Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 230127 - Loading trac through apache causes Python to segfault
Summary: Loading trac through apache causes Python to segfault
Alias: None
Product: Fedora
Classification: Fedora
Component: clearsilver
Version: rawhide
Hardware: x86_64
OS: Linux
Target Milestone: ---
Assignee: Jeffrey C. Ollie
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2007-02-26 19:30 UTC by Brenton D. Rothchild
Modified: 2007-11-30 22:11 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2007-04-19 20:24:11 UTC

Attachments (Terms of Use)
Backtrace of python crashing when loading trac through Apache/mod_python (deleted)
2007-02-26 19:30 UTC, Brenton D. Rothchild
no flags Details
Backtrace of python crashing when executing trac.cgi directly by Apache without mod_python (deleted)
2007-02-26 21:48 UTC, Brenton D. Rothchild
no flags Details
Fix segfault when delete a neo object (deleted)
2007-03-05 09:15 UTC, Peng Huang
no flags Details | Diff

Description Brenton D. Rothchild 2007-02-26 19:30:52 UTC
Description of problem:

Loading an instance of Trac through Apache using mod_python seems to crash with
a segfault coming from Python.

Version-Release number of selected component (if applicable):


How reproducible:

Steps to Reproduce:
1. gdb /usr/sbin/httpd
2. gdb> run -X
3. Load trac (via http://localhost/cgi-bin/trac.cgi)
Actual results:
Browser prompts user to download file "trac.cgi"

Apache error_log says:
[Mon Feb 26 12:40:33 2007] [notice] core dump file size limit raised to
18446744073709551615 bytes
[Mon Feb 26 12:40:33 2007] [notice] suEXEC mechanism enabled (wrapper:
[Mon Feb 26 12:40:34 2007] [notice] Digest: generating secret for digest
authentication ...
[Mon Feb 26 12:40:34 2007] [notice] Digest: done
[Mon Feb 26 12:40:34 2007] [notice] mod_python: Creating 4 session mutexes based
on 256 max processes and 0 max threads.
[Mon Feb 26 12:40:34 2007] [notice] mod_python: using mutex_directory /tmp 
[Mon Feb 26 12:40:35 2007] [notice] Apache/2.2.3 (Fedora) configured -- resuming
normal operations
[Mon Feb 26 12:41:02 2007] [notice] child pid 1432 exit signal Segmentation
fault (11), possible coredump in /tmp

Expected results:
Trac site should come up in browser

Additional info:
A backtrace from gdb is in a separate attachment.
I'm not discounting the fact that rawhide at my babies.

Comment 1 Brenton D. Rothchild 2007-02-26 19:30:52 UTC
Created attachment 148820 [details]
Backtrace of python crashing when loading trac through Apache/mod_python

Comment 2 Brenton D. Rothchild 2007-02-26 19:35:03 UTC
Forgot to include the version of track from rawhide:


Comment 3 Jeremy Katz 2007-02-26 20:10:48 UTC
Does it work if you just use it as a CGI without mod_python involved?

Comment 4 Brenton D. Rothchild 2007-02-26 21:47:25 UTC
I believe the following illustrates running the CGI without mod_python involved:

1) I moved conf.d/trac.conf to trac.conf.bak to avoid loading it

2) I changed the default httpd.conf to have TRAC_ENV set under cgi-bin,
and commented out the python_module directive:

/etc/httpd/conf/httpd.conf (relative bits):
<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
    SetEnv TRAC_ENV /opt/trac/test

#LoadModule python_module modules/

3) I restarted apache via "service httpd restart"

4) I loaded http://localhost/cgi-bin/trac.cgi with a browser

At this point, the Apache error_log filled with a backtrace indicating an
invalid free() in glibc was detected.

I have attached this error_log output as another attachment.

If this isn't the right information you need, please let me know.

Comment 5 Brenton D. Rothchild 2007-02-26 21:48:44 UTC
Created attachment 148833 [details]
Backtrace of python crashing when executing trac.cgi directly by Apache without mod_python

Comment 6 Jeremy Katz 2007-02-26 22:15:16 UTC
This is a bug in python-clearsilver.  It uses PyObject_NEW to allocate memory
and then later frees the memory with PyMem_DEL.  Although this "worked" in the
past, it's never been explicitly legal to do so and with changes to the object
system in python 2.5, it now fails spectacularly.

Fix is to replace the PyMem_DEL calls in clearsilver's python bindings with

Comment 7 Jeffrey C. Ollie 2007-02-27 00:05:48 UTC
Has this bug been reported upstream to clearsilver?

Comment 8 Jeffrey C. Ollie 2007-02-27 00:31:09 UTC
Apparently this bug has been fixed in version 0.10.4, which wasn't announced on
the home page:

I'll try and get clearsilver updated.

Comment 9 Jeffrey C. Ollie 2007-02-27 05:46:22 UTC
I've built some new RPMS... Let me know if they solve the problem and I'll
commit the changes.

