VirtualBox 1.5 crashes (very often) on Linux host with Win2000 guest (backtraces included)

[chriz]

Hi!

After crashes with VirtualBox 1.4 (see ticket #571) on my Fedora 7 box with Windows 2000 guest I today upgraded to VirtualBox 1.5.

After several problems with the installation of the guest additions I had it running... ... for a few minutes :-(

VB1.5 crashes more often than 1.4 for me. The guest silently aborts. No log entries.

So I did three backtraces and attached the last logfile.

==> core5904-backtrace <==
Program terminated with signal 6, Aborted.
#0  0x00110402 in __kernel_vsyscall ()
(gdb) bt
#0  0x00110402 in __kernel_vsyscall ()
#1  0x04be0fa0 in raise () from /lib/libc.so.6
#2  0x04be28b1 in abort () from /lib/libc.so.6
#3  0x04c17d6b in __libc_message () from /lib/libc.so.6
#4  0x04c20bdc in _int_malloc () from /lib/libc.so.6
#5  0x04c21ebe in malloc () from /lib/libc.so.6
#6  0x048bc557 in operator new () from /usr/lib/libstdc++.so.6
#7  0x00744033 in QRegion::QRegion () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#8  0x00826306 in QWidget::clipRegion () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#9  0x0074baee in QWidget::update () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#10 0x08199a86 in QTextEdit::setWrapPolicy ()
#11 0x09aad090 in ?? ()
#12 0x0000017f in ?? ()
#13 0x00000052 in ?? ()
#14 0x00000020 in ?? ()
#15 0x00000004 in ?? ()
#16 0xaf1ee048 in ?? ()
#17 0xb65adf88 in ?? ()
#18 0x099e3ec0 in ?? ()
#19 0x0000017f in ?? ()
#20 0x00000500 in ?? ()
#21 0xb65adfd8 in ?? ()
#22 0x047843e5 in ?? () from /usr/lib/virtualbox//components/VBoxC.so
Backtrace stopped: previous frame identical to this frame (corrupt stack?)



==> core6045-backtrace <==
Program terminated with signal 6, Aborted.
#0  0x00110402 in __kernel_vsyscall ()
(gdb) bt
#0  0x00110402 in __kernel_vsyscall ()
#1  0x0782ffa0 in raise () from /lib/libc.so.6
#2  0x078318b1 in abort () from /lib/libc.so.6
#3  0x07866d6b in __libc_message () from /lib/libc.so.6
#4  0x0786fbdc in _int_malloc () from /lib/libc.so.6
#5  0x07870ebe in malloc () from /lib/libc.so.6
#6  0x00ae6105 in QGArray::QGArray$base () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#7  0x0074417b in QRegion::QRegion () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#8  0x00826306 in QWidget::clipRegion () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#9  0x0074baee in QWidget::update () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#10 0x08199a86 in QTextEdit::setWrapPolicy ()
#11 0x090623e8 in ?? ()
#12 0x00000454 in ?? ()
#13 0x00000334 in ?? ()
#14 0x0000001a in ?? ()
#15 0x0000000d in ?? ()
#16 0xaee71050 in ?? ()
#17 0xb6603f88 in ?? ()
#18 0x08fa58e0 in ?? ()
#19 0x00000454 in ?? ()
#20 0x00000500 in ?? ()
#21 0xb6603fd8 in ?? ()
#22 0x03b4b3e5 in ?? () from /usr/lib/virtualbox//components/VBoxC.so
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)


==> core6099-backtrace <==
Program terminated with signal 6, Aborted.
#0  0x00110402 in __kernel_vsyscall ()
(gdb) bt
#0  0x00110402 in __kernel_vsyscall ()
#1  0x07b4ffa0 in raise () from /lib/libc.so.6
#2  0x07b518b1 in abort () from /lib/libc.so.6
#3  0x07b86d6b in __libc_message () from /lib/libc.so.6
#4  0x07b8fbdc in _int_malloc () from /lib/libc.so.6
#5  0x07b90ebe in malloc () from /lib/libc.so.6
#6  0x07204557 in operator new () from /usr/lib/libstdc++.so.6
#7  0x007420bf in QRegion::QRegion () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#8  0x00743b8d in QRegion::intersect () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#9  0x0074bb0d in QWidget::update () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#10 0x08199a86 in QTextEdit::setWrapPolicy ()
#11 0x09ca33e0 in ?? ()
#12 0x00000417 in ?? ()
#13 0x000001dd in ?? ()
#14 0x0000000f in ?? ()
#15 0x0000000f in ?? ()
#16 0xaf1f205c in ?? ()
#17 0xb64fef88 in ?? ()
#18 0x09bd8ed8 in ?? ()
#19 0x00000417 in ?? ()
#20 0x00000500 in ?? ()
#21 0xb64fefd8 in ?? ()
#22 0x026c63e5 in ?? () from /usr/lib/virtualbox//components/VBoxC.so
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

What's wrong here?

