Comment 1 for bug 1466415

#0 0x00007f15a8880cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007f15a88840d8 in __GI_abort () at abort.c:89
#2 0x00007f15a8879b86 in __assert_fail_base (fmt=0x7f15a89ca830 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0xaf7b40 "label <= 0xFFFFFF",
    file=file@entry=0xaf7b68 "controller/src/bgp/bgp_attr_base.cc", line=line@entry=37,
    function=function@entry=0xaf7bc0 <BgpProtoPrefix::WriteLabel(unsigned long, unsigned int, bool)::__PRETTY_FUNCTION__> "void BgpProtoPrefix::WriteLabel(size_t, uint32_t, bool)") at assert.c:92
#3 0x00007f15a8879c32 in __GI___assert_fail (assertion=0xaf7b40 "label <= 0xFFFFFF", file=0xaf7b68 "controller/src/bgp/bgp_attr_base.cc", line=37,
    function=0xaf7bc0 <BgpProtoPrefix::WriteLabel(unsigned long, unsigned int, bool)::__PRETTY_FUNCTION__> "void BgpProtoPrefix::WriteLabel(size_t, uint32_t, bool)") at assert.c:101
#4 0x00000000005b7cf0 in BgpProtoPrefix::WriteLabel (this=this@entry=0x7f159c03f570, label_offset=label_offset@entry=22, label=label@entry=4294967295, is_vni=is_vni@entry=true)
    at controller/src/bgp/bgp_attr_base.cc:37
#5 0x000000000045079d in WriteLabel (label=4294967295, offset=22, attr=0x7f1598535600, proto_prefix=0x7f159c03f570) at controller/src/bgp/evpn/evpn_route.cc:61
#6 EvpnPrefix::BuildProtoPrefix (this=0x7f159c55afd8, attr=0x7f1598535600, label=4294967295, proto_prefix=0x7f159c03f570) at controller/src/bgp/evpn/evpn_route.cc:260
#7 0x00000000005c2aec in BgpMessage::StartReach (this=this@entry=0x7f159c5d8300, roattr=roattr@entry=0x7f159d2a9418, route=route@entry=0x7f159c55af40) at controller/src/bgp/bgp_message_builder.cc:125
#8 0x00000000005c3a2b in Start (route=0x7f159c55af40, roattr=0x7f159d2a9418, this=0x7f159c5d8300) at controller/src/bgp/bgp_message_builder.cc:171
#9 BgpMessageBuilder::Create (this=<optimized out>, table=0x1d5df10, roattr=0x7f159d2a9418, route=0x7f159c55af40) at controller/src/bgp/bgp_message_builder.cc:241
#10 0x0000000000639979 in RibOutUpdates::DequeueCommon (this=this@entry=0x7f159c3e1f90, marker=marker@entry=0x7f159c3e2078, rt_update=0x7f159c692d30, blocked=blocked@entry=0x7f15a1cfab30)
    at controller/src/bgp/bgp_ribout_updates.cc:120
#11 0x0000000000639d2d in RibOutUpdates::TailDequeue (this=0x7f159c3e1f90, queue_id=1, msync=..., blocked=0x7f15a1cfab30) at controller/src/bgp/bgp_ribout_updates.cc:197
#12 0x0000000000674a83 in SchedulingGroup::UpdateRibOut (this=0x7f158c33c570, ribout=0x7f159c3e1d60, queue_id=1) at controller/src/bgp/scheduling_group.cc:1070
#13 0x00000000006799c5 in SchedulingGroup::Worker::Run (this=0x7f159c4cc150) at controller/src/bgp/scheduling_group.cc:425
#14 0x0000000000aafa60 in TaskImpl::execute (this=0x7f15a20d4140) at controller/src/base/task.cc:238
#15 0x00007f15a9657b3a in ?? () from /usr/lib/libtbb.so.2
#16 0x00007f15a9653816 in ?? () from /usr/lib/libtbb.so.2
#17 0x00007f15a9652f4b in ?? () from /usr/lib/libtbb.so.2
#18 0x00007f15a964f0ff in ?? () from /usr/lib/libtbb.so.2
#19 0x00007f15a964f2f9 in ?? () from /usr/lib/libtbb.so.2
#20 0x00007f15a9873182 in start_thread (arg=0x7f15a1cfb700) at pthread_create.c:312
#21 0x00007f15a894447d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

