On Tue, May 14, 2013 at 4:29 PM, Stefan Priebe - Profihost AG <s.pri...@profihost.ag> wrote: > Am 10.05.2013 13:09, schrieb Stefan Hajnoczi: >> On Fri, May 10, 2013 at 11:07 AM, Stefan Priebe - Profihost AG >> <s.pri...@profihost.ag> wrote: >>> Am 10.05.2013 09:42, schrieb Stefan Hajnoczi: >>>> On Fri, May 10, 2013 at 08:12:39AM +0200, Stefan Priebe - Profihost AG >>>> wrote: >>>> 3. Either use gdb or an LD_PRELOAD library that catches exit(3) and >>>> _exit(2) and dumps core using abort(3). Make sure core dumps are >>>> enabled. > > This time i had a segfault Qemu 1.4.1 plus > http://git.qemu.org/?p=qemu.git;a=commitdiff;h=dc7588c1eb3008bda53dde1d6b890cd299758155. > > aio_bh_poll async.c:80 > > Code... > > for (bh = ctx->first_bh; bh; bh = next) { > next = bh->next; > if (!bh->deleted && bh->scheduled) { > bh->scheduled = 0; > if (!bh->idle) > ret = 1; > bh->idle = 0; > bh->cb(bh->opaque); > } > } > > ctx->walking_bh--; > > /* remove deleted bhs */ > if (!ctx->walking_bh) { > bhp = &ctx->first_bh; > while (*bhp) { > bh = *bhp; > ===== THIS IS THE SEGFAULT LINE ===== if (bh->deleted) { > *bhp = bh->next; > g_free(bh); > } else { > bhp = &bh->next; > } > } > } > > return ret;
Interesting crash. Do you have the output of "thread apply all bt"? I would try looking at the AioContext using "p *ctx", and print out the ctx->first_bh linked list. Stefan
