Re: (ITS#5586) SLAPD crashing with SIGABRT in connection.c on Solaris - reference through nil pointer

[dbb@st-andrews.ac.uk]

Just an update, still present in 2.4.11, backtrace below. Still can't 
work out why it's happening,
it's something in the way that sendmail uses ldap and not the actual 
queries that cause the crash.

I can replay the connections and searches to the server, and I've used 
Suns ldap load testing software
to load up the server way over what we ever see and I can't replicate 
the SIGABRT or crash it in any
other way.

Any help appreciated.

Thanks,
          Duncan


# /usr/local/SUNWspro/bin/dbx 
/source/openldap-2.4.11/servers/slapd/.libs/slapd 
./slapd-2.4.11-core-1300-4-8-08
For information about new features see `help changes'
To remove this message, put `dbxenv suppress_startup_message 7.6' in 
your .dbxrc
Reading slapd
core file header read successfully
Reading ld.so.1
Reading libldap_r-2.4.so.2.1.0
Reading liblber-2.4.so.2.1.0
Reading libltdl.so.3.1.5
Reading libdb-4.2.so
Reading libicuuc.so.3
Reading libicudata.so.3
Reading libsasl2.so.2.0.22
Reading libdl.so.1
Reading libssl.so.0.9.8
Reading libcrypto.so.0.9.8
Reading libresolv.so.2
Reading libgen.so.1
Reading libnsl.so.1
Reading libsocket.so.1
Reading libc.so.1
Reading libgcc_s.so.1
Reading libgcc_s.so.1
Reading libpthread.so.1
Reading libm.so.2
Reading libCrun.so.1
Reading libc_psr.so.1
t@2 (l@2) terminated by signal ABRT (Abort)
0xfe2c0f90: __lwp_kill+0x0008:  bcc,a,pt  %icc,__lwp_kill+0x18  ! 0xfe2c0fa0
Current function is connection_next
  871                   assert( connections[*index].c_conn_state == 
SLAP_C_INVALID );
(dbx) where
current thread: t@2
  [1] __lwp_kill(0x0, 0x6, 0x0, 0x6, 0xfc00, 0x0), at 0xfe2c0f90
  [2] raise(0x6, 0x0, 0xfe2a4a98, 0xffffffff, 0xfe2e8284, 0x6), at 
0xfe25fd78
  [3] abort(0xfdfff3f0, 0x1, 0xfe2e9288, 0xa83f0, 0xfe2eb298, 0x0), at 
0xfe23ff98
  [4] __assert(0x1a1808, 0x1a183c, 0x367, 0x0, 0xa810c, 0x1d7b80), at 
0xfe2401d4
=>[5] connection_next(c = (nil), index = 0xfdfff6d4), line 871 in 
"connection.c"
  [6] connections_timeout_idle(now = 1217851229), line 225 in "connection.c"
  [7] slapd_daemon_task(ptr = (nil)), line 2152 in "daemon.c"
(dbx) threads
      t@1  a  l@1   ?()   LWP suspended in  __lwp_wait()
o>    t@2  a  l@2   slapd_daemon_task()   signal SIGABRT in  __lwp_kill()
      t@3  a  l@3   ldap_int_thread_pool_wrapper()   sleep on 0x258570  
in  __lwp_park()
      t@4  a  l@4   ldap_int_thread_pool_wrapper()   sleep on 0x258570  
in  __lwp_park()
      t@5  a  l@5   ldap_int_thread_pool_wrapper()   sleep on 0x258570  
in  __lwp_park()
      t@6  a  l@6   ldap_int_thread_pool_wrapper()   sleep on 0x258570  
in  __lwp_park()


Current function is connection_next
  871                   assert( connections[*index].c_conn_state == 
SLAP_C_INVALID );
(dbx) dump
c_struct = 1
index = 0xfdfff6d4
c = (nil)

(dbx) up
Current function is connections_timeout_idle
  225                   c = connection_next( c, &connindex ) )
(dbx) dump
connindex = 21
c = 0x2c14b0
now = 1217851229
i = 3

(dbx) up
Current function is slapd_daemon_task
 2152                           connections_timeout_idle( now );
(dbx) dump
rtask = (nil)
cat = RECORD
nwriters = 0
nfds = 68
writefds = RECORD
at = 1
now = 1217851229
ns = 0
nrfds = 0
readfds = RECORD
tdelta = 1
nwfds = 0
tvp = 0xfdfffb60
i = 22
tv = RECORD
last_idle_check = 1217851221
l = 1
idle = RECORD
ptr = (nil)
ebadf = 0