Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash when call freeRTOS API prvTaskDeleteWithCapsTask #8

Open
3 tasks
TempoTian opened this issue Feb 7, 2025 · 0 comments
Open
3 tasks

Crash when call freeRTOS API prvTaskDeleteWithCapsTask #8

TempoTian opened this issue Feb 7, 2025 · 0 comments

Comments

@TempoTian
Copy link
Contributor

TempoTian commented Feb 7, 2025

Checklist

  • Checked the issue tracker for similar issues to ensure this is not a duplicate.
  • Provided a clear description of your suggestion.
  • Included any relevant context or examples.

Issue or Suggestion Description

Added as a reminder for users encountering this issue.
It can be easily reproduced when running video-related demos such as doorbell_demo and videocall_demo. The crash log is as follows:

assert failed: tlsf_free tlsf.c:629 (!block_is_free(block) && "block already marked as free")
HINT: CORRUPT HEAP: heap metadata corrupted resulting in TLSF malfunction.
Make sure you are not making out of bound writing on the memory you allocate in your application.
Make sure you are not writing on freed memory.
For more information run 'idf.py docs -sp api-reference/system/heap_debug.html'.
--- Stack dump detected
Core  1 register dump:
MEPC    : 0x4ff00d0c  RA      : 0x4ff0d830  SP      : 0x4ff3b980  GP      : 0x4ff19380  
--- 0x4ff00d0c: panic_abort at /home/tempo/esp/master/esp-idf/components/esp_system/panic.c:468
0x4ff0d830: __ubsan_include at /home/tempo/esp/master/esp-idf/components/esp_system/ubsan.c:311

TP      : 0x4ff3bb50  T0      : 0x37363534  T1      : 0x7271706f  T2      : 0x33323130  
S0/FP   : 0x0000006a  S1      : 0x00000001  A0      : 0x4ff3b9bc  A1      : 0x4ff1cc69  
A2      : 0x00000001  A3      : 0x00000029  A4      : 0x00000001  A5      : 0x4ff21000  
A6      : 0x0000000c  A7      : 0x76757473  S2      : 0x00000009  S3      : 0x4ff3baed  
S4      : 0x4ff1cc68  S5      : 0x00000000  S6      : 0x00000000  S7      : 0x00000000  
S8      : 0x00000000  S9      : 0x00000000  S10     : 0x00000000  S11     : 0x00000000  
T3      : 0x6e6d6c6b  T4      : 0x6a696867  T5      : 0x66656463  T6      : 0x62613938  
MSTATUS : 0x00011880  MTVEC   : 0x4ff00003  MCAUSE  : 0x00000002  MTVAL   : 0x00000000  
--- 0x4ff00003: _vector_table at ??:?

MHARTID : 0x00000001  

--- Backtrace:
add symbol table from file "/home/tempo/test1/esp-webrtc-solution/solutions/videocall_demo/build/bootloader/bootloader.elf"
panic_abort (details=details@entry=0x4ff3b9bc "assert failed: tlsf_free tlsf.c:629 (!block_is_free(block) && \"block already marked as free\")") at /home/tempo/esp/master/esp-idf/components/esp_system/panic.c:468
468	    asm("unimp");   // should be an invalid operation on RISC-V targets
#0  panic_abort (details=details@entry=0x4ff3b9bc "assert failed: tlsf_free tlsf.c:629 (!block_is_free(block) && \"block already marked as free\")") at /home/tempo/esp/master/esp-idf/components/esp_system/panic.c:468
#1  0x4ff0d830 in esp_system_abort (details=details@entry=0x4ff3b9bc "assert failed: tlsf_free tlsf.c:629 (!block_is_free(block) && \"block already marked as free\")") at /home/tempo/esp/master/esp-idf/components/esp_system/port/esp_system_chip.c:92
#2  0x4ff179ba in __assert_func (file=file@entry=0x402009d3 "", line=line@entry=629, func=<optimized out>, func@entry=0x4023ee20 <__func__.6> "", expr=expr@entry=0x40200f64 "") at /home/tempo/esp/master/esp-idf/components/newlib/src/assert.c:80
#3  0x4ff15dcc in tlsf_free (tlsf=0x48000014, ptr=ptr@entry=0x4819e5c0) at /home/tempo/esp/master/esp-idf/components/heap/tlsf/tlsf.c:629
#4  0x4ff159ec in multi_heap_free_impl (heap=0x48000000, p=0x4819e5c0) at /home/tempo/esp/master/esp-idf/components/heap/multi_heap.c:233
#5  0x4ff0119e in heap_caps_free (ptr=<optimized out>) at /home/tempo/esp/master/esp-idf/components/heap/heap_caps_base.c:75
#6  0x401fca5e in prvTaskDeleteWithCaps (xTaskToDelete=0x4ff5f980, xTaskToDelete@entry=<error reading variable: value has been optimized out>) at /home/tempo/esp/master/esp-idf/components/freertos/esp_additions/idf_additions.c:129
#7  0x401fcb0c in prvTaskDeleteWithCapsTa

Cause for such issue is underchecking by IDF members, following is the temprory solution to fix such issue:

  1. Rollback the media lib adapter layer in media_lib_os_freertos.c
static int _thread_create(media_lib_thread_handle_t *handle, const char *name,
                          void(*body)(void *arg), void *arg, uint32_t stack_size,
                          int prio, int core)
{
    StackType_t *task_stack = NULL;
    do {
        task_stack = (StackType_t *) calloc_in_heap(1, stack_size);
        TaskParameters_t xRegParameters = {.pvTaskCode = body,
                                           .pcName = name,
                                           .usStackDepth = stack_size,
                                           .pvParameters = arg,
                                           .uxPriority =
                                               prio | portPRIVILEGE_BIT,
                                           .puxStackBuffer = task_stack,
                                           .xRegions = {{
                                               .pvBaseAddress = 0x00,
                                               .ulLengthInBytes = 0x00,
                                               .ulParameters = 0x00,
                                           }}};
        if (xTaskCreateRestrictedPinnedToCore(
                &xRegParameters, (TaskHandle_t *)handle, core) != pdPASS) {
            ESP_LOGE(TAG, "Error creating RestrictedPinnedToCore %s", name);
            break;
        }
        return ESP_OK;
    } while (0);
    if (task_stack) {
        _free_in_heap(task_stack);
    }
    return ESP_FAIL;
}

static void _thread_destroy(media_lib_thread_handle_t handle)
{
    // allow NULL to destroy self
    vTaskDelete((TaskHandle_t)handle);
}
  1. Run patch_idf.pl to patch for freertos after run export.sh for esp-idf
perl patch_idf.pl
@jason-mao jason-mao pinned this issue Feb 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant