multithreading issue / SIGSEGV under InfiniSim

multithreading issue / SIGSEGV under InfiniSim - Printable Version

+- PINE64 (https://forum.pine64.org)
+-- Forum: PineTime (https://forum.pine64.org/forumdisplay.php?fid=134)
+--- Forum: Development Discussion on PineTime (https://forum.pine64.org/forumdisplay.php?fid=136)
+--- Thread: multithreading issue / SIGSEGV under InfiniSim (/showthread.php?tid=19478)

multithreading issue / SIGSEGV under InfiniSim - lmamane - 10-26-2024

I get various crashes/SIGSEGV/SIGFPE/uncaught exceptions/"mutex released when not held"/... when running InfiniTime under InfiniSim.

I opened the discussion for one of the reproducible ones at https://github.com/InfiniTimeOrg/InfiniSim/issues/160

Another reproducible one seems too subtle / incomprehensible for me, and it seems to me that different threads get mixed up. I was hoping someone here would have more clue than me.

The backtrace looks like:

Code:
Thread 5 "displayapp" received signal SIGSEGV, Segmentation fault.

[Switching to Thread 0x7fffe29fe6c0 (LWP 642677)]

0x00005555555cf26b in lv_refr_obj (obj=0x7ffff79f1c, mask_ori_p=0x7fffe29fdb2e) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_core/lv_refr.c:892

892        if(obj->hidden != 0) return;

(gdb) bt

#0  0x00005555555cf26b in lv_refr_obj (obj=0x7ffff79f1c, mask_ori_p=0x7fffe29fdb2e) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_core/lv_refr.c:892

#1  0x00005555555cf1d6 in lv_refr_obj_and_children (top_p=0x555556bb96c8, mask_p=0x7fffe29fdb2e) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_core/lv_refr.c:867

#2  0x00005555555cef04 in lv_refr_area_part (area_p=0x7fffdc0017c2) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_core/lv_refr.c:773

#3  0x00005555555ce3d6 in lv_refr_area (area_p=0x7fffdc0017c2) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_core/lv_refr.c:515

#4  0x00005555555cdf7a in lv_refr_areas () at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_core/lv_refr.c:405

#5  0x00005555555cd9ba in _lv_disp_refr_task (task=0x7fffdc001918) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_core/lv_refr.c:204

#6  0x00005555555e53e4 in lv_task_exec (task=0x7fffdc001918) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_misc/lv_task.c:386

#7  0x00005555555e4e6f in lv_task_handler () at /home/master/src/pinetime/InfiniSim/InfiniTime/src/libs/lvgl/src/lv_misc/lv_task.c:134

#8  0x00005555555af57a in Pinetime::Applications::DisplayApp::Refresh (this=0x5555556a4ae0 <displayApp>) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/displayapp/DisplayApp.cpp:251

#9  0x00005555555af208 in Pinetime::Applications::DisplayApp::Process (instance=0x5555556a4ae0 <displayApp>) at /home/master/src/pinetime/InfiniSim/InfiniTime/src/displayapp/DisplayApp.cpp:149

#10 0x0000555555609dec in sdl_function_wrapper (instance=0x5555556a5bf8 <displayApp+4376>) at /home/master/src/pinetime/InfiniSim/sim/task.cpp:61

Note that according to gdb, in frame 1 lv_refr_obj_and_children is called with top_p=0x555556bb96c8 in thread LWP 642677. I have modified this function to make debug outputs to a file, one file per thread, as follows:

Near the top of the file:

Code:
#include <stdio.h>

#define __USE_GNU

#include <unistd.h>

#undef __USE_GNU

then in the function:

Code:
    char buf[40];

    snprintf(buf, sizeof(buf), "VERBOSE_DEBUG_lv_core_%d.txt", gettid());

    buf[sizeof(buf)-1] = (char)0;

    FILE* vdf = fopen(buf, "a");

and then I fprintf(vdf, ...), in particular I log the value of top_p. Now, the "funny thing" is according to the logs, lv_refr_obj_and_children is called with top_p=0x555556bb96c8 only in thread 642669!

Code:
$ grep -l 96c8 VERBOSE_DEBUG_lv_core_6426*

VERBOSE_DEBUG_lv_core_642669.txt

According to gdb, that thread is:

Code:
Thread 1 (Thread 0x7ffff6e22cc0 (LWP 642669) "infinisim"):

#0  0x00007ffff790d11f in __GI___poll (fds=0x7fffffffdac8, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29

29    ../sysdeps/unix/sysv/linux/poll.c: No such file or directory.

(gdb) thread 1

[Switching to thread 1 (Thread 0x7ffff6e22cc0 (LWP 642669))]

#0  0x00007ffff790d11f in __GI___poll (fds=0x7fffffffdac8, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29

29    in ../sysdeps/unix/sysv/linux/poll.c

(gdb) bt

#0  0x00007ffff790d11f in __GI___poll (fds=0x7fffffffdac8, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29

#1  0x00007ffff71f0d12 in ?? () from /lib/x86_64-linux-gnu/libxcb.so.1

#2  0x00007ffff71f2d8f in ?? () from /lib/x86_64-linux-gnu/libxcb.so.1

#3  0x00007ffff71f2f00 in xcb_wait_for_reply64 () from /lib/x86_64-linux-gnu/libxcb.so.1

#4  0x00007ffff743810c in _XReply () from /lib/x86_64-linux-gnu/libX11.so.6

#5  0x00007ffff74336ff in XSync () from /lib/x86_64-linux-gnu/libX11.so.6

#6  0x00007ffff6498166 in ?? () from /lib/x86_64-linux-gnu/libGLX_mesa.so.0

#7  0x00007ffff648823b in ?? () from /lib/x86_64-linux-gnu/libGLX_mesa.so.0

#8  0x00007ffff7ecbbe6 in ?? () from /lib/x86_64-linux-gnu/libSDL2-2.0.so.0

#9  0x00007ffff7e2f276 in ?? () from /lib/x86_64-linux-gnu/libSDL2-2.0.so.0

#10 0x0000555555572074 in Framework::refresh (this=0x7fffffffdee0) at /home/master/src/pinetime/InfiniSim/main.cpp:609

#11 0x000055555556f5d5 in main (argc=1, argv=0x7fffffffe0c8) at /home/master/src/pinetime/InfiniSim/main.cpp:1145

Somehow the threads get mixed up???

According to the logs, that function is called in thread 642677 only with values top_p = 0x7fffdc001958, 0x7fffdc001c58 or 0x7fffdc001d58 and each time it is called, lv_obj_get_parent(top_p) == NULL (this is the value with which par is initialised), meaning the function exits without entering the while(par != NULL) loop, and never enters the lv_refr_obj call where the SIGSEGV happens, which is the one in the loop.

Still according to the logs, in thread 642669, all calls where top_p == 0x555556bb96c8 return, and the last call has another top_p value and has lv_obj_get_parent(top_p) == NULL.