Comment 10 Brenton D. Rothchild 2007-02-27 19:51:37 UTC
I tried python-clearsilver-0.10.4-1.fc7.x86_64.rpm.

Trac loads fine through a regular CGI.

Trac still seems to crash python when using mod_python and has an identical
backtrace to the first attachement,

Comment 11 Jeffrey C. Ollie 2007-02-27 20:43:29 UTC
This issue probably needs to be taken upstream with the ClearSilver developers.
 I don't know enough about the internals of Python, mod_python, and httpd to be
of much help debugging.

Comment 12 Gwyn Ciesla 2007-02-27 21:01:46 UTC
I don't see an obvious bug-tracking system for upstream.  Will you be posting
the results of your contact with upstream in this bug?

Comment 13 Jeffrey C. Ollie 2007-02-27 21:24:08 UTC
No, you need to take it upstream, as I don't have the resources to duplicate the
problem (I don't have a box running development).  They do appear to have a
yahoo groups mailing list.  I had also looked for a public source code
repository but didn't see one.  If I had found one I would have looked to see if
there were any fixes in the repository that hadn't made it into a release...

Comment 14 Gwyn Ciesla 2007-02-28 12:16:46 UTC
You meaning me or you meaning Brenton?

Comment 15 Jeffrey C. Ollie 2007-02-28 15:02:28 UTC
(In reply to comment #14)
> You meaning me or you meaning Brenton?

I guess whoever can reproduce the bug, probably meaning Brenton.

Comment 16 Brenton D. Rothchild 2007-03-01 14:46:46 UTC
I have posted to the ClearSilver Yahoo! group to see if I can get more
information regarding this bug.

Comment 17 Peng Huang 2007-03-05 07:31:30 UTC
I use trac as standalone mode. The python will segfault too.
[phuang@dhcp-0-143 trac]$ /usr/sbin/tracd -p 8000 --auth '*',passwd,trac project1/
*** glibc detected *** /usr/bin/python: munmap_chunk(): invalid pointer:
0xb7ef6380 ***
======= Backtrace: =========
======= Memory map: ========
00110000-00111000 r-xp 00000000 08:08 1988879   
00111000-00112000 rwxp 00000000 08:08 1988879   
00112000-00120000 r-xp 00000000 08:08 1988889   
00120000-00123000 rwxp 0000d000 08:08 1988889   
00127000-0012c000 r-xp 00000000 08:08 1988887   
0012c000-0012d000 rwxp 00005000 08:08 1988887   
0012d000-0014b000 r-xp 00000000 08:08 2541276   
0014b000-0014e000 rwxp 0001d000 08:08 2541276   
0014e000-00155000 r-xp 00000000 08:08 1521601    /usr/lib/
00155000-00156000 rwxp 00007000 08:08 1521601    /usr/lib/
00169000-0016a000 r-xp 00000000 08:08 1988849   
0016a000-0016b000 rwxp 00001000 08:08 1988849   
0016b000-0019e000 r-xp 00000000 08:08 1521623    /usr/lib/
0019e000-0019f000 rwxp 00032000 08:08 1521623    /usr/lib/
001b4000-001b8000 r-xp 00000000 08:08 521254     /lib/
001b8000-001b9000 r-xp 00003000 08:08 521254     /lib/
001b9000-001ba000 rwxp 00004000 08:08 521254     /lib/
001ba000-001e1000 r-xp 00000000 08:08 423494     /usr/lib/
001e1000-001e2000 rwxp 00027000 08:08 423494     /usr/lib/
001f6000-00206000 r-xp 00000000 08:08 1988884   
00206000-00207000 rwxp 00010000 08:08 1988884   
00207000-0026c000 r-xp 00000000 08:08 1988915   
0026c000-0027b000 rwxp 00065000 08:08 1988915   
0027b000-00295000 r-xp 00000000 08:08 1521611    /usr/lib/
00295000-00296000 rwxp 0001a000 08:08 1521611    /usr/lib/
0029a000-0029c000 r-xp 00000000 08:08 1990840   
0029c000-0029e000 rwxp 00002000 08:08 1990840   
0029e000-002c7000 r-xp 00000000 08:08 1521605    /usr/lib/
002c7000-002c8000 rwxp 00028000 08:08 1521605    /usr/lib/libsAborted

Comment 18 Peng Huang 2007-03-05 07:38:36 UTC
The simple python code that is listed below will cause python to segfault. Hope
it  would be useful for debug it.

#!/usr/bin/env python
import neo_cgi
a = neo_cgi.CGI()
a = neo_cgi.CGI()
print a

Comment 19 Peng Huang 2007-03-05 09:15:59 UTC
Created attachment 149250 [details]
Fix segfault when delete a neo object

Comment 20 Jeffrey C. Ollie 2007-04-19 20:24:11 UTC
(In reply to comment #19)
> Created an attachment (id=149250) [edit]
> Fix segfault when delete a neo object

This fix is already in 0.10.4, which has been in extras for a while.  I'm going
to close this report, feel free to open it back up if there is still a problem. 

Note You need to log in before you can comment on or make changes to this bug.