[Home]

Summary:ASTERISK-13369: core dump on pri_schedule_event
Reporter:Ricardo Villa (ricvil)Labels:
Date Opened:2009-01-14 17:14:49.000-0600Date Closed:2011-06-07 14:03:06
Priority:MajorRegression?No
Status:Closed/CompleteComponents:Channels/chan_dahdi
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:
Description:This is the 3rd time in a week that this Asterisk has core dumped.  Always on the same pri_schedule_event.  I have recompiled with DONT_OPTIMZE, DEBUG_CHANNEL_LOCK, and DEBUG_THREADS.  
Version is 1.4.22 and libpri is 1.4.7.

Here is the 'bt' and 'bt full'.  I can also attach the 'thread apply all bt' if necessary.

# gdb asterisk /tmp/core.xxx.net-2009-01-14T10:31:51-0500
GNU gdb Red Hat Linux (6.5-37.el5rh)
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1".
warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcap.so.1...done.
Loaded symbols for /lib/libcap.so.1
Reading symbols from /lib/libpthread.so.0...done.
Loaded symbols for /lib/libpthread.so.0
.
.
.
Reading symbols from /usr/lib/asterisk/modules/app_settransfercapability.so...done.
Loaded symbols for /usr/lib/asterisk/modules/app_settransfercapability.so
Reading symbols from /lib/libgcc_s.so.1...done.
Loaded symbols for /lib/libgcc_s.so.1
Core was generated by `/usr/sbin/asterisk -f -vvvg -c'.
Program terminated with signal 11, Segmentation fault.
#0  0x00f5061e in pri_schedule_event (pri=0x15, ms=0, function=0xf4e0e6 <t200_expire>, data=0x86729b8) at prisched.c:44
44              while (pri->master)

(gdb) bt
#0  0x00f5061e in pri_schedule_event (pri=0x15, ms=0, function=0xf4e0e6 <t200_expire>, data=0x86729b8) at prisched.c:44
#1  0x00f4e8c2 in q921_transmit_iframe (pri=0x86729b8, buf=0x48e8880, len=14, cr=1) at q921.c:513
#2  0x00f56d62 in q931_xmit (pri=0x86729b8, h=0x48e8880, len=14, cr=1) at q931.c:2606
#3  0x00f56f5b in send_message (pri=0x83e8bd0, c=0x84f0130, msgtype=7, ies=0xf6d6ac) at q931.c:2649
#4  0x00f57c89 in q931_connect (pri=0x83e8bd0, c=0x84f0130, channel=0, nonisdn=1) at q931.c:2918
ASTERISK-1  0x00f4c2f6 in pri_answer (pri=0x83e8bd0, call=0x84f0130, channel=0, nonisdn=1) at pri.c:533
ASTERISK-2  0x06c2b56e in dahdi_answer (ast=0x87f8b58) at chan_dahdi.c:2906
ASTERISK-3  0x08087db2 in ast_answer (chan=0x87f8b58) at channel.c:1557
ASTERISK-4  0x00736f6b in ast_bridge_call (chan=0x87f8b58, peer=0x851df48, config=0x48e9200) at res_features.c:1448
ASTERISK-5  0x00960057 in dial_exec_full (chan=0x87f8b58, data=0x48ebf48, peerflags=0x48e9e14, continue_exec=0x0) at app_dial.c:1780
ASTERISK-6 0x00960ada in dial_exec (chan=0x87f8b58, data=0x48ebf48) at app_dial.c:1834
ASTERISK-7 0x080d01ca in pbx_exec (c=0x87f8b58, app=0xb7d20b60, data=0x48ebf48) at pbx.c:537
ASTERISK-8 0x080d3f25 in pbx_extension_helper (c=0x87f8b58, con=0x0, context=0x87f8d98 "arbinet_value2", exten=0x87f8de8 "012124274450", priority=1, label=0x0,
   callerid=0x85674b8 "7186849117", action=E_SPAWN) at pbx.c:1862
