Bug 43098 - Падает при завершении аудиозвонка
Summary: Падает при завершении аудиозвонка
Status: CLOSED WORKSFORME
Alias: None
Product: Sisyphus
Classification: Development
Component: telegram-desktop (show other bugs)
Version: unstable
Hardware: x86_64 Linux
: P5 normal
Assignee: Vitaly Lipatov
QA Contact: qa-sisyphus
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-06-29 04:31 MSK by Vitaly Lipatov
Modified: 2023-11-02 12:57 MSK (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vitaly Lipatov 2022-06-29 04:31:46 MSK
При завершении звонка:
free(): invalid next size (fast)
Аварийный останов (стек памяти сброшен на диск)

                Stack trace of thread 2707461:
                #0  0x00007f3c9abcd2f1 __GI_raise (libc.so.6 + 0x3d2f1)
                #1  0x00007f3c9abb6538 __GI_abort (libc.so.6 + 0x26538)
                #2  0x00007f3c9ac0eee7 __libc_message (libc.so.6 + 0x7eee7)
                #3  0x00007f3c9ac169bc malloc_printerr (libc.so.6 + 0x869bc)
                #4  0x00007f3c9ac17e04 _int_free (libc.so.6 + 0x87e04)
                #5  0x0000556a992007ef _ZNK3rtc20RefCountedNonVirtualIN6webrtc21PendingTaskSafetyFlagEE7ReleaseEv (telegram-desktop + 0x284e7ef)
                #6  0x0000556a9920086d _ZN7tgcalls13ReflectorPortD0Ev (telegram-desktop + 0x284e86d)
                #7  0x00007f3c9f3bf6be _ZN7cricket25BasicPortAllocatorSessionD2Ev (libtg_owt.so.0 + 0x8f76be)
                #8  0x00007f3c9f3bfae9 _ZN7cricket25BasicPortAllocatorSessionD0Ev (libtg_owt.so.0 + 0x8f7ae9)
                #9  0x00007f3c9f381b27 _ZNKSt14default_deleteIN7cricket20PortAllocatorSessionEEclEPS1_ (libtg_owt.so.0 + 0x8b9b27)
                #10 0x00007f3c9f381c89 _ZN7cricket19P2PTransportChannelD0Ev (libtg_owt.so.0 + 0x8b9c89)
                #11 0x0000556a990d7ca2 _ZNKSt14default_deleteIN7cricket19P2PTransportChannelEEclEPS1_ (telegram-desktop + 0x2725ca2)
                #12 0x0000556a990d824d _ZN7tgcalls14NetworkManagerD0Ev (telegram-desktop + 0x272624d)
                #13 0x0000556a990cb4da _ZNSt16_Sp_counted_baseILN9__gnu_cxx12_Lock_policyE2EE10_M_releaseEv (telegram-desktop + 0x27194da)
                #14 0x00007f3c9ef0d519 _ZN3rtc6Thread17QueuedTaskHandler9OnMessageEPNS_7MessageE (libtg_owt.so.0 + 0x445519)
                #15 0x00007f3c9ef0ddf1 _ZN3rtc6Thread8DispatchEPNS_7MessageE (libtg_owt.so.0 + 0x445df1)
                #16 0x00007f3c9ef0d197 _ZN3rtc6Thread15ProcessMessagesEi (libtg_owt.so.0 + 0x445197)
                #17 0x00007f3c9ef0d274 _ZN3rtc6Thread3RunEv (libtg_owt.so.0 + 0x445274)
                #18 0x00007f3c9ea50eae start_thread (libpthread.so.0 + 0x8eae)
                #19 0x00007f3c9ac8f89f __clone (libc.so.6 + 0xff89f)


воспроизводится на
telegram-desktop-4.0.2
и
telegram-desktop-3.7.5

видимо, появилось раньше.
