
Created attachment 795145 [details]
File: maps
Comment 8 Joachim Frieben 2013-09-07 11:56:48 EDT
Created attachment 795146 [details]
File: open_fds
Comment 9 Joachim Frieben 2013-09-07 11:56:53 EDT
Created attachment 795147 [details]
File: proc_pid_status
Comment 10 Cole Robinson 2013-09-08 13:39:34 EDT
Christoph, what were you doing when the crash happened? What OS is this?

Traceback from ehci, CCing gerd and hans
Comment 11 Joachim Frieben 2013-09-08 14:36:48 EDT
As stated in the initial report, qemu was launched with boot option

  -drive file=/home/frieben/Downloads/iso/ReactOS/ReactOS-BootCD.iso ,

thus from the standard ReactOS 0.3.15 install media. The crash occurred after confirming that the OS was to be installed to drive C:

However, GNOME Boxes also crashes when booting from the corresponding image file ReactOS.vmdk.
Comment 12 Hans de Goede 2013-09-09 04:22:37 EDT
Ah, good catch, thanks for the bug-report. This is a regression in the qemu ehci code in 1.6.0, I've managed to reproduce this, and I've just completed writing a fix for it.

I'll attach the patch fixing this. Cole can you please add this patch to the F20+ qemu builds? I'll try to get it into qemu-1.6.1 .
Comment 13 Hans de Goede 2013-09-09 04:23:19 EDT
Created attachment 795526 [details]
[PATCH] ehci: Fix crash with isoc usb packets
Comment 14 Hans de Goede 2013-09-09 06:52:22 EDT
Created attachment 795576 [details]
[PATCH v2] ehci: save device pointer in EHCIState

Upstream discussion has led to a slightly different patch.
Comment 15 Gerd Hoffmann 2013-09-12 05:35:05 EDT
commit adbecc89731cf3e0ae656d50ea9fa58c589c4bdc
Comment 16 Fedora Update System 2013-09-24 12:23:10 EDT
qemu-1.6.0-8.fc20 has been submitted as an update for Fedora 20.
Comment 17 Fedora Update System 2013-09-26 02:29:39 EDT
Package qemu-1.6.0-8.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing qemu-1.6.0-8.fc20'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
Comment 18 Fedora Update System 2013-09-30 22:17:50 EDT
qemu-1.6.0-8.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.