ASTERISK-9 0x080d526a in ast_spawn_extension (c=0x87f8b58, context=0x87f8d98 "arbinet_value2", exten=0x87f8de8 "012124274450", priority=1,
   callerid=0x85674b8 "7186849117") at pbx.c:2317
ASTERISK-10 0x080d569a in __ast_pbx_run (c=0x87f8b58) at pbx.c:2406
ASTERISK-11 0x080d6495 in pbx_thread (data=0x87f8b58) at pbx.c:2621
ASTERISK-12 0x08119e13 in dummy_start (data=0x83f0310) at utils.c:912
ASTERISK-13 0x0067946b in start_thread () from /lib/libpthread.so.0
ASTERISK-14 0x005d0dbe in clone () from /lib/libc.so.6

(gdb) bt full
#0  0x00f5061e in pri_schedule_event (pri=0x15, ms=0, function=0xf4e0e6 <t200_expire>, data=0x86729b8) at prisched.c:44
       x = 133504
       tv = {tv_sec = 142624384, tv_usec = 36}
#1  0x00f4e8c2 in q921_transmit_iframe (pri=0x86729b8, buf=0x48e8880, len=14, cr=1) at q921.c:513
       f = (q921_frame *) 0x8645148
       prev = (q921_frame *) 0x0
#2  0x00f56d62 in q931_xmit (pri=0x86729b8, h=0x48e8880, len=14, cr=1) at q931.c:2606
No locals.
#3  0x00f56f5b in send_message (pri=0x83e8bd0, c=0x84f0130, msgtype=7, ies=0xf6d6ac) at q931.c:2649
       buf = "\b\002\204h\a\030\003©\203\224\036\002\201\202\036", '\0' <repeats 1008 times>
       h = (q931_h *) 0x48e8880
       mh = (q931_mh *) 0x48e8884
       len = 14
       res = 4
       offset = 9
       x = 2
       codeset = 0
#4  0x00f57c89 in q931_connect (pri=0x83e8bd0, c=0x84f0130, channel=0, nonisdn=1) at q931.c:2918
       __PRETTY_FUNCTION__ = "q931_connect"
ASTERISK-1  0x00f4c2f6 in pri_answer (pri=0x83e8bd0, call=0x84f0130, channel=0, nonisdn=1) at pri.c:533
No locals.
ASTERISK-2  0x06c2b56e in dahdi_answer (ast=0x87f8b58) at chan_dahdi.c:2906
       p = (struct dahdi_pvt *) 0x83df638
       res = 0
       index = 0
       oldstate = 4
       __PRETTY_FUNCTION__ = "dahdi_answer"
ASTERISK-3  0x08087db2 in ast_answer (chan=0x87f8b58) at channel.c:1557
       res = 0
       __PRETTY_FUNCTION__ = "ast_answer"
ASTERISK-4  0x00736f6b in ast_bridge_call (chan=0x87f8b58, peer=0x851df48, config=0x48e9200) at res_features.c:1448
       f = (struct ast_frame *) 0x48e9234
       who = (struct ast_channel *) 0x87f8de8
       chan_featurecode = '\0' <repeats 11 times>
       peer_featurecode = '\0' <repeats 11 times>
       orig_channame = "5}\024\b\201\210\024\bØ\216\216\004\220Èg\0008\217\216\004~=\b\bÐ\213\177\b(­u\bH\217\216\004\2309\b\bÐ\213\177\b4}\024\b%\006\000\000Ì\225\024\b\000ýH\bÐ\213\177\bH\217\216\004Y\"\t\b\t\000\000\000\200\210\024\b"
       orig_peername = "¨\216\216\004j|\021\b\234Äg\000\217\222\021\b¸\216\216\004\001\000\000\000\000\000\000\000\220ë\216\0045}\024\b\201\210\024\b¨\216\216\004\220Èg\000Ø\216\216\004\221\230\021\b\234Äg\000(\b\000\0005}\024\b\001\000\000\000È\216\216\004\220ë\216\004"
       res = 76451704
       diff = 134816345
       hasfeatures = 0
       hadfeatures = 0
       aoh = (struct ast_option_header *) 0x11fd