Comment 1 Vitaly Lipatov 2022-06-29 04:35:34 MSK
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007f3c9abb6538 in __GI_abort () at abort.c:79
#2  0x00007f3c9ac0eee7 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f3c9ad1f395 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007f3c9ac169bc in malloc_printerr (str=str@entry=0x7f3c9ad217f8 "free(): invalid next size (fast)") at malloc.c:5389
#4  0x00007f3c9ac17e04 in _int_free (av=0x7f3b84000020, p=0x7f3b8425e410, have_lock=0) at malloc.c:4281
#5  0x0000556a992007ef in rtc::RefCountedNonVirtual<webrtc::PendingTaskSafetyFlag>::Release (this=0x7f3b8425e420) at /usr/include/tg_owt/api/ref_counted_base.h:80
#6  rtc::RefCountedNonVirtual<webrtc::PendingTaskSafetyFlag>::Release (this=0x7f3b8425e420) at /usr/include/tg_owt/api/ref_counted_base.h:68
#7  rtc::scoped_refptr<webrtc::PendingTaskSafetyFlag>::~scoped_refptr (this=0x7f3b8425e348, __in_chrg=<optimized out>) at /usr/include/tg_owt/api/scoped_refptr.h:103
#8  webrtc::ScopedTaskSafety::~ScopedTaskSafety (this=0x7f3b8425e348, __in_chrg=<optimized out>) at /usr/include/tg_owt/rtc_base/task_utils/pending_task_safety_flag.h:122
#9  tgcalls::ReflectorPort::~ReflectorPort (this=0x7f3b8425dc80, __in_chrg=<optimized out>) at /usr/src/debug/telegram-desktop-4.0.2/Telegram/ThirdParty/tgcalls/tgcalls/v2/ReflectorPort.cpp:125
#10 0x0000556a9920086d in tgcalls::ReflectorPort::~ReflectorPort (this=0x7f3b8425dc80, __in_chrg=<optimized out>) at /usr/src/debug/telegram-desktop-4.0.2/Telegram/ThirdParty/tgcalls/tgcalls/v2/ReflectorPort.cpp:137
#11 0x00007f3c9f3bf6be in cricket::BasicPortAllocatorSession::~BasicPortAllocatorSession (this=0x7f3b8402e0f0, __in_chrg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/client/basic_port_allocator.cc:304
#12 0x00007f3c9f3bfae9 in cricket::BasicPortAllocatorSession::~BasicPortAllocatorSession (this=0x7f3b8402e0f0, __in_chrg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/client/basic_port_allocator.cc:310
#13 0x00007f3c9f381b27 in std::default_delete<cricket::PortAllocatorSession>::operator() (__ptr=<optimized out>, this=0x7f3b8414fca0) at /usr/include/c++/10/bits/unique_ptr.h:79
#14 std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >::~unique_ptr (this=0x7f3b8414fca0, __in_chrg=<optimized out>) at /usr/include/c++/10/bits/unique_ptr.h:361
#15 std::destroy_at<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> > > (__location=0x7f3b8414fca0) at /usr/include/c++/10/bits/stl_construct.h:88
#16 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> > > (__pointer=0x7f3b8414fca0) at /usr/include/c++/10/bits/stl_construct.h:138
#17 std::_Destroy_aux<false>::__destroy<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >*> (__last=<optimized out>, __first=0x7f3b8414fca0)
    at /usr/include/c++/10/bits/stl_construct.h:152
#18 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >*> (__last=<optimized out>, __first=<optimized out>) at /usr/include/c++/10/bits/stl_construct.h:185
#19 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >*, std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> > > (
    __last=0x7f3b8414fca8, __first=<optimized out>) at /usr/include/c++/10/bits/alloc_traits.h:738
#20 std::vector<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >, std::allocator<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> > > >::~vector (this=0x7f3b8414f8f0, __in_chrg=<optimized out>) at /usr/include/c++/10/bits/stl_vector.h:680
