local caput causes ioc crash on win32
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
EPICS Base |
Fix Released
|
Medium
|
Jeff Hill |
Bug Description
From Carsten Winkler:
Problem: softIoc.exe runs into fatal exception after caput call from local host.
caput calls does not change the behavior.
Error message: "softIoc has encountered a problem and needs to close. We are sorry for the
inconvience."
Error details: AppName: softioc.exe; AppVer:0.0.0.0; ModName: com.dll; ModVer: 3.14.12.0;
Offset: 0000a613
System: EPICS 3.14.12 plus all published patches (8 Feb. 2011), no local changes
(compiled with MVS 2010 professional - without any error)
Host: Windows XP SP3 @ Pentium 4 with 3.2GHz and 3GB RAM
Test setup: The following configuration files have been used:
startDemo.bat:
DemoIOC.cmd:
demo.db:
call stack:
Com.dll!
Com.dll!
Com.dll!
msvcr100d.
msvcr100d.
kernel32.
exception occurred here:
void ellDelete (ELLLIST *pList, ELLNODE *pNode)
{
if (pList-
else
(s. memory map)
if (pList->node.next == pNode)
else
pList-
return;
}
This function was called from "static void epicsParmCleanu
osdThread.c
memory maps:
- pList 0x00a22ed0 {node={...} count=23 } ELLLIST *
- node {next=0x00a24728 previous=0x00cf0c60 } ELLNODE
- next 0x00a24728 {next=0x00a26340 previous=0x00000000 } ELLNODE *
- next 0x00a26340 {next=0x00adbd90 previous=0x00a24728 } ELLNODE *
[... 20 thread parameter blocks in this list without address 0x00cf0d08]
+ previous 0x00cf0de0 {next=0x00cf0c60 previous=0x00cf0b40 } ELLNODE *
+ previous 0x00cf0b40 {next=0x00cf0de0 previous=0x00af1ac0 } ELLNODE *
[... 20 thread parameter blocks in this list without address 0x00cf0d08]
count 23 int
- pNode 0x00cf0d08 {next=0x00000000 previous=0x00000000 } ELLNODE *
+ next 0x00000000 {next=??? previous=??? } ELLNODE *
next CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
previous CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
+ previous 0x00000000 {next=??? previous=??? } ELLNODE *
next CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
previous CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
0x00CF0C80 00 00 00 00 43 41 53 2d 65 76 65 6e 74 00 fd fd fd fd dd dd dd dd dd dd 09 00 0c 00 a1
01 0c 02 a0 12 ....CAS-
0x00CF0CA2 cf 00 e8 0c cf 00 00 00 00 00 00 00 00 00 18 00 00 00 01 00 00 00 fd 26 00 00 fd fd fd
fd 00 00 00 00 Ï.è.Ï..
This looks like there is a situation (with a 40% chance), in which the thread parameter block of a
CAS-event task is not added to the thread list when the client connects. When the clients
disconnects and the thread gets shut down, it tries to remove its parameter block from the thread
list by calling ellDelete() with a node that is not in the list. ellDelete() behaves fragile and
crashes the softIoc (by dereferencing a null pointer). This exception seems to occur only when caput
has been called from local host.
Related branches
Changed in epics-base: | |
milestone: | none → 3.14.branch |
status: | Confirmed → Fix Committed |
Changed in epics-base: | |
status: | Fix Committed → Fix Released |
this bug occurrs only on win32