[chriz]

You can ignore the second attachment. It's a duplicate of the first. (There seems to be no way to delete an attachment here...)

[ugemkow]

I can second this bug report. I am using VirtualBox 1.5 OSE (compiled from source), F7 as host, Windows 2000 as guest and crashes happen regulary. I cant guarantee for the sanity of my build environment - its a development machine

The following two crash report from the malloc-handler happened:

*** glibc detected *** /u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VirtualBox: malloc(): memory corruption (fast): 0xb689ebff ***
======= Backtrace: =========
/lib/libc.so.6[0x7aefbdc]
/lib/libc.so.6(__libc_malloc+0x7e)[0x7af0ebe]
/usr/lib/libstdc++.so.6(_Znwj+0x27)[0x25ec557]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QRegionC1Eb+0x2f)[0x3190cf]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZNK7QRegion9intersectERKS_+0x2d)[0x31ab9d]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QWidget6updateEiiii+0xdd)[0x322b1d]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VirtualBox[0x8198bf6]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin//components/VBoxC.so[0x455b485]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin//components/VBoxC.so[0x455b98d]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin//components/VBoxC.so[0x455c6a9]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxDD.so[0x26e8975]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so[0x72a2ceb]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so(TMR3TimerQueuesDo+0x194)[0x72a2ec4]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so[0x72be408]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so(EMR3ExecuteVM+0xb8b)[0x72c0c2b]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so[0x729baf5]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxRT.so[0x9b57f1]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxRT.so[0x9be83a]
/lib/libpthread.so.0[0x239a44b]
/lib/libc.so.6(clone+0x5e)[0x7b5780e]

*** glibc detected *** /u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VirtualBox: malloc(): memory corruption (fast): 0x0a221f97 ***
======= Backtrace: =========
/lib/libc.so.6[0x2780bdc]
/lib/libc.so.6(__libc_malloc+0x7e)[0x2781ebe]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QGArrayC2Ei+0x85)[0x6bdc05]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QRegionC1ERK5QRectNS_10RegionTypeE+0x1ab)[0x31b18b]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QWidget6updateEiiii+0xa9)[0x322ae9]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VirtualBox[0x8198bf6]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin//components/VBoxC.so[0x33d5485]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin//components/VBoxC.so[0x33d598d]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxDD.so[0x30c8e2e]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so(IOMIOPortWrite+0x4e)[0x22dca1e]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so(IOMInterpretOUT+0x9c)[0x22dcafc]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so[0x23083ca]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so[0x230886d]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so(EMR3ExecuteVM+0x95a)[0x23099fa]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxVMM.so[0x22e4af5]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxRT.so[0x9b57f1]
/u/user/Build/VirtualBox-1.5.0_OSE/out/linux.x86/release/bin/VBoxRT.so[0x9be83a]
/lib/libpthread.so.0[0x249044b]
/lib/libc.so.6(clone+0x5e)[0x27e880e]

I then compiled the debug version (configure -d) but unfortunately (:-) the crashes disappeared and no assert happened.

[ugemkow]

Sorry for adding another followup. I now got a crash from the debug version with the following backtrace:

#0  0x0012d402 in __kernel_vsyscall ()
#1  0x0240bfa0 in raise () from /lib/libc.so.6
#2  0x0240d8b1 in abort () from /lib/libc.so.6
#3  0x02442d6b in __libc_message () from /lib/libc.so.6
#4  0x0244bbdc in _int_malloc () from /lib/libc.so.6
#5  0x0244cebe in malloc () from /lib/libc.so.6
#6  0x006bdc05 in QGArray::QGArray$base () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#7  0x0031b18b in QRegion::QRegion () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#8  0x00322ae9 in QWidget::update () from /usr/lib/qt-3.3/lib/libqt-mt.so.3
#9  0x081643f5 in VBoxSDLFrameBuffer::NotifyUpdate (this=0x93a6f38, aX=694, aY=172, aW=24, aH=22, aFinished=0xb64fea70)
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/Frontends/VirtualBox/src/VBoxFrameBuffer.cpp:486
#10 0x0752c274 in Display::handleDisplayUpdate (this=0x93a1c80, x=694, y=172, w=24, h=22)
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/Main/DisplayImpl.cpp:491
#11 0x0752c5ea in vbvaRgnDirtyRect (prgn=0xb64feb38, uScreenId=0, phdr=0xb556b99c)
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/Main/DisplayImpl.cpp:605
#12 0x0752ca24 in Display::VideoAccelFlush (this=0x93a1c80) at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/Main/DisplayImpl.cpp:1202
#13 0x0752d818 in Display::displayRefreshCallback (pInterface=0x94ba984)
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/Main/DisplayImpl.cpp:2068
#14 0x026df312 in vgaTimerRefresh (pDevIns=0xb5554000, pTimer=0xb62d87a0)
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/Devices/Graphics/DevVGA.cpp:4074
#15 0x06804a43 in tmR3TimerQueueRun (pVM=0x4286000, pQueue=0xb62c03f0) at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/VMM/TM.cpp:1349
#16 0x06805031 in TMR3TimerQueuesDo (pVM=0x4286000) at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/VMM/TM.cpp:1275
#17 0x067f5102 in vmR3HaltMethod1DoHalt (pVM=0x4286000, fMask=1823, u64Now=4294505940620669)
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/VMM/VMEmt.cpp:448
#18 0x067f6636 in VMR3WaitHalted (pVM=0x4286000, fIgnoreInterrupts=false) at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/VMM/VMEmt.cpp:680
#19 0x06861d07 in EMR3ExecuteVM (pVM=0x4286000) at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/VMM/EM.cpp:3376
#20 0x067f6d03 in vmR3EmulationThread (ThreadSelf=0xb6505b98, pvArgs=0xb6766fb0)
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/VMM/VMEmt.cpp:139
#21 0x009de41b in rtThreadMain (pThread=0xb6505b98, NativeThread=3058695056, pszThreadName=0xb6505bec "EMT")
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/Runtime/thread.cpp:591
#22 0x009eff83 in rtThreadNativeMain (pvArgs=0xb6505b98)
    at /u/user/Build/VirtualBox-1.5.0_OSE/src/VBox/Runtime/r3/posix/thread-posix.cpp:135
#23 0x05e5a44b in start_thread () from /lib/libpthread.so.0
#24 0x024b380e in clone () from /lib/libc.so.6