#21 cricket::P2PTransportChannel::~P2PTransportChannel (this=0x7f3b8414f490, __in_chrg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/base/p2p_transport_channel.cc:211
#22 0x00007f3c9f381c89 in cricket::P2PTransportChannel::~P2PTransportChannel (this=0x7f3b8414f490, __in_chrg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/base/p2p_transport_channel.cc:220
#23 0x0000556a990d7ca2 in std::default_delete<cricket::P2PTransportChannel>::operator() (__ptr=<optimized out>, this=0x7f3b840552a0) at /usr/include/c++/10/bits/unique_ptr.h:79
#24 std::__uniq_ptr_impl<cricket::P2PTransportChannel, std::default_delete<cricket::P2PTransportChannel> >::reset (__p=0x0, this=0x7f3b840552a0) at /usr/include/c++/10/bits/unique_ptr.h:182
#25 std::unique_ptr<cricket::P2PTransportChannel, std::default_delete<cricket::P2PTransportChannel> >::reset (__p=0x0, this=0x7f3b840552a0) at /usr/include/c++/10/bits/unique_ptr.h:456
#26 tgcalls::NetworkManager::~NetworkManager (this=0x7f3b840550a0, __in_chrg=<optimized out>) at /usr/src/debug/telegram-desktop-4.0.2/Telegram/ThirdParty/tgcalls/tgcalls/NetworkManager.cpp:103
#27 0x0000556a990d824d in tgcalls::NetworkManager::~NetworkManager (this=0x7f3b840550a0, __in_chrg=<optimized out>) at /usr/src/debug/telegram-desktop-4.0.2/Telegram/ThirdParty/tgcalls/tgcalls/NetworkManager.cpp:109
#28 0x0000556a990cb4da in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release (this=0x7f3b8414de10) at /usr/include/c++/10/bits/shared_ptr_base.h:158
#29 std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count (this=<optimized out>, __in_chrg=<optimized out>) at /usr/include/c++/10/bits/shared_ptr_base.h:736
#30 std::__shared_ptr<tgcalls::NetworkManager, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr (this=<optimized out>, __in_chrg=<optimized out>) at /usr/include/c++/10/bits/shared_ptr_base.h:1188
#31 std::__shared_ptr<tgcalls::NetworkManager, (__gnu_cxx::_Lock_policy)2>::reset (this=<optimized out>) at /usr/include/c++/10/bits/shared_ptr_base.h:1306
#32 tgcalls::ThreadLocalObject<tgcalls::NetworkManager>::~ThreadLocalObject()::{lambda()#1}::operator()() const (this=<optimized out>)
    at /usr/src/debug/telegram-desktop-4.0.2/Telegram/ThirdParty/tgcalls/tgcalls/ThreadLocalObject.h:29
#33 webrtc::webrtc_new_closure_impl::ClosureTask<tgcalls::ThreadLocalObject<tgcalls::NetworkManager>::~ThreadLocalObject()::{lambda()#1}>::Run() (this=<optimized out>) at /usr/include/tg_owt/rtc_base/task_utils/to_queued_task.h:32
#34 0x00007f3c9ef0d519 in rtc::Thread::QueuedTaskHandler::OnMessage (this=<optimized out>, msg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:1031
#35 0x00007f3c9ef0ddf1 in rtc::Thread::Dispatch (this=0x7f3b34002290, pmsg=0x7f3baf7fd3d0) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:700
#36 0x00007f3c9ef0d197 in rtc::Thread::ProcessMessages (this=this@entry=0x7f3b34002290, cmsLoop=cmsLoop@entry=-1) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:1144
#37 0x00007f3c9ef0d274 in rtc::Thread::Run (this=0x7f3b34002290) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:890
#38 rtc::Thread::PreRun (pv=0x7f3b34002290) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:879
#39 0x00007f3c9ea50eae in start_thread (arg=0x7f3baf7fe640) at pthread_create.c:463
#40 0x00007f3c9ac8f89f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Comment 2 Vitaly Lipatov 2022-06-29 05:16:22 MSK
Примечательно, что при запуске через valgrind падения нет, работает и звук и видео, и корректно завершается.
