From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NcUhW-0000Ho-Gz for qemu-devel@nongnu.org; Tue, 02 Feb 2010 21:10:42 -0500 Received: from [199.232.76.173] (port=36211 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NcUhW-0000HL-0i for qemu-devel@nongnu.org; Tue, 02 Feb 2010 21:10:42 -0500 Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim 4.60) (envelope-from ) id 1NcUhU-0000Uq-BV for qemu-devel@nongnu.org; Tue, 02 Feb 2010 21:10:41 -0500 Received: from mx20.gnu.org ([199.232.41.8]:41085) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1NcUhT-0000RO-2V for qemu-devel@nongnu.org; Tue, 02 Feb 2010 21:10:39 -0500 Received: from mail-px0-f189.google.com ([209.85.216.189]) by mx20.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NcUgZ-0000iv-97 for qemu-devel@nongnu.org; Tue, 02 Feb 2010 21:09:43 -0500 Received: by pxi27 with SMTP id 27so759356pxi.4 for ; Tue, 02 Feb 2010 18:09:32 -0800 (PST) MIME-Version: 1.0 In-Reply-To: <20100202105846.11524da1@doriath> References: <473191351001310028q75bff0fah52f7a1f3ce5fdbee@mail.gmail.com> <20100201101733.46459bde@doriath> <473191351002010436w65fe6357h8fbf1f2ef787df4d@mail.gmail.com> <20100201112208.04e70689@doriath> <473191351002010542h5b0c268ehbbc411be59150260@mail.gmail.com> <20100201140206.1f414f3f@doriath> <473191351002010826v7575cf55pa5146f6c7d8d6782@mail.gmail.com> <20100201165822.78a7c5bb@doriath> <473191351002011735j29950b07hfa4fd06821849a8b@mail.gmail.com> <20100202105846.11524da1@doriath> From: Roy Tam Date: Wed, 3 Feb 2010 10:09:07 +0800 Message-ID: <473191351002021809j187ef16bo172d1c925135d191@mail.gmail.com> Subject: Re: [Qemu-devel] system_reset command cause assert failed Content-Type: text/plain; charset=ISO-8859-1 List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Luiz Capitulino Cc: qemu-devel 2010/2/2 Luiz Capitulino : > On Tue, 2 Feb 2010 09:35:16 +0800 > Roy Tam wrote: > >> 2010/2/2 Luiz Capitulino : >> > On Tue, 2 Feb 2010 00:26:53 +0800 >> > Roy Tam wrote: >> > >> >> 2010/2/2 Luiz Capitulino : >> >> >> >> > Hm, I'm puzzled. Is this failing on malloc()? At least qemu_malloc() >> >> > is the last qemu's function I see in the logs. >> >> > >> >> > From now on I only see msvcrt functions... >> >> > >> >> > Maybe, you can type run on gdb, run system_reset on the >> >> > Monitor and then switch back to gdb and type bt? >> >> > >> >> source-less debugging seems better... >> > >> > As far as I can understand something bad happens while the parser >> > is processing the first "'" character of the qobject_from_jsonf() >> > call in monitor.c:4524. >> > >> > Strange. Can you try 'info pci', 'info block' and 'info version'? >> > Do they work? >> > >> > Maybe this is a refcount problem? >> > >> > Anthony, could you take a look too please? >> > >> >> rebuild with -gstabs -O1, you can see double free here: > > Ok, so we have a double free and > Clarify that after digging into sources further, it is not double free, but parse_json not be executed by json_lexer_feed_char as I put asm("int3") in parse_json but there's no SIGTRAP be raised. (for system_reset and system_powerdown) >> #0 qobject_to_qdict (obj=0x0) at qobject.h:108 >> #1 0x004127ae in pci_device_print (mon=0x494c460, device=0x49696c0) >> at /home/roy/qemu/hw/pci.c:1165 > > a segfault. for this, parse_json was executed by json_lexer_feed_char. a workaround patch is here, but why null qobj has pushed into qlist? diff --git a/hw/pci.c b/hw/pci.c index 023f7b6..84e7b35 100644 --- a/hw/pci.c +++ b/hw/pci.c @@ -1161,8 +1161,11 @@ static void pci_device_print(Monitor *mon, QDict *device) qdict_get_int(info, "limit")); } + QObject* qobj; QLIST_FOREACH_ENTRY(qdict_get_qlist(device, "regions"), entry) { - qdict = qobject_to_qdict(qlist_entry_obj(entry)); + qobj = qlist_entry_obj(entry); + if(!qobj) continue; + qdict = qobject_to_qdict(qobj); monitor_printf(mon, " BAR%d: ", (int) qdict_get_int(qdict, "bar")); addr = qdict_get_int(qdict, "address");