Re: Subversion BDB doesn't work with Apache 2.4 event MPM

Branko Čibej <brane_at_apache.org> writes:

> On 02.04.2012 18:46, Philip Martin wrote:
>> I am unable to run the Subversion regression tests for BDB and DAV with
>> Apache 2.4 using the event MPM (the new default MPM in 2.4). Sometimes
>> mod_dav_svn SEGVs causing tests to FAIL and sometimes the tests hang
>> with mod_dav_svn spinning in a loop. The problems go away when I switch
>> to the worker MPM (the old default MPM in 2.2).
>>
>> I'm not sure what the event MPM does that causes the problem. Here is a
>> typical SEGV:
>>
>> #0 0x00007fb2017f8e96 in svn_error_clear (err=0x2031203920312038)
>> at ../src/subversion/libsvn_subr/error.c:341
>> 341 while (err->child)
>> (gdb) p err
>> $1 = (svn_error_t *) 0x2031203920312038
>> (gdb) p err[0]
>> Cannot access memory at address 0x2031203920312038
>
> Looks like the DB_REGISTER dance biting us yet again. Pool lifetimes
> most likely, it's a tricky bit of code. Hard to say for certain since I
> don't know how the event MPM works.

I normally use pool debugging with valgrind as that catches more and
earlier errors. This causes almost all the tests to FAIL without
Subversion appearing the stack trace:

==28130== Thread 28:
==28130== Invalid read of size 8
==28130== at 0x669CE1B: process_lingering_close (event.c:1254)
==28130== by 0x669DA9F: listener_thread (event.c:1485)
==28130== by 0x58F38C9: start_thread (pthread_create.c:300)
==28130== by 0x600486C: clone (clone.S:112)
==28130== Address 0x63c4150 is 32 bytes inside a block of size 88 free'd
==28130== at 0x4C240FD: free (vg_replace_malloc.c:366)
==28130== by 0x508D7E8: pool_clear_debug (apr_pools.c:1588)
==28130== by 0x508DA61: apr_pool_clear_debug (apr_pools.c:1625)
==28130== by 0x669CE1A: process_lingering_close (event.c:1253)
==28130== by 0x669DA9F: listener_thread (event.c:1485)
==28130== by 0x58F38C9: start_thread (pthread_create.c:300)
==28130== by 0x600486C: clone (clone.S:112)
==28130==
==28130== Invalid read of size 8
==28130== at 0x508D0FD: pool_alloc (apr_pools.c:1482)
==28130== by 0x66A0ECD: ap_push_pool (fdqueue.c:235)
==28130== by 0x669CE2A: process_lingering_close (event.c:1254)
==28130== by 0x669DA9F: listener_thread (event.c:1485)
==28130== by 0x58F38C9: start_thread (pthread_create.c:300)
==28130== by 0x600486C: clone (clone.S:112)
==28130== Address 0x41414141414141a1 is not stack'd, malloc'd or (recently) free'd

Without pool debugging valgrind gives:

==10434== Thread 15:
==10434== Invalid read of size 4
==10434== at 0x802D5BB: svn_fs_bdb__open_internal (env.c:660)
==10434== by 0x802D679: svn_fs_bdb__open (env.c:672)
==10434== by 0x80390D7: open_databases (fs.c:536)
==10434== by 0x8039C26: base_open (fs.c:763)
==10434== by 0x77445A5: svn_fs_open (fs-loader.c:374)
==10434== by 0x752D8C6: get_repos (repos.c:1416)
==10434== by 0x752DA13: svn_repos_open2 (repos.c:1462)
==10434== by 0x72EBB1B: get_resource (repos.c:2159)
==10434== by 0x70B7B73: dav_get_resource (mod_dav.c:712)
==10434== by 0x70BC768: dav_method_options (mod_dav.c:1602)
==10434== by 0x70BDAE7: dav_handler (mod_dav.c:4706)
==10434== by 0x44BBBF: ap_run_handler (config.c:169)
==10434== Address 0x17a0b690 is 16 bytes inside a block of size 24 free'd
==10434== at 0x4C240FD: free (vg_replace_malloc.c:366)
==10434== by 0x802D0BF: svn_fs_bdb__close (env.c:539)
==10434== by 0x8038AAA: cleanup_fs (fs.c:183)
==10434== by 0x8038B36: cleanup_fs_apr (fs.c:289)
==10434== by 0x508DBCD: apr_pool_clear (apr_pools.c:2359)
==10434== by 0x669ADE3: process_lingering_close (event.c:1253)
==10434== by 0x669B987: listener_thread (event.c:1485)
==10434== by 0x58F18C9: start_thread (pthread_create.c:300)
==10434== by 0x600286C: clone (clone.S:112)
==10434==
==10434== Invalid write of size 4
==10434== at 0x802D5C1: svn_fs_bdb__open_internal (env.c:660)
==10434== by 0x802D679: svn_fs_bdb__open (env.c:672)
==10434== by 0x80390D7: open_databases (fs.c:536)
==10434== by 0x8039C26: base_open (fs.c:763)
==10434== by 0x77445A5: svn_fs_open (fs-loader.c:374)
==10434== by 0x752D8C6: get_repos (repos.c:1416)
==10434== by 0x752DA13: svn_repos_open2 (repos.c:1462)
==10434== by 0x72EBB1B: get_resource (repos.c:2159)
==10434== by 0x70B7B73: dav_get_resource (mod_dav.c:712)
==10434== by 0x70BC768: dav_method_options (mod_dav.c:1602)
==10434== by 0x70BDAE7: dav_handler (mod_dav.c:4706)
==10434== by 0x44BBBF: ap_run_handler (config.c:169)
==10434== Address 0x17a0b690 is 16 bytes inside a block of size 24 free'd
==10434== at 0x4C240FD: free (vg_replace_malloc.c:366)
==10434== by 0x802D0BF: svn_fs_bdb__close (env.c:539)
==10434== by 0x8038AAA: cleanup_fs (fs.c:183)
==10434== by 0x8038B36: cleanup_fs_apr (fs.c:289)
==10434== by 0x508DBCD: apr_pool_clear (apr_pools.c:2359)
==10434== by 0x669ADE3: process_lingering_close (event.c:1253)
==10434== by 0x669B987: listener_thread (event.c:1485)
==10434== by 0x58F18C9: start_thread (pthread_create.c:300)
==10434== by 0x600286C: clone (clone.S:112)

-- 
uberSVN: Apache Subversion Made Easy
http://www.uberSVN.com