[Libevent-users] SEGV in compare (event_tree_RB_INSERT), or sometimes event_tree_RB_INSERT_COLOR

[Ken Cox]

I have a libevent program that wakes up every 20ms and does some  
processing.  For this I use one event and repeatedly call event_add  
reusing the same event.  In the field I see occasional crashes in  
event_tree_RB_INSERT or event_tree_RB_INSERT_COLOR, but I can't reproduce  
them in the lab or under valgrind.

If you have seen this kind of crash, or can tell I'm doing something  
dreadfully wrong, or just can give me a general clue, I would greatly  
appreciate it.

I built on r309 from the SVN trunk.

Here's one such stack.

	Program terminated with signal 11, Segmentation fault.
	#0  compare (a=0x8648924, b=0x1) at event.c:136
	136     event.c: No such file or directory.
	        in event.c
	(gdb) bt
	#0  compare (a=0x8648924, b=0x1) at event.c:136
	#1  0x08063bcd in event_tree_RB_INSERT (head=0x86481cc, elm=0x8648924) at  
event.c:170
	#2  0x0806406e in event_queue_insert (base=0x86481a0, ev=0x8648924,  
queue=1) at event.c:847
	#3  0x0806429e in event_add (ev=0x8648924, tv=0x86489d4) at event.c:635
	#4  0x08055062 in process_cb (fd=-1, what=1, arg=0x86488b0) at foo.c:335
	#5  0x080649a4 in event_base_loop (base=0x86481a0, flags=0) at event.c:313
	#6  0x08064b4a in event_loop (flags=0) at event.c:364
	#7  0x08064b62 in event_dispatch () at event.c:327
	#8  0x08057d42 in main (argc=3, argv=0xbf985764) at foo.c:1061

The code looks kind of like this:

struct event timer_ev;
struct timeval next_wakeup_tv, snooze_tv;

void process_once(void *arg)
{
}

/* timer callback, invokes process_once and sets next timer */
void process_cb(int fd, short what, void *arg)
{
   struct timeval now, then;
   struct timeval delta_tv = {0, 20000};

   process_once(arg);

   /* calculate next wakeup time */
   timeradd(&next_wakeup_tv, &delta_tv, &then);
   next_wakeup_tv = then;

   /* calculate snooze time until then; don't allow it to go negative */
   gettimeofday(&now, NULL);
   if (timercmp(&then, &now, <))
     timerclear(&snooze_tv);
   else
     timersub(&then, &now, &snooze_tv); /* snooze = then - now */
   event_add(&timer_ev, &snooze_tv);

   fprintf(stderr, "%s: snooze={%lu, %6lu} next={%lu, %6lu}\n", __func__,
           snooze_tv.tv_sec, snooze_tv.tv_usec,
           next_wakeup_tv.tv_sec, next_wakeup_tv.tv_usec);
}

/* bootstrap timer */
void start(void *arg)
{
   struct timeval now, delta_tv = {0, 20000};
   event_set(&timer_ev, -1, 0, process_cb, arg);
   event_add(&timer_ev, &delta_tv);
   gettimeofday(&now, NULL);
   timeradd(&now, &delta_tv, &next_wakeup_tv);
}


==
Ken