svn commit: r261071 - in head: contrib/jemalloc contrib/jemalloc/doc contrib/jemalloc/include/jemalloc contrib/jemalloc/include/jemalloc/internal contrib/jemalloc/src include lib/libc/gen lib/libc/...

[Jason Evans]

On Feb 6, 2014, at 8:01 PM, Lawrence Stewart <lstewart at freebsd.org> wrote:
> On 01/23/14 13:47, Jason Evans wrote:
>> Author: jasone
>> Date: Thu Jan 23 02:47:36 2014
>> New Revision: 261071
>> URL: http://svnweb.freebsd.org/changeset/base/261071
>> 
>> Log:
>>  Update jemalloc to version 3.5.0.
> 
> I suspect that this commit is related to the assertion failures I've
> been seeing on recent head when I updated from r260427 to r261453.
> Here's two I noticed today:
> 
> <jemalloc>:
> /usr/local/poudriere/jails/head-amd64/usr/src/lib/libc/../../contrib/jemalloc/include/jemalloc/internal/arena.h:7
> 76: Failed assertion: "binind == actual_binind"
> *** Signal 6
> 
> and
> 
> <jemalloc>:
> /usr/src/lib/libc/../../contrib/jemalloc/include/jemalloc/internal/arena.h:776:
> Failed assertion: "binind == actual_binind"
> Abort trap
> 
> I seem to be able to reproduce the first one readily when poudriere
> tries to build chromium so I can provide more info and help test ideas.
> 
> Cheers,
> Lawrence

Are the failures you saw happening only for the chromium build, or have you seen that same failure for other things as well?  If it’s just the chromium build, is there any chance that this same failure would have occurred prior to the jemalloc 3.5.0 update?

If this is an application bug, it’s probably due do a buffer overrun corrupting an adjacent page that contains page run metadata.  If it’s a jemalloc bug, I’m going to need to reproduce it and dig in; it’s unlikely to be easy to diagnose.

Thanks,
Jason