Because it seems to be a memory corruption I fear this will not help much. If you give a hint what I can do for more diagnostics I will try do so.

Disclaimer: I have no idea whether there are (after the many crashes) inconsistencies in the virtual image or whether my build environment is sane.

[pilovis]

Have you tried to remove the USB support? I had continuous crashes because of that. The USB support on Win 2000 host seems not to work very well

[chriz]

@ugemkow: I'll try to compile and use the OSE version (with debugging) here too in the next days. (I'm no expert in this.)

@pilovis: The OSE version ugemkow uses doesn't have USB built in and crashes like my binary version. All my crashes happened when not using (the enabled) USB but doing simple things like opening an editor and typing text or so.

[chriz]

Now I tried it with the OSE version (1.5.51 from SVN)

Unfortunately it still crashes/aborts:

Informational: VirtualBox object created (rc=00000000).
*** glibc detected *** /home/chris/VB/out/linux.x86/release/bin/VirtualBox: malloc(): memory corruption (fast): 0xa6a4952f ***
======= Backtrace: =========
/lib/libc.so.6[0x490ebdc]
/lib/libc.so.6(__libc_malloc+0x7e)[0x490febe]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QGArrayC2Ei+0x85)[0x7c27105]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QRegionC1ERK5QRectNS_10RegionTypeE+0x1ab)[0x788517b]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZNK7QWidget10clipRegionEv+0x46)[0x7967306]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QWidget6updateEiiii+0xbe)[0x788caee]
/home/chris/VB/out/linux.x86/release/bin/VirtualBox[0x819cd06]
/home/chris/VB/out/linux.x86/release/bin//components/VBoxC.so[0x2ec4775]
/home/chris/VB/out/linux.x86/release/bin//components/VBoxC.so[0x2ec4c7d]
/home/chris/VB/out/linux.x86/release/bin//components/VBoxC.so[0x2ec5999]
/home/chris/VB/out/linux.x86/release/bin/VBoxDD.so[0x6bc9295]
/home/chris/VB/out/linux.x86/release/bin/VBoxVMM.so[0x1d245b]
/home/chris/VB/out/linux.x86/release/bin/VBoxVMM.so(TMR3TimerQueuesDo+0x194)[0x1d2634]
/home/chris/VB/out/linux.x86/release/bin/VBoxVMM.so[0x1cb87a]
/home/chris/VB/out/linux.x86/release/bin/VBoxVMM.so(VMR3WaitHalted+0xde)[0x1cb5de]
/home/chris/VB/out/linux.x86/release/bin/VBoxVMM.so(EMR3ExecuteVM+0x5df)[0x1f073f]
/home/chris/VB/out/linux.x86/release/bin/VBoxVMM.so[0x1cb235]
/home/chris/VB/out/linux.x86/release/bin/VBoxRT.so[0x147af1]
/home/chris/VB/out/linux.x86/release/bin/VBoxRT.so[0x150bca]
/lib/libpthread.so.0[0x37744b]
/lib/libc.so.6(clone+0x5e)[0x497680e]

[chriz]

Logfile from 1.5.51-OSE

[chriz]

This time I compiled 1.5.51-OSE with debug option.

Now it already/always crashes (aborts) while the guest Windows 2000 is starting. Tested several times.