Comment 3 Vitaly Lipatov 2022-06-29 05:34:27 MSK
==2730493== Thread 46 tgc-net:
==2730493== Invalid read of size 4
==2730493==    at 0x60B3940: pthread_mutex_destroy (pthread_mutex_destroy.c:32)
==2730493==    by 0x29567E1: ~MutexImpl (mutex_pthread.h:41)
==2730493==    by 0x29567E1: ~Mutex (mutex.h:35)
==2730493==    by 0x29567E1: ~SequenceCheckerImpl (sequence_checker_internal.h:34)
==2730493==    by 0x29567E1: ~SequenceChecker (sequence_checker.h:38)
==2730493==    by 0x29567E1: ~PendingTaskSafetyFlag (pending_task_safety_flag.h:71)
==2730493==    by 0x29567E1: Release (ref_counted_base.h:80)
==2730493==    by 0x29567E1: Release (ref_counted_base.h:68)
==2730493==    by 0x29567E1: ~scoped_refptr (scoped_refptr.h:103)
==2730493==    by 0x29567E1: ~ScopedTaskSafety (pending_task_safety_flag.h:122)
==2730493==    by 0x29567E1: tgcalls::ReflectorPort::~ReflectorPort() (ReflectorPort.cpp:125)
==2730493==    by 0x295686C: tgcalls::ReflectorPort::~ReflectorPort() (ReflectorPort.cpp:137)
==2730493==    by 0x5C7C6BD: cricket::BasicPortAllocatorSession::~BasicPortAllocatorSession() (basic_port_allocator.cc:304)
==2730493==    by 0x5C7CAE8: cricket::BasicPortAllocatorSession::~BasicPortAllocatorSession() (basic_port_allocator.cc:310)
==2730493==    by 0x5C3EB26: operator() (unique_ptr.h:85)
==2730493==    by 0x5C3EB26: ~unique_ptr (unique_ptr.h:361)
==2730493==    by 0x5C3EB26: destroy_at<std::unique_ptr<cricket::PortAllocatorSession> > (stl_construct.h:88)
==2730493==    by 0x5C3EB26: _Destroy<std::unique_ptr<cricket::PortAllocatorSession> > (stl_construct.h:138)
==2730493==    by 0x5C3EB26: __destroy<std::unique_ptr<cricket::PortAllocatorSession>*> (stl_construct.h:152)
==2730493==    by 0x5C3EB26: _Destroy<std::unique_ptr<cricket::PortAllocatorSession>*> (stl_construct.h:185)
==2730493==    by 0x5C3EB26: _Destroy<std::unique_ptr<cricket::PortAllocatorSession>*, std::unique_ptr<cricket::PortAllocatorSession> > (alloc_traits.h:738)
==2730493==    by 0x5C3EB26: ~vector (stl_vector.h:680)
==2730493==    by 0x5C3EB26: cricket::P2PTransportChannel::~P2PTransportChannel() (p2p_transport_channel.cc:211)
==2730493==    by 0x5C3EC88: cricket::P2PTransportChannel::~P2PTransportChannel() (p2p_transport_channel.cc:220)
==2730493==    by 0x282DCA1: operator() (unique_ptr.h:85)
==2730493==    by 0x282DCA1: reset (unique_ptr.h:182)
==2730493==    by 0x282DCA1: reset (unique_ptr.h:456)
==2730493==    by 0x282DCA1: tgcalls::NetworkManager::~NetworkManager() (NetworkManager.cpp:103)
==2730493==    by 0x282E24C: tgcalls::NetworkManager::~NetworkManager() (NetworkManager.cpp:109)
==2730493==    by 0x28214D9: _M_release (shared_ptr_base.h:158)
==2730493==    by 0x28214D9: ~__shared_count (shared_ptr_base.h:736)
==2730493==    by 0x28214D9: ~__shared_ptr (shared_ptr_base.h:1188)
==2730493==    by 0x28214D9: reset (shared_ptr_base.h:1306)
==2730493==    by 0x28214D9: operator() (ThreadLocalObject.h:29)
==2730493==    by 0x28214D9: webrtc::webrtc_new_closure_impl::ClosureTask<tgcalls::ThreadLocalObject<tgcalls::NetworkManager>::~ThreadLocalObject()::{lambda()#1}>::Run() (to_queued_task.h:32)
==2730493==    by 0x57CA518: rtc::Thread::QueuedTaskHandler::OnMessage(rtc::Message*) (thread.cc:1031)
==2730493==    by 0x57CADF0: rtc::Thread::Dispatch(rtc::Message*) (thread.cc:700)
==2730493==  Address 0x177f04f8 is 16 bytes after a block of size 8 alloc'd
==2730493==    at 0x50AAF01: operator new(unsigned long) (vg_replace_malloc.c:417)
==2730493==    by 0x57F35F5: webrtc::PendingTaskSafetyFlag::CreateInternal(bool) (pending_task_safety_flag.cc:20)
==2730493==    by 0x57F3642: webrtc::PendingTaskSafetyFlag::Create() (pending_task_safety_flag.cc:25)