       backup_config = {features_caller = {flags = 0}, features_callee = {flags = 0}, start_time = {tv_sec = 0, tv_usec = 0}, feature_timer = 0,
 timelimit = 0, play_warning = 0, warning_freq = 0, warning_sound = 0x0, end_sound = 0x0, start_sound = 0x0, firstpass = 0, flags = 0}
       bridge_cdr = (struct ast_cdr *) 0x0
       orig_peer_cdr = (struct ast_cdr *) 0x0
       __PRETTY_FUNCTION__ = "ast_bridge_call"
ASTERISK-5  0x00960057 in dial_exec_full (chan=0x87f8b58, data=0x48ebf48, peerflags=0x48e9e14, continue_exec=0x0) at app_dial.c:1780
       config = {features_caller = {flags = 1}, features_callee = {flags = 0}, start_time = {tv_sec = 1231947111, tv_usec = 279084}, feature_timer = 0,
 timelimit = 7180000, play_warning = 60000, warning_freq = 30000, warning_sound = 0x84047eb "1", end_sound = 0x84e12f3 "1", start_sound = 0x0,
 firstpass = 1, flags = 0}
       number = 0x846afc1 "550512124274450@arbinet_B"
       end_time = 76454336
       answer_time = 1231947111
       res = 0
       u = (struct ast_module_user *) 0x84bd9f0
       rest = 0x0
       cur = 0x0
       outgoing = (struct dial_localuser *) 0x0
       peer = (struct ast_channel *) 0x851df48
       to = 57269
       numbusy = 0
       numcongestion = 0
       numnochan = 0
       cause = 0
       numsubst = "550512124274450@arbinet_B\000\216\004C\235\216\004ô\234\216\004C\235\216\004", '\0' <repeats 20 times>, "?\000\000\000\000\000\000\000ôïc1\000\000\000\000\000\000\000\000d\233\216\004\237(V\000ÿÿÿ1\210\233\216\004\000\000\000\000ÿÿÿÿ\024PV\000ÿÿÿÿ\000\000\000\000ôïc\000\000\000\000\000\000\000\000\000½bV\000\024\235\216\004Jan 14 10:31:27\000@éc\000\000\000\000\000\001\000\000\000\000Pö·@\000\000\000Àôc\000Àôc\000è\233\216\004\024PV\000Àôc\000\000Pö·ôïc\000\000\000\000\000\000\000\000\000½b"...
       cidname = '\0' <repeats 79 times>
       privdb_val = 0
       calldurationlimit = 0
       timelimit = 7180000
       play_warning = 60000
       warning_freq = 30000
       warning_sound = 0x84047eb "1"
       end_sound = 0x84e12f3 "1"
       start_sound = 0x0
       dtmfcalled = 0x0
       dtmfcalling = 0x0
       status = "ANSWER\000R\000GS", '\0' <repeats 244 times>
       play_to_caller = 1
       play_to_callee = 0
       sentringing = 0
       moh = 0
       outbound_group = 0x0
       result = 0
       start_time = 1231947087
       privintro = "\000\000\000\000 \027F\b¨\236\216\004K\000\000\000\000\000\000\000\237\235\216d\a\000\000\000\000\000\000\000ôïc\000\236\235\216\004\001\000\000\000ø\233\216\004±¾S\000\034\234\216\004ô\225\216\004ôïc\000d\226\216\004C\004\\\000ôïc\000\b\227\216\004\2205X\000\003\000\000\000\231Jb\000d\226\216\004(\226\216\004d\233\216\004\237»S\000sQV\000q\235\216\004!\214V\000.\000\000\000\236iU\000þ«\025\b\001\000\000\000q\235\216\004\000\000\000\000\033\000\000\000\001\000\000\000H\234\216\004\000\000\000\000\200\234\216\004\001\000\000\000\000\000\000\000m:\026\bsQV\000\030\000\000\000L\001d\000\000ý\000\000\000\000\000\000\000\000\000\000"...