$   LD_LIBRARY_PATH=. ./VirtualBox
Type Manifest File: /home/chris/.VirtualBox/xpti.dat
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nNCL: registering deferred (0)
Informational: VirtualBox object created (rc=00000000).
Type Manifest File: /home/chris/.VirtualBox/xpti.dat
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nNCL: registering deferred (0)
*** glibc detected *** /home/chris/VB/out/linux.x86/debug/bin/VirtualBox: malloc(): memory corruption (fast): 0xb67939ff ***
======= Backtrace: =========
/lib/libc.so.6[0x2226bdc]
/lib/libc.so.6(__libc_malloc+0x7e)[0x2227ebe]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QGArrayC2Ei+0x85)[0x7c27105]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QRegionC1ERK5QRectNS_10RegionTypeE+0x1ab)[0x788517b]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QWidget6updateEiiii+0xa9)[0x788cad9]
/home/chris/VB/out/linux.x86/debug/bin/VirtualBox[0x8165b49]
/home/chris/VB/out/linux.x86/debug/bin//components/VBoxC.so[0x3f51940]
/home/chris/VB/out/linux.x86/debug/bin//components/VBoxC.so[0x3f51cb6]
/home/chris/VB/out/linux.x86/debug/bin//components/VBoxC.so[0x3f520f0]
/home/chris/VB/out/linux.x86/debug/bin//components/VBoxC.so[0x3f52ee4]
/home/chris/VB/out/linux.x86/debug/bin/VBoxDD.so[0x4a47b96]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so[0x2b143f]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so(TMR3TimerQueuesDo+0x47d)[0x2b1a2d]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so[0x2a1abe]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so(VMR3WaitHalted+0x25a)[0x2a2ff2]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so(EMR3ExecuteVM+0x13cb)[0x30f979]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so[0x2a36bf]
/home/chris/VB/out/linux.x86/debug/bin/VBoxRT.so[0x172c6f]
/home/chris/VB/out/linux.x86/debug/bin/VBoxRT.so[0x18497f]
/lib/libpthread.so.0[0x6b9844b]
/lib/libc.so.6(clone+0x5e)[0x228e80e]
======= Memory map: ========
00110000-00111000 r-xp 00110000 00:00 0          [vdso]
00111000-00118000 r-xp 00000000 08:0a 7113760    /home/chris/VB/out/linux.x86/debug/bin/VBoxKeyboard.so
00118000-00119000 rwxp 00006000 08:0a 7113760    /home/chris/VB/out/linux.x86/debug/bin/VBoxKeyboard.so
00119000-001c2000 r-xp 00000000 08:0a 7113747    /home/chris/VB/out/linux.x86/debug/bin/VBoxRT.so
001c2000-001c4000 rwxp 000a8000 08:0a 7113747    /home/chris/VB/out/linux.x86/debug/bin/VBoxRT.so
001c4000-001c5000 rwxp 001c4000 00:00 0
001c5000-00423000 r-xp 00000000 08:0a 7113750    /home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so
00423000-00425000 rwxp 0025e000 08:0a 7113750    /home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so
00425000-00434000 r-xp 00000000 08:0a 7349562    /usr/lib/libXext.so.6.4.0
00434000-00435000 rwxp 0000e000 08:0a 7349562    /usr/lib/libXext.so.6.4.0
00435000-00533000 r-xp 00000000 08:0a 7344976    /usr/lib/libX11.so.6.2.0
00533000-00537000 rwxp 000fe000 08:0a 7344976    /usr/lib/libX11.so.6.2.0
00537000-00540000 r-xp 00000000 08:0a 7351581    /usr/lib/libXcursor.so.1.0.2
00540000-00541000 rwxp 00008000 08:0a 7351581    /usr/lib/libXcursor.so.1.0.2
00541000-00542000 rwxp 00541000 00:00 0
00542000-0055d000 r-xp 00000000 08:0a 1572889    /lib/ld-2.6.so
0055d000-0055e000 r-xp 0001a000 08:0a 1572889    /lib/ld-2.6.so
0055e000-0055f000 rwxp 0001b000 08:0a 1572889    /lib/ld-2.6.so
0055f000-005fc000 r-xp 00000000 08:0a 7113761    /home/chris/VB/out/linux.x86/debug/bin/VBoxREM.so
005fc000-00601000 rwxp 0009c000 08:0a 7113761    /home/chris/VB/out/linux.x86/debug/bin/VBoxREM.so
00601000-00e23000 rwxp 00601000 00:00 0
00e23000-01e24000 rwxp 00e23000 00:00 0
01e24000-01e28000 rwxp 01e24000 00:00 0
01e28000-01f08000 r-xp 00000000 08:0a 7362352    /usr/lib/libstdc++.so.6.0.8
01f08000-01f0b000 r-xp 000e0000 08:0a 7362352    /usr/lib/libstdc++.so.6.0.8
01f0b000-01f0d000 rwxp 000e3000 08:0a 7362352    /usr/lib/libstdc++.so.6.0.8
01f0d000-01f13000 rwxp 01f0d000 00:00 0
01f13000-01f1b000 r-xp 00000000 08:0a 7350326    /usr/lib/libXi.so.6.0.0
01f1b000-01f1c000 rwxp 00007000 08:0a 7350326    /usr/lib/libXi.so.6.0.0
01f1c000-01f24000 r-xp 00000000 08:0a 7347896    /usr/lib/libXrender.so.1.3.0
01f24000-01f25000 rwxp 00007000 08:0a 7347896    /usr/lib/libXrender.so.1.3.0
01f25000-01f37000 r-xp 00000000 08:0a 7368339    /usr/lib/libXft.so.2.1.2
01f37000-01f38000 rwxp 00012000 08:0a 7368339    /usr/lib/libXft.so.2.1.2
01f38000-01f40000 r-xp 00000000 08:0a 7358323    /usr/lib/libSM.so.6.0.0
01f40000-01f41000 rwxp 00007000 08:0a 7358323    /usr/lib/libSM.so.6.0.0
01f41000-01f60000 r-xp 00000000 08:0a 2009356    /usr/lib/kde3/plugins/styles/plastik.so
01f60000-01f61000 rwxp 0001f000 08:0a 2009356    /usr/lib/kde3/plugins/styles/plastik.so
01f61000-01f62000 rwxp 01f61000 00:00 0
01f62000-01f63000 rwxs 00000000 00:09 36526      /dev/zero (deleted)
01f63000-01f64000 rwxs 00000000 00:09 36527      /dev/zero (deleted)
01f64000-01f66000 rwxp 01f64000 00:00 0
01f66000-01f69000 rwxs 00000000 00:09 36531      /dev/zero (deleted)
01f69000-01f8d000 r-xp 00000000 08:0a 7113752    /home/chris/VB/out/linux.x86/debug/bin/VBoxDD2.so
01f8d000-01f8e000 rwxp 00023000 08:0a 7113752    /home/chris/VB/out/linux.x86/debug/bin/VBoxDD2.so
01f8e000-01f92000 r-xp 00000000 08:0a 1572902    /lib/libnss_dns-2.6.so
01f92000-01f93000 r-xp 00003000 08:0a 1572902    /lib/libnss_dns-2.6.so
01f93000-01f94000 rwxp 00004000 08:0a 1572902    /lib/libnss_dns-2.6.so
01f94000-01fa4000 r-xp 00000000 08:0a 1572898    /lib/libresolv-2.6.so
01fa4000-01fa5000 r-xp 0000f000 08:0a 1572898    /lib/libresolv-2.6.so
01fa5000-01fa6000 rwxp 00010000 08:0a 1572898    /lib/libresolv-2.6.so
01fa6000-01fa8000 rwxp 01fa6000 00:00 0
021be000-0230c000 r-xp 00000000 08:0a 1572893    /lib/libc-2.6.so
0230c000-0230e000 r-xp 0014e000 08:0a 1572893    /lib/libc-2.6.so
0230e000-0230f000 rwxp 00150000 08:0a 1572893    /lib/libc-2.6.so
0230f000-02312000 rwxp 0230f000 00:00 0
02749000-028bc000 r-xp 00000000 08:0a 7113748    /home/chris/VB/out/linux.x86/debug/bin/VBoWARNING: failed to send RELEASE event, file /home/chris/VB/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp, line 1691
WARNING: failed to send RELEASE event, file /home/chris/VB/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp, line 1691