==2730493==    by 0x295B744: ScopedTaskSafety (pending_task_safety_flag.h:121)
==2730493==    by 0x295B744: tgcalls::ReflectorPort::ReflectorPort(rtc::Thread*, rtc::PacketSocketFactory*, rtc::Network*, unsigned short, unsigned short, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, cricket::ProtocolAddress const&, unsigned char, cricket::RelayCredentials const&, int) (ReflectorPort.cpp:112)
==2730493==    by 0x2887E86: Create (ReflectorPort.h:118)
==2730493==    by 0x2887E86: CreateUnique (ReflectorPort.h:135)
==2730493==    by 0x2887E86: tgcalls::ReflectorRelayPortFactory::Create(cricket::CreateRelayPortArgs const&, int, int) (ReflectorRelayPortFactory.cpp:71)
==2730493==    by 0x5C84AC0: cricket::AllocationSequence::CreateTurnPort(cricket::RelayServerConfig const&) (basic_port_allocator.cc:1592)
==2730493==    by 0x5C84EE1: cricket::AllocationSequence::CreateRelayPorts() (basic_port_allocator.cc:1532)
==2730493==    by 0x5C859E7: cricket::AllocationSequence::Process(int) (basic_port_allocator.cc:1392)
==2730493==    by 0x5C85AAB: operator() (basic_port_allocator.cc:1408)
==2730493==    by 0x5C85AAB: Run (to_queued_task.h:50)
==2730493==    by 0x5C85AAB: webrtc::webrtc_new_closure_impl::SafetyClosureTask<cricket::AllocationSequence::Process(int)::{lambda()#1}>::Run() (to_queued_task.h:48)
==2730493==    by 0x57CA518: rtc::Thread::QueuedTaskHandler::OnMessage(rtc::Message*) (thread.cc:1031)
==2730493==    by 0x57CADF0: rtc::Thread::Dispatch(rtc::Message*) (thread.cc:700)
==2730493==    by 0x57CA196: rtc::Thread::ProcessMessages(int) (thread.cc:1144)
Comment 4 Vitaly Lipatov 2022-06-29 05:55:46 MSK
==2730493==  Address 0x177f04f8 is 16 bytes after a block of size 8 alloc'd
==2730493==    at 0x50AAF01: operator new(unsigned long) (vg_replace_malloc.c:417)
==2730493==    by 0x57F35F5: webrtc::PendingTaskSafetyFlag::CreateInternal(bool) (pending_task_safety_flag.cc:20)


pending_task_safety_flag.cc:
// static
rtc::scoped_refptr<PendingTaskSafetyFlag> PendingTaskSafetyFlag::CreateInternal(
    bool alive) {
  // Explicit new, to access private constructor.
  return rtc::scoped_refptr<PendingTaskSafetyFlag>(
      new PendingTaskSafetyFlag(alive));
}


owt/src/api/scoped_refptr.h:
...
  explicit scoped_refptr(T* p) : ptr_(p) {
    if (ptr_)
      ptr_->AddRef();
  }
...

  template <typename U>
  scoped_refptr(const scoped_refptr<U>& r) : ptr_(r.get()) {
    if (ptr_)
      ptr_->AddRef();
  }


Пока могу только предположить, что есть объекты разного размера из-за различия флагов компиляции.


Если запустить через jemalloc.sh (не пересобирая ничего), то ошибка выглядит так:

<jemalloc>: src/jemalloc.c:3555: Failed assertion: "usize == isalloc(tsd_tsdn(tsd), ptr)"

Трейс падения при этом такой же:
0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007f3b84189538 in __GI_abort () at abort.c:79
#2  0x00007f3b8903bd6a in ?? () from /usr/lib64/libjemalloc.so.2
#3  0x00007f3b8903c17d in ?? () from /usr/lib64/libjemalloc.so.2
#4  0x00007f3b8909934e in operator delete(void*, unsigned long) () from /usr/lib64/libjemalloc.so.2
#5  0x000055bfc1de77ef in rtc::RefCountedNonVirtual<webrtc::PendingTaskSafetyFlag>::Release (this=0x7f3b1e595440) at /usr/include/tg_owt/api/ref_counted_base.h:80
#6  rtc::RefCountedNonVirtual<webrtc::PendingTaskSafetyFlag>::Release (this=0x7f3b1e595440) at /usr/include/tg_owt/api/ref_counted_base.h:68
#7  rtc::scoped_refptr<webrtc::PendingTaskSafetyFlag>::~scoped_refptr (this=0x7f3b1e5ef4c8, __in_chrg=<optimized out>) at /usr/include/tg_owt/api/scoped_refptr.h:103
