[vdr] segfault when killing vdr

[Wolfgang Rohdewald]

this is vdr-1.3.22, no patches, no plugins.

Sometimes when I kill it, it segfaults in different
places but always while clearing some cList. After
putting in a dsyslog into ~cListBase, I could no
longer reproduce it.

Any ideas? To me this smells like a threading bug.

(gdb) bt
#0  0xb7dbd4a1 in malloc_consolidate () from /lib/libc.so.6
#1  0xb7dbd36e in _int_free () from /lib/libc.so.6
#2  0xb7dbc09f in free () from /lib/libc.so.6
#3  0x080e6140 in ~cRecording (this=0x84b0e60) at recording.c:431
#4  0x081153fc in cListBase::Clear (this=0x81e1df8) at tools.c:997
#5  0x08114ffb in ~cListBase (this=0x81e1df8) at tools.c:920
#6  0x080e99a5 in ~cList (this=0x81e1df8) at svdrp.c:330
#7  0x080e987d in ~cRecordings (this=0x81e1df8) at svdrp.c:330
#8  0x080e943c in __tcf_0 () at recording.c:621
#9  0xb7d76ae2 in exit () from /lib/libc.so.6
#10 0xb7d60dce in __libc_start_main () from /lib/libc.so.6
#11 0x08086301 in _start () at ../sysdeps/i386/elf/start.S:102

(gdb) bt
#0  0xb7dbd4a1 in malloc_consolidate () from /lib/libc.so.6
#1  0xb7dbd36e in _int_free () from /lib/libc.so.6
#2  0xb7dbc09f in free () from /lib/libc.so.6
#3  0xb7f39d23 in operator delete () from /usr/lib/libstdc++.so.5
#4  0x080df13c in ~cCaDescriptors (this=0x84c7068) at pat.c:199
#5  0x08115584 in cListBase::Clear (this=0x81e1fe0) at tools.c:997
#6  0x08115183 in ~cListBase (this=0x81e1fe0) at tools.c:920
#7  0x080df477 in ~cList (this=0x81e1fe0) at pat.c:222
#8  0x080df569 in ~cCaDescriptorHandler (this=0x81e1fe0) at pat.c:222
#9  0x080de84c in __tcf_0 () at pat.c:222
#10 0xb7d76ae2 in exit () from /lib/libc.so.6
#11 0xb7d60dce in __libc_start_main () from /lib/libc.so.6
#12 0x08086301 in _start () at ../sysdeps/i386/elf/start.S:102

valgrind output:
==17072== Process terminating with default action of signal 11 (SIGSEGV)
==17072==  Access not within mapped region at address 0xFFFFFFFF
==17072==    at 0x81C1209: typeinfo for cString (in /home/vdr/vdr-1.3.22/vdr)
==17072==    by 0x810DCF5: cThread::StartThread(cThread*) (thread.c:227)
==17072==    by 0x1D4E4D52: thread_wrapper (vg_libpthread.c:867)
==17072==    by 0xB000F5DF: do__quit (vg_scheduler.c:1872)
==17072==


-- 
Wolfgang