[chriz]

Logfile from 1.5.51-OSE compiled with debug option

[chriz]

Now I upgraded to 1.5.51_OSE r4786 (from yesterdays r4735) and I'm able to start the Windows 2000 guest even with VirtualBox compiled in debug mode.

But the aborts are still there. Easily reproducable e.g. with holding down a key in my favorite text editor for some seconds.

The log file is attached.

The results in the shell:

[chris@lx2 bin]$ LD_LIBRARY_PATH=. ./VirtualBox
Type Manifest File: /home/chris/.VirtualBox/xpti.dat
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nNCL: registering deferred (0)
Informational: VirtualBox object created (rc=00000000).
Type Manifest File: /home/chris/.VirtualBox/xpti.dat
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nNCL: registering deferred (0)
*** glibc detected *** /home/chris/VB/out/linux.x86/debug/bin/VirtualBox: malloc(): memory corruption (fast): 0x0879f2e7 ***
======= Backtrace: =========
/lib/libc.so.6[0x1fa4bdc]
/lib/libc.so.6(__libc_malloc+0x7e)[0x1fa5ebe]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QGArrayC2Ei+0x85)[0x7c27105]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QRegionC1ERK5QRectNS_10RegionTypeE+0x1ab)[0x788517b]
/usr/lib/qt-3.3/lib/libqt-mt.so.3(_ZN7QWidget6updateEiiii+0xa9)[0x788cad9]
/home/chris/VB/out/linux.x86/debug/bin/VirtualBox[0x8165af9]
/home/chris/VB/out/linux.x86/debug/bin//components/VBoxC.so[0x6ce2940]
/home/chris/VB/out/linux.x86/debug/bin//components/VBoxC.so[0x6ce2cb6]
/home/chris/VB/out/linux.x86/debug/bin//components/VBoxC.so[0x6ce30f0]
/home/chris/VB/out/linux.x86/debug/bin//components/VBoxC.so[0x6ce3ee4]
/home/chris/VB/out/linux.x86/debug/bin/VBoxDD.so[0x70a0b96]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so[0x2b235b]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so(TMR3TimerQueuesDo+0x47d)[0x2b2949]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so[0x2a29de]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so(VMR3WaitHalted+0x25a)[0x2a3f12]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so(EMR3ExecuteVM+0x13cb)[0x310fc5]
/home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so[0x2a45df]
/home/chris/VB/out/linux.x86/debug/bin/VBoxRT.so[0x172daf]
/home/chris/VB/out/linux.x86/debug/bin/VBoxRT.so[0x184abf]
/lib/libpthread.so.0[0x515c44b]
/lib/libc.so.6(clone+0x5e)[0x200c80e]
======= Memory map: ========
00110000-00111000 r-xp 00110000 00:00 0          [vdso]
00111000-00118000 r-xp 00000000 08:0a 7113760    /home/chris/VB/out/linux.x86/debug/bin/VBoxKeyboard.so
00118000-00119000 rwxp 00006000 08:0a 7113760    /home/chris/VB/out/linux.x86/debug/bin/VBoxKeyboard.so
00119000-001c2000 r-xp 00000000 08:0a 7113742    /home/chris/VB/out/linux.x86/debug/bin/VBoxRT.so
001c2000-001c3000 rwxp 000a9000 08:0a 7113742    /home/chris/VB/out/linux.x86/debug/bin/VBoxRT.so
001c3000-001c5000 rwxp 001c3000 00:00 0
001c5000-00425000 r-xp 00000000 08:0a 7113747    /home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so
00425000-00427000 rwxp 0025f000 08:0a 7113747    /home/chris/VB/out/linux.x86/debug/bin/VBoxVMM.so
00427000-00436000 r-xp 00000000 08:0a 7349562    /usr/lib/libXext.so.6.4.0
00436000-00437000 rwxp 0000e000 08:0a 7349562    /usr/lib/libXext.so.6.4.0
00437000-00535000 r-xp 00000000 08:0a 7344976    /usr/lib/libX11.so.6.2.0
00535000-00539000 rwxp 000fe000 08:0a 7344976    /usr/lib/libX11.so.6.2.0
00539000-00540000 r-xp 00000000 08:0a 1573228    /lib/librt-2.6.so
00540000-00541000 r-xp 00006000 08:0a 1573228    /lib/librt-2.6.so