#8  webrtc::ScopedTaskSafety::~ScopedTaskSafety (this=0x7f3b1e5ef4c8, __in_chrg=<optimized out>) at /usr/include/tg_owt/rtc_base/task_utils/pending_task_safety_flag.h:122
#9  tgcalls::ReflectorPort::~ReflectorPort (this=0x7f3b1e5eee00, __in_chrg=<optimized out>) at /usr/src/debug/telegram-desktop-4.0.2/Telegram/ThirdParty/tgcalls/tgcalls/v2/ReflectorPort.cpp:125
Comment 5 Vitaly Lipatov 2022-08-06 15:48:55 MSK
4.0.4 всё так же:
                Stack trace of thread 2920095:
                #0  0x00007f9a6142b2f1 __GI_raise (libc.so.6 + 0x3d2f1)
                #1  0x00007f9a61414538 __GI_abort (libc.so.6 + 0x26538)
                #2  0x00007f9a6146cee7 __libc_message (libc.so.6 + 0x7eee7)
                #3  0x00007f9a614749bc malloc_printerr (libc.so.6 + 0x869bc)
                #4  0x00007f9a61475e04 _int_free (libc.so.6 + 0x87e04)
                #5  0x000055ce9edd5d3f n/a (telegram-desktop + 0x28ffd3f)
                #6  0x000055ce9edd5dbd n/a (telegram-desktop + 0x28ffdbd)
                #7  0x00007f9a65c1e6be _ZN7cricket25BasicPortAllocatorSessionD2Ev (libtg_owt.so.0 + 0x8f76be)
                #8  0x00007f9a65c1eae9 _ZN7cricket25BasicPortAllocatorSessionD0Ev (libtg_owt.so.0 + 0x8f7ae9)
                #9  0x00007f9a65be0b27 _ZNKSt14default_deleteIN7cricket20PortAllocatorSessionEEclEPS1_ (libtg_owt.so.0 + 0x8b9b27)
                #10 0x00007f9a65be0c89 _ZN7cricket19P2PTransportChannelD0Ev (libtg_owt.so.0 + 0x8b9c89)
                #11 0x000055ce9ecad132 n/a (telegram-desktop + 0x27d7132)
                #12 0x000055ce9ecad6dd n/a (telegram-desktop + 0x27d76dd)
                #13 0x000055ce9eca096a n/a (telegram-desktop + 0x27ca96a)
                #14 0x00007f9a6576c519 _ZN3rtc6Thread17QueuedTaskHandler9OnMessageEPNS_7MessageE (libtg_owt.so.0 + 0x445519)
                #15 0x00007f9a6576cdf1 _ZN3rtc6Thread8DispatchEPNS_7MessageE (libtg_owt.so.0 + 0x445df1)
                #16 0x00007f9a6576c197 _ZN3rtc6Thread15ProcessMessagesEi (libtg_owt.so.0 + 0x445197)
                #17 0x00007f9a6576c274 _ZN3rtc6Thread3RunEv (libtg_owt.so.0 + 0x445274)
                #18 0x00007f9a652afeae start_thread (libpthread.so.0 + 0x8eae)
                #19 0x00007f9a614ed89f __clone (libc.so.6 + 0xff89f)
Comment 6 Vitaly Lipatov 2022-08-06 16:05:19 MSK
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007f9a61414538 in __GI_abort () at abort.c:79
#2  0x00007f9a6146cee7 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f9a6157d395 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007f9a614749bc in malloc_printerr (str=str@entry=0x7f9a6157f7f8 "free(): invalid next size (fast)") at malloc.c:5389
#4  0x00007f9a61475e04 in _int_free (av=0x7f98dc000020, p=0x7f98dc045e10, have_lock=0) at malloc.c:4281
#5  0x000055ce9edd5d3f in ?? ()
#6  0x000055ce9edd5dbd in ?? ()
#7  0x00007f9a65c1e6be in cricket::BasicPortAllocatorSession::~BasicPortAllocatorSession (this=0x7f98dc0066d0, __in_chrg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/client/basic_port_allocator.cc:304
#8  0x00007f9a65c1eae9 in cricket::BasicPortAllocatorSession::~BasicPortAllocatorSession (this=0x7f98dc0066d0, __in_chrg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/client/basic_port_allocator.cc:310
#9  0x00007f9a65be0b27 in std::default_delete<cricket::PortAllocatorSession>::operator() (__ptr=<optimized out>, this=0x7f98dc008ef0) at /usr/include/c++/10/bits/unique_ptr.h:79
#10 std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >::~unique_ptr (this=0x7f98dc008ef0, __in_chrg=<optimized out>) at /usr/include/c++/10/bits/unique_ptr.h:361
#11 std::destroy_at<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> > > (__location=0x7f98dc008ef0) at /usr/include/c++/10/bits/stl_construct.h:88
