Opened 11 months ago

Last modified 5 months ago

#32729 assigned defect

"hs_circuitmap_init: Assertion !the_hs_circuitmap failed" when repeating failed tests on Android

Reported by: eighthave Owned by: ahf
Priority: Medium Milestone: Tor: 0.4.4.x-final
Component: Core Tor/Tor Version:
Severity: Normal Keywords: Android, backport?, crash?, 043-should, 044-must, postfreeze-ok
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:


When repeated running the Android TorService test suite from, I occasionally received this crash:

      main  src/feature/hs/hs_circuitmap.c:598: hs_circuitmap_init: Assertion !the_hs_circuitmap failed; aborting.
TorService  Bug: Tor (git-7e55ab23311d00b6): Assertion !the_hs_circuitmap failed in hs_circuitmap_init at src/feature/hs/hs_circuitmap.c:598: . (Stack trace not available) (on Tor 7e55ab23311d00b6)
      libc  Fatal signal 6 (SIGABRT), code -6 in tid 862 (tor), pid 836 (oid.binary.test)
TorService  ⇠ run [1425ms]
     DEBUG  #00 pc 00000af0  [vdso:f319a000] (__kernel_vsyscall+16)
            #01 pc 0001edf8  /system/lib/ (syscall+40)
            #02 pc 0001f073  /system/lib/ (abort+115)
            #03 pc 0025ab6e  /data/app/ (tor_raw_abort_+31)
            #04 pc 0025673e  /data/app/ (tor_abort_+31)
            #05 pc 0014df1d  /data/app/ (hs_circuitmap_init+146)
            #06 pc 00154110  /data/app/ (hs_init+39)
            #07 pc 000b17ac  /data/app/ (tor_init+132)
            #08 pc 000b2033  /data/app/ (tor_run_main+243)
            #09 pc 000b0933  /data/app/ (Java_org_torproject_jni_TorService_runMain+59)
            #10 pc 000085c8  /data/app/ (offset 0x8000)
            #11 pc 000091ff  [anon:libc_malloc:e6980000]
            #12 pc 01114457  /dev/ashmem/dalvik-main space (region space) (deleted)
            #13 pc 80e30d65  <unknown>

nickm said:

So there are at least two possibilities:
1) tor is busted and is calling hs_circuitmap_init() more than it should
2) tor is busted and is calling hs_circuitmap_free_all() less than it should there are probably more, like:
3) there is a problem in the android harness, and it is trying to restart tor before it has shut down

Child Tickets

Attachments (1)

crashlog.txt (26.4 KB) - added by eighthave 11 months ago.

Download all attachments as: .zip

Change History (8)

comment:1 Changed 11 months ago by nickm

Keywords: backport? crash? added
Milestone: Tor: 0.4.3.x-final

Changed 11 months ago by eighthave

Attachment: crashlog.txt added

comment:2 Changed 11 months ago by eighthave

I'm still seeing this crash occasionally when running the TorService test suite with multiple Tor start/stops (e.g. first running testOverridingDefaultsTorrc then testBindService). I added logging of hs_circuitmap_init and hs_circuitmap_free_all, as well as the "clear between test runs" to the Android test runner:

        // The following argument makes the Android Test Orchestrator run its
        // "pm clear" command after each test invocation. This command ensures
        // that the app's state is completely cleared between tests. This is required
        // since there is no way to unset URL.setURLStreamHandlerFactory().
        testInstrumentationRunnerArguments clearPackageData: 'true'

Attached is the crash log from adb logcat, it does not seem to show double calls to hs_circuitmap_init or hs_circuitmap_free_all. I think we might have to consider that Android will kill Tor without warning and reuse the process.

comment:3 Changed 10 months ago by nickm

Keywords: 043-should added

comment:4 Changed 9 months ago by ahf

Owner: set to ahf
Status: newassigned

comment:5 Changed 5 months ago by nickm

Milestone: Tor: 0.4.3.x-finalTor: 0.4.4.x-final

0.4.3 was released: Move non merge-ready 0.4.3 tickets to 044.

comment:6 Changed 5 months ago by nickm

Keywords: 044-must added

Add 044-must to all crash tickets in 0.4.4

comment:7 Changed 5 months ago by nickm

Keywords: postfreeze-ok added

Mark tickets which are important or safe enough to look at post-freeze for 0.4.4.

Note: See TracTickets for help on using tickets.