00541000-00542000 rwxp 00007000 08:0a 1573228    /lib/librt-2.6.so
00542000-0055d000 r-xp 00000000 08:0a 1572889    /lib/ld-2.6.so
0055d000-0055e000 r-xp 0001a000 08:0a 1572889    /lib/ld-2.6.so
0055e000-0055f000 rwxp 0001b000 08:0a 1572889    /lib/ld-2.6.so
0055f000-005fc000 r-xp 00000000 08:0a 7113757    /home/chris/VB/out/linux.x86/debug/bin/VBoxREM.so
005fc000-00601000 rwxp 0009c000 08:0a 7113757    /home/chris/VB/out/linux.x86/debug/bin/VBoxREM.so
00601000-00e23000 rwxp 00601000 00:00 0
00e23000-01e24000 rwxp 00e23000 00:00 0
01e24000-01e28000 rwxp 01e24000 00:00 0
01e28000-01f08000 r-xp 00000000 08:0a 7362352    /usr/lib/libstdc++.so.6.0.8
01f08000-01f0b000 r-xp 000e0000 08:0a 7362352    /usr/lib/libstdc++.so.6.0.8
01f0b000-01f0d000 rwxp 000e3000 08:0a 7362352    /usr/lib/libstdc++.so.6.0.8
01f0d000-01f13000 rwxp 01f0d000 00:00 0
01f13000-01f3a000 r-xp 00000000 08:0a 1572980    /lib/libm-2.6.so
01f3a000-01f3b000 r-xp 00026000 08:0a 1572980    /lib/libm-2.6.so
01f3b000-01f3c000 rwxp 00027000 08:0a 1572980    /lib/libm-2.6.so
01f3c000-0208a000 r-xp 00000000 08:0a 1572893    /lib/libc-2.6.so
0208a000-0208c000 r-xp 0014e000 08:0a 1572893    /lib/libc-2.6.so
0208c000-0208d000 rwxp 00150000 08:0a 1572893    /lib/libc-2.6.so
0208d000-02090000 rwxp 0208d000 00:00 0
02090000-02099000 r-xp 00000000 08:0a 7351581    /usr/lib/libXcursor.so.1.0.2
02099000-0209a000 rwxp 00008000 08:0a 7351581    /usr/lib/libXcursor.so.1.0.2
0209a000-020a2000 r-xp 00000000 08:0a 7347896    /usr/lib/libXrender.so.1.3.0
020a2000-020a3000 rwxp 00007000 08:0a 7347896    /usr/lib/libXrender.so.1.3.0
020a3000-020b5000 r-xp 00000000 08:0a 7368339    /usr/lib/libXft.so.2.1.2
020b5000-020b6000 rwxp 00012000 08:0a 7368339    /usr/lib/libXft.so.2.1.2
020b6000-020be000 r-xp 00000000 08:0a 7358323    /usr/lib/libSM.so.6.0.0
020be000-020bf000 rwxp 00007000 08:0a 7358323    /usr/lib/libSM.so.6.0.0
020bf000-020c1000 r-xp 00000000 08:0a 7344442    /usr/lib/libXau.so.6.0.0
020c1000-020c2000 rwxp 00001000 08:0a 7344442    /usr/lib/libXau.so.6.0.0
020c2000-020c7000 r-xp 00000000 08:0a 7344975    /usr/lib/libXdmcp.so.6.0.0
020c7000-020c8000 rwxp 00004000 08:0a 7344975    /usr/lib/libXdmcp.so.6.0.0
020c8000-020cc000 r-xp 00000000 08:0a 7350465    /usr/lib/libXfixes.so.3.1.0
020cc000-020cd000 rwxp 00003000 08:0a 7350465    /usr/lib/libXfixes.so.3.1.0
020cd000-020fe000 r-xp 00000000 08:0a 7343316    /usr/lib/liblcms.so.1.0.16
020fe000-020ff000 rwxp 00031000 08:0a 7343316    /usr/lib/liblcms.so.1.0.16
020ff000-02102000 rwxp 020ff000 00:00 0
02102000-02121000 r-xp 00000000 08:0a 1572988    /lib/libexpat.so.0.5.0
02121000-02123000 rwxp 0001e000 08:0a 1572988    /lib/libexpat.so.0.5.0
02123000-02124000 rwxp 02123000 00:00 0
02124000-02125000 rwxs 00000000 00:09 871554     /dev/zero (deleted)
02125000-02126000 rwxs 00000000 00:09 871555WARNING: failed to send RELEASE event, file /home/chris/VB/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp, line 1691
WARNING: failed to send RELEASE event, file /home/chris/VB/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp, line 1691
ipcDConnectService Stats
 => number of worker threads: 1
nsStringStats
 => mAllocCount:             83
 => mReallocCount:           26
 => mFreeCount:              83
 => mShareCount:            122
 => mAdoptCount:             11
 => mAdoptFreeCount:         11
WARNING: failed to send RELEASE event, file /home/chris/VB/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp, line 1691
Informational: VirtualBox object deleted.

