Bug 1184925 - [abrt] bash: xfree(): bash killed by SIGABRT
Summary: [abrt] bash: xfree(): bash killed by SIGABRT
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: bash
Version: 21
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Ondrej Oprala
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:a0f42ac10e23ca433d7ff74892e...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-22 13:33 UTC by Gerard Torrent
Modified: 2016-02-01 02:10 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-07-27 06:46:14 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: backtrace (43.21 KB, text/plain)
2015-01-22 13:33 UTC, Gerard Torrent
no flags Details
File: cgroup (190 bytes, text/plain)
2015-01-22 13:33 UTC, Gerard Torrent
no flags Details
File: core_backtrace (4.77 KB, text/plain)
2015-01-22 13:33 UTC, Gerard Torrent
no flags Details
File: dso_list (933 bytes, text/plain)
2015-01-22 13:33 UTC, Gerard Torrent
no flags Details
File: environ (3.18 KB, text/plain)
2015-01-22 13:34 UTC, Gerard Torrent
no flags Details
File: limits (1.29 KB, text/plain)
2015-01-22 13:34 UTC, Gerard Torrent
no flags Details
File: maps (3.93 KB, text/plain)
2015-01-22 13:34 UTC, Gerard Torrent
no flags Details
File: open_fds (182 bytes, text/plain)
2015-01-22 13:34 UTC, Gerard Torrent
no flags Details
File: proc_pid_status (937 bytes, text/plain)
2015-01-22 13:34 UTC, Gerard Torrent
no flags Details
File: var_log_messages (29 bytes, text/plain)
2015-01-22 13:34 UTC, Gerard Torrent
no flags Details
coredumps 2015/03/18 (7.27 MB, application/octet-stream)
2015-03-18 18:42 UTC, Gerard Torrent
no flags Details

Description Gerard Torrent 2015-01-22 13:33:52 UTC
Description of problem:
'ls' command ina directory with a large number of directories

Version-Release number of selected component:
bash-4.3.33-1.fc21

Additional info:
reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        bash
crash_function: xfree
executable:     /usr/bin/bash
kernel:         3.17.8-300.fc21.x86_64
runlevel:       N 3
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #6 xfree at xmalloc.c:148
 #7 _rl_free_match_list at complete.c:1907
 #8 rl_complete_internal at complete.c:2063
 #9 _rl_dispatch_subseq at readline.c:879
 #10 _rl_dispatch at readline.c:822
 #11 readline_internal_char at readline.c:649
 #12 readline_internal_charloop at readline.c:676
 #13 readline_internal at readline.c:690
 #14 e at readline.c:416
 #15 yy_readline_get at ./parse.y:1455

Comment 1 Gerard Torrent 2015-01-22 13:33:55 UTC
Created attachment 982810 [details]
File: backtrace

Comment 2 Gerard Torrent 2015-01-22 13:33:56 UTC
Created attachment 982811 [details]
File: cgroup

Comment 3 Gerard Torrent 2015-01-22 13:33:57 UTC
Created attachment 982812 [details]
File: core_backtrace

Comment 4 Gerard Torrent 2015-01-22 13:33:59 UTC
Created attachment 982813 [details]
File: dso_list

Comment 5 Gerard Torrent 2015-01-22 13:34:00 UTC
Created attachment 982814 [details]
File: environ

Comment 6 Gerard Torrent 2015-01-22 13:34:01 UTC
Created attachment 982815 [details]
File: limits

Comment 7 Gerard Torrent 2015-01-22 13:34:02 UTC
Created attachment 982816 [details]
File: maps

Comment 8 Gerard Torrent 2015-01-22 13:34:03 UTC
Created attachment 982817 [details]
File: open_fds

Comment 9 Gerard Torrent 2015-01-22 13:34:05 UTC
Created attachment 982818 [details]
File: proc_pid_status

Comment 10 Gerard Torrent 2015-01-22 13:34:06 UTC
Created attachment 982819 [details]
File: var_log_messages

Comment 11 Ondrej Oprala 2015-01-22 15:32:26 UTC
Can you reproduce it every time? Could you provide me with some numbers for that dir (how many subdirs..)? Thanks

Comment 12 Gerard Torrent 2015-01-23 07:51:46 UTC
The directory contains 6 files and 25712 subdirs.

I can't reproduce the crash. I reviewed the content of $HOME/.bash_history in order to found the exact command but I found nothing distinct than usual. I tried 'ls', 'ls -sort', 'ls + tab' and 'ls + u + tab' for auto-completation, 'find . -name \*u\*', execute the previous commands as another user, ... and nothing. All runs fine :-(

note: tests were done after PC reboot.

Comment 13 Ondrej Oprala 2015-01-23 15:03:21 UTC
Hmm, that doesn't give me much to go on, looking at your /var/log tail, a core wasn't generated either... looking at the backtrace file, the crash was apparently caused by the readline part of bash, but still, too much info is optimized out. I'm going to have to close it for now, if you'll ever come across this again, feel free to reopen.

Comment 14 Gerard Torrent 2015-01-26 08:00:01 UTC
Another user experienced a similar problem:

> su - root
> ls /home/user1/dir_with_a_lot_of_subdirs/ + Tab + Ctrl-C


reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        -bash
crash_function: xfree
executable:     /usr/bin/bash
kernel:         3.18.3-201.fc21.x86_64
package:        bash-4.3.33-1.fc21
reason:         bash killed by SIGABRT
runlevel:       N 3
type:           CCpp
uid:            0

Comment 15 Gerard Torrent 2015-01-28 14:47:28 UTC
Hi Ondrej, I reproduced the error. Seems that is the combination of large number of subdirs + command + Tab + Ctrl-C. I can't reproduce systematically, but if I repeat some times then crash.

Comment 16 Ondrej Oprala 2015-03-18 11:15:36 UTC
Hey Gerard,
unfortunately, I still can't reproduce it on my side.
If you could generate a coredump and attach it, that would really help.

Thanks

Comment 17 Gerard Torrent 2015-03-18 18:31:01 UTC
Hi Ondrej,

I have reproduced the crash on a distinct machine (but same operating system). 
The error behaviour is slightly different, but triggered by the same procedure: command + tab + tab + ctrl-C
I attached 3 coredumps.

Commands used to recreate the environment:

  for i in $(seq 1 125712); do
    mktemp -d -p . -t XXXXXXXX
  done
  touch file1.txt
  touch file2.txt
  touch file3.txt
  touch file4.txt
  touch file5.txt

Commands used to enable the coredump:

  ulimit -c unlimited
  ulimit -a
  echo "core.%e.%p" > /proc/sys/kernel/core_pattern 

Commands used to create the crashes:

  more + tab + tab + ctrl-c
  ls + tab + tab + ctrl-c

Regards,
Gerard

Comment 18 Gerard Torrent 2015-03-18 18:42:20 UTC
Created attachment 1003379 [details]
coredumps 2015/03/18

coredumps created on 2015-03-18.

Comment 19 Ondrej Oprala 2015-07-07 06:20:48 UTC
The coredumps didn't tell me much :/ though some things have been fixed in bash since -33.1. Can you still reproduce this on a fully-updated F22?

Comment 20 Gerard Torrent 2015-07-18 06:44:51 UTC
I made some attempts and I cannot reproduce the bug in Fedora-22. Seems that the latest version has solved the bug. Good!

Comment 21 Ondrej Oprala 2015-07-27 06:46:14 UTC
Glad to hear that! I'll be closing this for now, feel free to reopen if you come across this again.


Note You need to log in before you can comment on or make changes to this bug.