#12 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> > > (__pointer=0x7f98dc008ef0) at /usr/include/c++/10/bits/stl_construct.h:138
#13 std::_Destroy_aux<false>::__destroy<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >*> (__last=<optimized out>, __first=0x7f98dc008ef0)
    at /usr/include/c++/10/bits/stl_construct.h:152
#14 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >*> (__last=<optimized out>, __first=<optimized out>) at /usr/include/c++/10/bits/stl_construct.h:185
#15 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >*, std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> > > (
    __last=0x7f98dc008ef8, __first=<optimized out>) at /usr/include/c++/10/bits/alloc_traits.h:738
#16 std::vector<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >, std::allocator<std::unique_ptr<cricket::PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> > > >::~vector (this=0x7f98dc008b00, __in_chrg=<optimized out>) at /usr/include/c++/10/bits/stl_vector.h:680
#17 cricket::P2PTransportChannel::~P2PTransportChannel (this=0x7f98dc0086a0, __in_chrg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/base/p2p_transport_channel.cc:211
#18 0x00007f9a65be0c89 in cricket::P2PTransportChannel::~P2PTransportChannel (this=0x7f98dc0086a0, __in_chrg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/base/p2p_transport_channel.cc:220
#19 0x000055ce9ecad132 in ?? ()
#20 0x000055ce9ecad6dd in ?? ()
#21 0x000055ce9eca096a in ?? ()
#22 0x00007f9a6576c519 in rtc::Thread::QueuedTaskHandler::OnMessage (this=<optimized out>, msg=<optimized out>) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:1031
#23 0x00007f9a6576cdf1 in rtc::Thread::Dispatch (this=0x7f98e40040d0, pmsg=0x7f9913ffe3d0) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:700
#24 0x00007f9a6576c197 in rtc::Thread::ProcessMessages (this=this@entry=0x7f98e40040d0, cmsLoop=cmsLoop@entry=-1) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:1144
#25 0x00007f9a6576c274 in rtc::Thread::Run (this=0x7f98e40040d0) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:890
#26 rtc::Thread::PreRun (pv=0x7f98e40040d0) at /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:879
#27 0x00007f9a652afeae in start_thread (arg=0x7f9913fff640) at pthread_create.c:463
#28 0x00007f9a614ed89f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Comment 7 Олег Щавелев 2023-11-02 11:08:27 MSK
(Ответ для Vitaly Lipatov на комментарий #6)
> (gdb) bt
> #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
> #1  0x00007f9a61414538 in __GI_abort () at abort.c:79
> #2  0x00007f9a6146cee7 in __libc_message (action=action@entry=do_abort,
> fmt=fmt@entry=0x7f9a6157d395 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
> #3  0x00007f9a614749bc in malloc_printerr (str=str@entry=0x7f9a6157f7f8
> "free(): invalid next size (fast)") at malloc.c:5389
> #4  0x00007f9a61475e04 in _int_free (av=0x7f98dc000020, p=0x7f98dc045e10,
> have_lock=0) at malloc.c:4281
> #5  0x000055ce9edd5d3f in ?? ()
> #6  0x000055ce9edd5dbd in ?? ()
> #7  0x00007f9a65c1e6be in
> cricket::BasicPortAllocatorSession::~BasicPortAllocatorSession
> (this=0x7f98dc0066d0, __in_chrg=<optimized out>) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/client/basic_port_allocator.cc:304
> #8  0x00007f9a65c1eae9 in
> cricket::BasicPortAllocatorSession::~BasicPortAllocatorSession
> (this=0x7f98dc0066d0, __in_chrg=<optimized out>) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/client/basic_port_allocator.cc:310
> #9  0x00007f9a65be0b27 in
> std::default_delete<cricket::PortAllocatorSession>::operator()
> (__ptr=<optimized out>, this=0x7f98dc008ef0) at