[chris@lx2 bin]$ fg
LD_LIBRARY_PATH=. ./VBoxSVC
Terminated event loop.
ipcDConnectService Stats
 => number of worker threads: 2
XPCOM server has shutdown.
nsStringStats
 => mAllocCount:             99
 => mReallocCount:           41
 => mFreeCount:              99
 => mShareCount:            164
 => mAdoptCount:             16
 => mAdoptFreeCount:         16

[chriz]

Logfile from VB 1.5.51_OSE r4786 with debug option

[Frank Mehnert]

Please could you start the debug version of both VBoxSVC and VirtualBox from gdb?

LD_LIBRARY_PATH=. gdb ./VBoxSVC
LD_LIBRARY_PATH=. gdb ./VirtualBox (in another terminal)

and can you reproduce the crashes with VBoxSDL?

LD_LIBRARY_PATH=. gdb ./VBoxSVC
LD_LIBRARY_PATH=. gdb -args ./VBoxSDL -vm <vm-name-to-start> (in another terminal)

The backtrace would be interesting (command 'bt' in gdb).

[chriz]

Frank,

I tried to do as you suggested. Since I'm not familiar with gdb my actions may be not optimal. If so: please advise ;-)

The output of the two terminals is in the attached file.
I listed 4 tries, commented with lines beginning with "##@@##" in that file.
First the output of VBoxSVC and then the corresponding one of VirtualBox.

VBoxSVC always wents into background.
So to be able to type "bt" after a crash I first had to type Ctrl-C.
I'm not sure if the result is good then.

Anyway, an expert may be able to read in that file.

And I can't reproduce the crashes with VBoxSDL. At least it didn't crash within a few minutes trying.
The normal VirtualBox crashes within second ususally.

[Frank Mehnert]

Hi guys,

please don't insert VBox.log files or any other dumps here, they are completely messed up as you already should have noted. Instead attach these files.

[masch]

Hi! Sorry i don't know that. Can you help me??

Salu2...

[Sander van Leeuwen]

Can you still reproduce this with the latest SVN code? We fixed a similar problem last week.

[chriz]

I tried it every few days with a new version and it always crashes.