       privcid = "\000\000\000\000m:\026\b\000\000\000\000\017\235\216\004ôïc\000l:\026\b\001\000\000\000è\232\216\004±¾S\000\f\233\216\004l:\026\b\001\000\000\000\000\000\000\000\2163\025\b\a\000\000\000P\233\216\004ôïc\000¦\234\216\004À\232\216\004\030\233\216\004±¾S\000T\232\216\004\237»S\000ôïc\000\000\000\000\000\000\000\000\000+\000\000\000W:\026\bì\231\216\004\000\000\000\000\000\000\000\000ÿÿÿÿ\000\000\000\000\2163\025\b\002\232\216\004 \233\216\004", '\0' <repeats 36 times>, "ÿÿÿÿk:\026\bW:\026\b\006\000\000\000\035", '\0' <repeats 15 times>, "\n\000\000\000R\232\216\004", '\0' <repeats 35 times>
       parse = 0x48e9010 "SIP"
       opermode = 0
       args = {argc = 3, argv = 0x48e9498, peers = 0x48e9010 "SIP", timeout = 0x48e902e "80", options = 0x48e9031 "L(7180000", url = 0x0}
       opts = {flags = 512}
       opt_args = {0x0, 0x0, 0x0, 0x48e9033 "7180000", 0x0, 0x0, 0x20 <Address 0x20 out of bounds>, 0x0, 0x1d <Address 0x1d out of bounds>}
       datastore = (struct ast_datastore *) 0x83655f0
       ds_caller_features = (struct ast_datastore *) 0x8568aa8
       ds_callee_features = (struct ast_datastore *) 0x85b3800
       caller_features = (struct ast_dial_features *) 0x8461818
       fulldial = 0
       num_dialed = 1
       __PRETTY_FUNCTION__ = "dial_exec_full"
ASTERISK-6 0x00960ada in dial_exec (chan=0x87f8b58, data=0x48ebf48) at app_dial.c:1834
       peerflags = {flags = 0}
ASTERISK-7 0x080d01ca in pbx_exec (c=0x87f8b58, app=0xb7d20b60, data=0x48ebf48) at pbx.c:537
       res = 76463944
       saved_c_appl = 0x0
       saved_c_data = 0x0
ASTERISK-8 0x080d3f25 in pbx_extension_helper (c=0x87f8b58, con=0x0, context=0x87f8d98 "arbinet_value2", exten=0x87f8de8 "012124274450", priority=1, label=0x0,
   callerid=0x85674b8 "7186849117", action=E_SPAWN) at pbx.c:1862
       e = (struct ast_exten *) 0xb7dc7730
       app = (struct ast_app *) 0xb7d20b60
       res = 76475280
       q = {incstack = {0x0 <repeats 128 times>}, stacklen = 0, status = 5, swo = 0x0, data = 0x0, foundcontext = 0x87f8d98 "arbinet_value2"}
       passdata = "SIP/550512124274450@arbinet_B|80|L(7180000:60000:30000)", '\0' <repeats 8136 times>
       matching_action = 0
       __PRETTY_FUNCTION__ = "pbx_extension_helper"
ASTERISK-9 0x080d526a in ast_spawn_extension (c=0x87f8b58, context=0x87f8d98 "arbinet_value2", exten=0x87f8de8 "012124274450", priority=1,
   callerid=0x85674b8 "7186849117") at pbx.c:2317
No locals.
ASTERISK-10 0x080d569a in __ast_pbx_run (c=0x87f8b58) at pbx.c:2406
       dst_exten = "(­u\bÌ¡V\000(­u\b\000\000\000\000,\b\000\000@\001d\000\200F\200\b(\b\000\000\200\t\002\000ô\177h\000u/\024\bÍ/\024\bXâ\216\004<z\021\b\001\000\000\000(\b", '\0' <repeats 18 times>, "\020\000\000\000ÚÞg\000\000\000\000\000\000\000\000\000Pã\216\004UÞg\000\220ë\216\004¡³g\000\210â\216\004!\214V\000\234Äg\000\217\222\021\b\230â\216\004\001\000\000\000\234Äg\000\220ë\216\004u/\024\bÍ/\024\b\210â\216\004\220Èg\000¸â\216\004\221\230\021\bp\001d\000(\b\000\000u/\024\bH\000\000\000d\001d\000\220ë\216\004u/\024\bÍ/\024\b¸â\216\004\220Èg\000"...
