Assertion failure happens soon after Transmission startup

[User294]

Configuration:

Latest SVN revision of Transmission (12052).

To reproduce:

For me it's enough to start GTK+ client with usual torrents set and wait for several seconds.

Result:
---cut---
$ transmission-gtk
transmission-gtk: peer-mgr.c:1611: peerCallbackFunc: Assertion `peer->atom != ((void *)0)' failed.
Aborted
---cut---

Note:

1) 5-days old SVN is OK for me - seems to be recently introduced bug.
2) Can't specify suitable version, 2.21 used unstead. This is INCORRECT - bug is SVN-only.

[User294]

This issue seems to be caused by changeset 12041 (https://trac.transmissionbt.com/changeset/12041)

---

(trunk libT) peer-mgr.c peerCallbackFunc(): Replace some "should always be true" tests with assert()s. These tests used to be useful, but I don't think they are anymore. The assert()s have been put in their place to test that theory...

---

As for me looks like "test failed".

[jordan]

Yes, I agree that's the commit that caused the crash.

I could just undo that commit, but I think overall it's a valid assertion, and that the crash you're seeing is actually a caused by a (small) bug that's being triggered by the new assertion.

I'll try to add some code tonight to fix this w/o reverting r12041

[jordan]

User294: the problem wasn't what I thought it was, and I'd like to understand the issue before I remove the assertion or remove any other code. Would it be possible for you to attach a gdb backtrace from the assertion crash?

IIRC we've walked through those steps before. But if I'm misremembering and you gdb help, just ask.

[User294]

I'd like to understand the issue before I remove the assertion or remove any other code.

Sounds reasonable for me. I'm going to help you as much as I can and as time permits.

Would it be possible for you to attach a gdb backtrace from the assertion crash?

Ok, I collected one for crashing thread. Sorry, it has been usual (optimized) build, so some things were optimized out. If that's not enough I can re-compile without optimizations and/or attach backtraces of other threads as well.

IIRC we've walked through those steps before.

I can remember I posted rare crash with old libcurl but it has been rare enough so I only managed to get partial backtrace with missing symbols. It has been tricky to catch it under debugger.

But if I'm misremembering and you gdb help, just ask

I'm starting to feel somewhat in control of my GDB, though it's not perfect for sure :). Well, here backtrace goes. If you need backtraces of other threads and/or optimized-out values, just ask and I will collect these as well.

Backtrace for crashing thread:

