crash on je_arena_dalloc_bin_locked

[Jason Evans]

On Jul 8, 2014, at 1:28 PM, Eduardo Silva <edsiper at gmail.com> wrote:
> i am using jemalloc as part of our web services framework stack and
> running on high loads (after every 6 hours of work) i find common
> segfaults like the one described here.
> 
> It was triggered on je_arena_dalloc_bin_locked(..). Do you have some
> idea that what can be causing the problem ?
> 
> (gdb) bt
> #0  0x00007f50eab23425 in __GI_raise (sig=<optimized out>) at
> ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #1  0x00007f50eab26b8b in __GI_abort () at abort.c:91
> #2  0x000000000040d232 in mk_signal_handler (signo=11,
> si=0x7f50de7f96f0, context=0x7f50de7f95c0) at mk_signals.c:108
> #3  <signal handler called>
> #4  je_arena_dalloc_bin_locked (arena=0x7f50ea409240,
> chunk=0x7f50e4c00000, ptr=<optimized out>, mapelm=<optimized out>) at
> src/arena.c:1897

This looks like a crash due to a double-freed region being flushed from the thread cache.  You may be able to find the actual source of the problem if you use a debug build of jemalloc and disable thread caching (MALLOC_CONF=tcache:false).

Jason