> /usr/include/c++/10/bits/unique_ptr.h:79
> #10 std::unique_ptr<cricket::PortAllocatorSession,
> std::default_delete<cricket::PortAllocatorSession> >::~unique_ptr
> (this=0x7f98dc008ef0, __in_chrg=<optimized out>) at
> /usr/include/c++/10/bits/unique_ptr.h:361
> #11 std::destroy_at<std::unique_ptr<cricket::PortAllocatorSession,
> std::default_delete<cricket::PortAllocatorSession> > >
> (__location=0x7f98dc008ef0) at /usr/include/c++/10/bits/stl_construct.h:88
> #12 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession,
> std::default_delete<cricket::PortAllocatorSession> > >
> (__pointer=0x7f98dc008ef0) at /usr/include/c++/10/bits/stl_construct.h:138
> #13
> std::_Destroy_aux<false>::__destroy<std::unique_ptr<cricket::
> PortAllocatorSession, std::default_delete<cricket::PortAllocatorSession> >*>
> (__last=<optimized out>, __first=0x7f98dc008ef0)
>     at /usr/include/c++/10/bits/stl_construct.h:152
> #14 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession,
> std::default_delete<cricket::PortAllocatorSession> >*> (__last=<optimized
> out>, __first=<optimized out>) at
> /usr/include/c++/10/bits/stl_construct.h:185
> #15 std::_Destroy<std::unique_ptr<cricket::PortAllocatorSession,
> std::default_delete<cricket::PortAllocatorSession> >*,
> std::unique_ptr<cricket::PortAllocatorSession,
> std::default_delete<cricket::PortAllocatorSession> > > (
>     __last=0x7f98dc008ef8, __first=<optimized out>) at
> /usr/include/c++/10/bits/alloc_traits.h:738
> #16 std::vector<std::unique_ptr<cricket::PortAllocatorSession,
> std::default_delete<cricket::PortAllocatorSession> >,
> std::allocator<std::unique_ptr<cricket::PortAllocatorSession,
> std::default_delete<cricket::PortAllocatorSession> > > >::~vector
> (this=0x7f98dc008b00, __in_chrg=<optimized out>) at
> /usr/include/c++/10/bits/stl_vector.h:680
> #17 cricket::P2PTransportChannel::~P2PTransportChannel (this=0x7f98dc0086a0,
> __in_chrg=<optimized out>) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/base/p2p_transport_channel.cc:211
> #18 0x00007f9a65be0c89 in cricket::P2PTransportChannel::~P2PTransportChannel
> (this=0x7f98dc0086a0, __in_chrg=<optimized out>) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/p2p/base/p2p_transport_channel.cc:220
> #19 0x000055ce9ecad132 in ?? ()
> #20 0x000055ce9ecad6dd in ?? ()
> #21 0x000055ce9eca096a in ?? ()
> #22 0x00007f9a6576c519 in rtc::Thread::QueuedTaskHandler::OnMessage
> (this=<optimized out>, msg=<optimized out>) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:1031
> #23 0x00007f9a6576cdf1 in rtc::Thread::Dispatch (this=0x7f98e40040d0,
> pmsg=0x7f9913ffe3d0) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:700
> #24 0x00007f9a6576c197 in rtc::Thread::ProcessMessages
> (this=this@entry=0x7f98e40040d0, cmsLoop=cmsLoop@entry=-1) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:1144
> #25 0x00007f9a6576c274 in rtc::Thread::Run (this=0x7f98e40040d0) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:890
> #26 rtc::Thread::PreRun (pv=0x7f98e40040d0) at
> /usr/src/debug/libowt-tg-4.3.0.7/src/rtc_base/thread.cc:879
> #27 0x00007f9a652afeae in start_thread (arg=0x7f9913fff640) at
> pthread_create.c:463
> #28 0x00007f9a614ed89f in clone () at
> ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Виталий, вы можете воспроизвести проблему, описанную в репорте в текущей версии telegram-desktop-4.11.2-alt1.x86_64?
Comment 8 Vitaly Lipatov 2023-11-02 12:57:49 MSK
(Ответ для Олег Щавелев на комментарий #7)
...
> Виталий, вы можете воспроизвести проблему, описанную в репорте в текущей
> версии telegram-desktop-4.11.2-alt1.x86_64?

На новой версии не воспроизводится.