[New Thread 0x7fffedd69700 (LWP 10648)]
[New Thread 0x7fffed568700 (LWP 10649)]
[New Thread 0x7fffecd67700 (LWP 10650)]
transmission-gtk: peer-mgr.c:1611: peerCallbackFunc: Assertion `peer->atom != ((void *)0)' failed.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffedd69700 (LWP 10648)]
0x00007ffff3a4aa75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
        in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0  0x00007ffff3a4aa75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff3a4e5c0 in *__GI_abort () at abort.c:92
#2  0x00007ffff3a43941 in *__GI___assert_fail (assertion=0x4d5706 "peer->atom != ((void *)0)", file=<value optimized out>, line=1611, function=0x4d61e0 "peerCallbackFunc")
    at assert.c:81
#3  0x0000000000490034 in peerCallbackFunc (peer=0xb56170, e=0x7fffedd68b40, vt=0xb560c0) at peer-mgr.c:1611
#4  0x00000000004a3e4a in publish (w=0xb56170, e=0x7fffedd68b40) at webseed.c:84
#5  0x00000000004a3ed7 in fire_client_got_rej (tor=0xb556c0, w=0xb56170, block=4464) at webseed.c:93
#6  0x00000000004a4371 in web_response_func (session=0x740620, did_connect=0 '\000', did_timeout=0 '\000', response_code=0, response=0x0, response_byte_count=0, vtask=0x108fbb0)
    at webseed.c:214
#7  0x000000000047f75f in task_finish_func (vtask=0x71dcf0) at web.c:204
#8  0x000000000047a49a in readFromPipe (fd=10, eventType=2, veh=0x73f140) at trevent.c:193
#9  0x00007ffff5a2112c in event_process_active_single_queue (base=0x740370, flags=<value optimized out>) at event.c:1287
#10 event_process_active (base=0x740370, flags=<value optimized out>) at event.c:1354
#11 event_base_loop (base=0x740370, flags=<value optimized out>) at event.c:1551
#12 0x000000000047a63a in libeventThreadFunc (veh=0x73f140) at trevent.c:245
#13 0x000000000045fa21 in ThreadFunc (_t=0x73d3f0) at platform.c:118
#14 0x00007ffff53979ca in start_thread (arg=<value optimized out>) at pthread_create.c:300
#15 0x00007ffff3afd70d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#16 0x0000000000000000 in ?? ()
(gdb) bt full
#0  0x00007ffff3a4aa75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        pid = <value optimized out>
        selftid = <value optimized out>
#1  0x00007ffff3a4e5c0 in *__GI_abort () at abort.c:92
        act = {__sigaction_handler = {sa_handler = 0x4d5706, sa_sigaction = 0x4d5706}, sa_mask = {__val = {140737282177615, 140737183647904, 1611, 140737183648144, 
              140737281253606, 206158430232, 140737183648160, 140737183647936, 140737281160952, 206158430256, 140737183648184, 140737090632816, 140737085702176, 10, 
              140737282182854, 140737488348553}}, sa_flags = -206185734, sa_restorer = 0x4d540a}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007ffff3a43941 in *__GI___assert_fail (assertion=0x4d5706 "peer->atom != ((void *)0)", file=<value optimized out>, line=1611, function=0x4d61e0 "peerCallbackFunc")
    at assert.c:81
        buf = 0x7fffe84b3c70 "transmission-gtk: peer-mgr.c:1611: peerCallbackFunc: Assertion `peer->atom != ((void *)0)' failed.\n"
#3  0x0000000000490034 in peerCallbackFunc (peer=0xb56170, e=0x7fffedd68b40, vt=0xb560c0) at peer-mgr.c:1611
        t = 0xb560c0
        __PRETTY_FUNCTION__ = "peerCallbackFunc"
#4  0x00000000004a3e4a in publish (w=0xb56170, e=0x7fffedd68b40) at webseed.c:84
No locals.
#5  0x00000000004a3ed7 in fire_client_got_rej (tor=0xb556c0, w=0xb56170, block=4464) at webseed.c:93
        e = {eventType = TR_PEER_CLIENT_GOT_REJ, pieceIndex = 279, bitfield = 0x0, offset = 0, length = 16384, err = 0, wasPieceData = 0 '\000', port = 0}
#6  0x00000000004a4371 in web_response_func (session=0x740620, did_connect=0 '\000', did_timeout=0 '\000', response_code=0, response=0x0, response_byte_count=0, vtask=0x108fbb0)
    at webseed.c:214
        t = 0x108fbb0
        w = 0xb56170
        tor = 0xb556c0
        success = 0
#7  0x000000000047f75f in task_finish_func (vtask=0x71dcf0) at web.c:204
        task = 0x71dcf0
#8  0x000000000047a49a in readFromPipe (fd=10, eventType=2, veh=0x73f140) at trevent.c:193
        data = {func = 0x47f68b <task_finish_func>, user_data = 0x71dcf0}
        nwant = 16
        ngot = 16
        ch = 114 'r'
        ret = 1
        eh = 0x73f140
        __PRETTY_FUNCTION__ = "readFromPipe"
#9  0x00007ffff5a2112c in event_process_active_single_queue (base=0x740370, flags=<value optimized out>) at event.c:1287
        ev = 0x73f5f0
#10 event_process_active (base=0x740370, flags=<value optimized out>) at event.c:1354
        i = 0
#11 event_base_loop (base=0x740370, flags=<value optimized out>) at event.c:1551
---Type <return> to continue, or q <return> to quit---
        n = 1
        evsel = 0x7ffff5c4fbe0
        tv = {tv_sec = 0, tv_usec = 282373}
        tv_p = <value optimized out>
        res = <value optimized out>
        retval = <value optimized out>
        __func__ = "event_base_loop"
#12 0x000000000047a63a in libeventThreadFunc (veh=0x73f140) at trevent.c:245
        base = 0x740370
        eh = 0x73f140
#13 0x000000000045fa21 in ThreadFunc (_t=0x73d3f0) at platform.c:118
        t = 0x73d3f0
#14 0x00007ffff53979ca in start_thread (arg=<value optimized out>) at pthread_create.c:300
        __res = <value optimized out>
        pd = 0x7fffedd69700
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140737183651584, 699829674412831025, 8388608, 140737183652288, 0, 0, -699869058704117455, -699851162064162511}, 
              mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#15 0x00007ffff3afd70d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#16 0x0000000000000000 in ?? ()

[livings124]

#4077 is a duplicate of this.

[jordan]

User294: that's perfect, thank you.

I'd overlooked the case of webseeds -- there wasn't a bug before, the new assertion was in error. Thanks very much for posting the backtrace.

Fixed in r12073.

[User294]

Great! Now I would be able also to retest quite obscure bug #4078 I suspected to be here for several months or so but I was unable to figure out exact details/conditions so I haven't created it as I was unable to provide a good description of conditions/ways to reproduce it.