(gdb) fr 6
#6 EvpnPrefix::BuildProtoPrefix (this=0x7f159c55afd8, attr=0x7f1598535600, label=4294967295, proto_prefix=0x7f159c03f570) at controller/src/bgp/evpn/evpn_route.cc:260
260 in controller/src/bgp/evpn/evpn_route.cc

# Tag is 0xFFFFFFFF
(gdb) p this->tag_
$3 = 4294967295
(gdb)

(gdb) p &route->path_
$15 = (Route::PathList *) 0x7f159c55afc0
(gdb) x /10x 0x7f159c55afc0
0x7f159c55afc0: 0x00000001 0x00000000 0x9c41fdf8 0x00007f15
0x7f159c55afd0: 0x9c41fdf8 0x00007f15 0x07010001 0x004d0707
0x7f159c55afe0: 0x00000500 0x000000fc
# Label is 0xFFFFFFFF
(gdb) p *(BgpPath *) 0x00007f159c41fdf0
$16 = (BgpPath) {
  <Path> = {
    _vptr.Path = 0xafac10 <vtable for BgpPath+16>,
    node_ = <boost::intrusive_hook> next = 0x7f159c55afc8 prev = 0x7f159c55afc8,
    time_stamp_usecs_ = 1434526297530868
  },
  members of BgpPath:
  static INFEASIBLE_MASK = 11,
  peer_ = 0x7f158d061e70,
  path_id_ = 117901133,
  source_ = BgpPath::BGP_XMPP,
  attr_ = (boost::intrusive_ptr<BgpAttr const>) 0x7f1598535600,
  flags_ = 0,
  label_ = 4294967295
}
# Peer is MX and EBGP peering
(gdb) p ((BgpPeer *) 0x7f158d061e70)->peer_name_
$17 = "default-domain:default-project:ip-fabric:__default__:walsh"
(gdb) p ((BgpPeer *) 0x7f158d061e70)->peer_type_
$18 = BgpProto::EBGP

# Encap is set as VXLAN
(gdb) p ((BgpAttr *) 0x7f1598535600)->ext_community_
$28 = (boost::intrusive_ptr<ExtCommunity const>) 0x7f15992bac60
(gdb) p /x *(ExtCommunity *) 0x7f15992bac60
$29 = (ExtCommunity) {
  _vptr.ExtCommunity = 0xb099d0 <vtable for ExtCommunity+16>,
  refcount_ = {
    <tbb::internal::atomic_impl_with_arithmetic<int, int, char>> = {
      <tbb::internal::atomic_impl<int>> = {
        my_storage = {
          my_value = 0x1
        }
      }, <No data fields>}, <No data fields>},
  extcomm_db_ = 0x1d3b700,
  communities_ = std::vector of length 3, capacity 4 = {{0x0, 0x2, 0xfc, 0x0, 0x0, 0x0, 0x13, 0x88}, {0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
}

Crash is seen for following route update from MX:

Jun 17 17:43:13.597359 BGP SEND 7.7.7.77+179 -> 10.204.216.58+55734
Jun 17 17:43:13.597423 BGP SEND message type 2 (Update) length 104
Jun 17 17:43:13.597460 BGP SEND Update PDU length 104
Jun 17 17:43:13.597499 BGP SEND flags 0x40 code Origin(1): IGP
Jun 17 17:43:13.597540 BGP SEND flags 0x40 code ASPath(2) length 0: <null>
Jun 17 17:43:13.597579 BGP SEND flags 0x40 code LocalPref(5): 100
Jun 17 17:43:13.597627 BGP SEND flags 0xc0 code Extended Communities(16): 2:64512:5000 30c:0:0:0:0:0:8 esi-label:all-active(label 0)
Jun 17 17:43:13.597670 BGP SEND flags 0x90 code MP_reach(14): AFI/SAFI 25/70
Jun 17 17:43:13.597718 BGP SEND nhop 7.7.7.77 len 4
Jun 17 17:43:13.597785 BGP SEND 1:7.7.7.77:0::050000fc000000019000::FFFF:FFFF/304

Tunnel Encap is VXLAN(30c:0:0:0:0:0:8).

Due to this the label is set as 0xFFFFFFFF (For which WriteLabel asserts)

The crash was seen when Mx peering was set as EBGP as Control-node would try to re advertise this route (with label 0xFFFFFFFF).