Segmentation fault in TopicPayloadPool::shrink(). [13983]

[ghost]

Is there an already existing issue for this?

• I have searched the existing issues

Expected behavior

It should be possible to concurrently create multiple domain participants inside multiple processes. FastDDS should not crash in this scenario.

Current behavior

FastDDS crashes when run the test program.

There is code:

bool TopicPayloadPool::shrink (
        uint32_t max_num_payloads)
{
    assert(payload_pool_allocated_size() - payload_pool_available_size() <= max_num_payloads);

    while (max_num_payloads < all_payloads_.size())
    {
        PayloadNode* payload = free_payloads_.back();
        free_payloads_.pop_back();

        // Find data in allPayloads, remove element, then delete it
        all_payloads_.at(payload->data_index()) = all_payloads_.back();
        all_payloads_.back()->data_index(payload->data_index());
        all_payloads_.pop_back();
        delete payload;
    }

    return true;
}

Where max_num_payloads=0 during the destruction. It seems the assertion should trigger if compile the debug build. Otherwise the code expects that the number free payloads is equal to the number of allocated payloads. It seems to be not always the case, because of the payload pool data-sharing feature. All of this happens between PDP readers/writers.

Steps to reproduce

1. Compile the test program (attached).
2. Copy certs directory where you want to run the program.
3. Run the first instance: ./concurrent_participant_test
4. Run the second instance: ./concurrent_participant_test
5. Wait for few seconds.
   concurrent_participant_test.zip

Fast DDS version/commit

Git tag: v2.5.0

Platform/Architecture

Ubuntu Focal 20.04 amd64

Transport layer

UDPv4

Additional context

Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f7b3d961248 in eprosima::fastrtps::rtps::TopicPayloadPool::shrink(unsigned int) () from /lib/libfastrtps.so.2.5
[Current thread is 1 (Thread 0x7f7b3cd7cb80 (LWP 971097))]
(gdb) bt
#0 0x00007f7b3d961248 in eprosima::fastrtps::rtps::TopicPayloadPool::shrink(unsigned int) () from /lib/libfastrtps.so.2.5
#1 0x00007f7b3d961320 in eprosima::fastrtps::rtps::TopicPayloadPool::release_history(eprosima::fastrtps::rtps::PoolConfig const&, bool) ()
from /lib/libfastrtps.so.2.5
#2 0x00007f7b3db698d6 in eprosima::fastrtps::rtps::PDP::~PDP() () from /lib/libfastrtps.so.2.5
#3 0x00007f7b3db6e56d in eprosima::fastrtps::rtps::PDPSimple::~PDPSimple() () from /lib/libfastrtps.so.2.5
#4 0x00007f7b3db60e88 in eprosima::fastrtps::rtps::BuiltinProtocols::~BuiltinProtocols() () from /lib/libfastrtps.so.2.5
#5 0x00007f7b3db60fdd in eprosima::fastrtps::rtps::BuiltinProtocols::~BuiltinProtocols() () from /lib/libfastrtps.so.2.5
#6 0x00007f7b3d9ab6ed in eprosima::fastrtps::rtps::RTPSParticipantImpl::disable() () from /lib/libfastrtps.so.2.5
#7 0x00007f7b3d9bb1ed in eprosima::fastrtps::rtps::RTPSDomain::removeRTPSParticipant(eprosima::fastrtps::rtps::RTPSParticipant*) ()
from /lib/libfastrtps.so.2.5
#8 0x00007f7b3da42f52 in eprosima::fastdds::dds::DomainParticipantImpl::~DomainParticipantImpl() () from /lib/libfastrtps.so.2.5
#9 0x00007f7b3da4345d in eprosima::fastdds::dds::DomainParticipantImpl::~DomainParticipantImpl() () from /lib/libfastrtps.so.2.5
#10 0x00007f7b3da349f9 in eprosima::fastdds::dds::DomainParticipantFactory::delete_participant(eprosima::fastdds::dds::DomainParticipant*) ()
from /lib/libfastrtps.so.2.5
#11 0x000055d7c49e9aec in Participant::~Participant (this=0x7f7b28068098, __in_chrg=) at /concurrent_participant_test.cpp:64
#12 0x000055d7c49f46e1 in std::_Destroy (__pointer=0x7f7b28068098) at /usr/include/c++/9/bits/stl_construct.h:98
#13 0x000055d7c49f3486 in std::_Destroy_aux::__destroy<Participant*> (__first=0x7f7b28068098, __last=0x7f7b280680a0) at /usr/include/c++/9/bits/stl_construct.h:108
#14 0x000055d7c49f1adc in std::_Destroy<Participant*> (__first=0x7f7b28068050, __last=0x7f7b280680a0) at /usr/include/c++/9/bits/stl_construct.h:137
#15 0x000055d7c49ef4bb in std::_Destroy<Participant*, Participant> (__first=0x7f7b28068050, __last=0x7f7b280680a0) at /usr/include/c++/9/bits/stl_construct.h:206
#16 0x000055d7c49ec1c5 in std::vector<Participant, std::allocator >::~vector (this=0x7fffe87733c0, __in_chrg=) at /usr/include/c++/9/bits/stl_vector.h:677
#17 0x000055d7c49e5941 in main () at /concurrent_participant_test.cpp:80

XML configuration file

No response

Relevant log output

No response

Network traffic capture

No response

[JLBuenoLopez]

This should be solved by #2853 which has been merged right now. @oleksandr-hryshchuk, could you please check if the issue is solved?

[ghost]

@JLBuenoLopez-eProsima, your fix works, thank you. Unfortunately the test program hangs on the newest master, but it looks like a different or regression issue.

I am closing the issue.