Today it's 1.5.51_OSE r5020. And it still crashes.

Sorry for the bad news.

[chriz]

Now I tried it with Windows XP as guest. It doesn't crash as often as with the Windows 2000 guest, and is not so easy to replicate, but it still crashes often.

Logfiles are attached.

[chriz]

Another try, now with VirtualBox 1.5.51_OSE r5098

Situation that produced this crash:

Just after start of Windows XP guest I opened a command prompt window and executed a "dir C:\ /s"
After some seconds (perhaps 20???) the guest froze and then aborted.
This time I remembered to set "ulimit -c unlimited" before to get a core file.
The freeze may be due to writing the core file?
So now there is a backtrace inluded. Hopefully correct.

Attachments: VirtualBoxCrashes-XP-20070928.txt and VBox.8.log

[Frank Mehnert]

Chriz, thank you very much for the backtrace. Unfortunately, I cannot see any hint there why VBox crashed on your system. The backtrace looks quite ok, the memory corruption must have been occurred earlier.

[ugemkow]

Can you give some hint how to give more helpful information or how to debug this?

[chriz]

Frank,

now I tried it with my Windows 2000 guest again. That's much easier to replicate the crash ...
And perhaps the backtrace gives some infos.

Attachments: VirtualBoxCrashes-W2k-20071001.txt and VBox.9.log

[ugemkow]

Is there anything we can do to help innotek debug and fix this problem? Is it possible i.e. to valgrind VirtualBox?

I can produce some more backtraces but as already noted these may be of little help if this is really a memory corruption. Shall I add them anyway?

[Frank Mehnert]

ugemkow: valgrind is only a limited aid in debugging VBox since VBox uses several kernel areas mapped to userland which valgrind doesn't know. Therefore it would complain with tons of messages. As a first step you could try to generate backtraces with gdb:

export VBOX_ASSERT=0
LD_LIBRARY_PATH=. gdb ./VBoxSVC

and in another terminal

export VBOX_ASSERT=0
LD_LIBRARY_PATH=. gdb ./VirtualBox

and then start your guest session. Once VBox crashes, please dump the backtraces of all threads:

 info threads
 thread 1
 bt
 thread 2
 bt
 ...

And what did you exactly do to reproduce the crash? I have Win2k as guest here on a Ubuntu 7.04/i386 host. If you could find a pattern how to reproduce your problem as quick as possible that would be very helpful.

[chriz]

frank: Here another crash with the info files.
I tried to follow the instructions you gave ugemkow above. The "VBOX_ASSERT=0" and the "threads" command were new to me.
Again I only typed a bit in my favourite editor (​http://www.vedit.com) to reproduce the crash.

[chriz]

This time Windows2000 guest crashed during it's shutdown (just after startup, no actions within done.)

More thread infos this time. From VirtualBox process too.

[Frank Mehnert]

chris: Thank you very much for these additional information. Unfortunately, still no idea.

Which windows decorations are you using (kcontrol, Appearance & Themes, Window Decorations)? Crystal? Could you try to switch to other Window decorations, for example Plastik? Does that makes a difference?

[sitor]

Some people including myself have successfully gotten rid of these aborts by disabling hyperthreading or dual processor suport in the BIOS. Seems that that would be the direction to look to. Look at this thread ​http://forums.virtualbox.org/viewtopic.php?t=149&postdays=0&postorder=asc&start=28 for the details.

Hope this can help to get the problem fixed in the next version.

KR,

Sitor

[chriz]

frank:
Usually I'm using KDE, mostly with standard settings (Plastic?).
Now I switched to Gnome for a test: same crash.
And with Fluxbox instead of Gnome: the same aborting.

[chriz]

... and with Xfce and Blackbox it's the same aborting as well.

[Frank Mehnert]

Thanks for testing, so we can rule out at least such things.

[ugemkow]

Hello Frank,

I made a clean install mirroring the machine where the problems happens and also in this new installation the crashes happen.

Would it be helpful for you to get access to this system? Stuttgart is not so far away from Weinstadt. I can also give you the system for a few days.

Please contact me in private mail if this would be helpful.

[ugemkow]

In case you are still not able to reproduce these crashes maybe the following observation helps:

With current git (including the commit r5329 (Don't call QWidgtet::update() from a non-GUI thread) I was not able to reproduce the crash on my machine after about 15 minutes of working - before, the crash happened after a few seconds. So there is a significant difference.

[chriz]

I can confirm ugemkow's observation.
Today I tried it with r5352 and no crash yet.

[Frank Mehnert]

Indeed, it is very likely that this changeset fixed the problem. I will close this bug (fix contained in 1.5.2), please re-open if still relevant.

[masch]

Exelent New!!1... I was wainting this fixed...how can i get this version??

Congratulations!!...y Thanks..:D

Salu2...

[Frank Mehnert]

​http://www.virtualbox.org/wiki/Downloads -- version 1.5.2 contains the fix.