       pos = 0
       digit = 0
       found = 1
       res = 0
       autoloopflag = 0
       error = 0
       __PRETTY_FUNCTION__ = "__ast_pbx_run"
ASTERISK-11 0x080d6495 in pbx_thread (data=0x87f8b58) at pbx.c:2621
       c = (struct ast_channel *) 0x87f8b58
ASTERISK-12 0x08119e13 in dummy_start (data=0x83f0310) at utils.c:912
       __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {6848500, 0, 76475280, 76473288, -1091513198, -1301304621}, __mask_was_saved = 0}},
 __pad = {0x48ee480, 0x0, 0x8461ac8, 0x87e88b0}}
       __cancel_routine = (void (*)(void *)) 0x806ab43 <ast_unregister_thread>
       __cancel_arg = (void *) 0x48eeb90
       not_first_call = 0
       ret = (void *) 0x678b8c
       a = {start_routine = 0x80d647e <pbx_thread>, data = 0x87f8b58,
 name = 0x8712378 "pbx_thread", ' ' <repeats 11 times>, "started at [ 2645] pbx.c ast_pbx_start()"}
       lock_info = (struct thr_lock_info *) 0x875ad28
       mutex_attr = {__size = "\001\000\000", __align = 1}
ASTERISK-13 0x0067946b in start_thread () from /lib/libpthread.so.0
No symbol table info available.
ASTERISK-14 0x005d0dbe in clone () from /lib/libc.so.6
No symbol table info available.
(gdb)
Comments:By: Ricardo Villa (ricvil) 2009-01-14 20:15:58.000-0600

I just had another core dump a few minutes ago on q921_transmit_iframe.  Here is the 'bt'.

Core was generated by `/usr/sbin/asterisk -f -vvvg -c'.
Program terminated with signal 11, Segmentation fault.
#0  0x00e3c57f in q921_transmit_iframe (pri=0xb7b00338, buf=0x1c54b50, len=9, cr=1) at q921.c:459
459             for (f=pri->txqueue; f; f = f->next) prev = f;
(gdb) bt
#0  0x00e3c57f in q921_transmit_iframe (pri=0xb7b00338, buf=0x1c54b50, len=9, cr=1) at q921.c:459
#1  0x00e44d62 in q931_xmit (pri=0xb7b00338, h=0x1c54b50, len=9, cr=1) at q931.c:2606
#2  0x00e44f5b in send_message (pri=0x95ad100, c=0xb7b6f5e0, msgtype=69, ies=0xe5b6d0) at q931.c:2649
#3  0x00e4612a in q931_disconnect (pri=0x95ad100, c=0xb7b6f5e0, cause=16) at q931.c:2984
#4  0x00e46a98 in q931_hangup (pri=0x95ad100, c=0xb7b6f5e0, cause=16) at q931.c:3194
ASTERISK-1  0x00e3a4bf in pri_hangup (pri=0x95ad100, call=0xb7b6f5e0, cause=16) at pri.c:605
ASTERISK-2  0x044d5851 in dahdi_hangup (ast=0xb7b71420) at chan_dahdi.c:2718
ASTERISK-3  0x08087ae3 in ast_hangup (chan=0xb7b71420) at channel.c:1507
ASTERISK-4  0x080d6245 in __ast_pbx_run (c=0xb7b71420) at pbx.c:2561
ASTERISK-5  0x080d6495 in pbx_thread (data=0xb7b71420) at pbx.c:2621
ASTERISK-6 0x08119e13 in dummy_start (data=0xb7b6a730) at utils.c:912
ASTERISK-7 0x0067946b in start_thread () from /lib/libpthread.so.0
ASTERISK-8 0x005d0dbe in clone () from /lib/libc.so.6
(gdb) bt all
No symbol "all" in current context.
(gdb) bt full
#0  0x00e3c57f in q921_transmit_iframe (pri=0xb7b00338, buf=0x1c54b50, len=9, cr=1) at q921.c:459
       f = (q921_frame *) 0xa5a425ff
       prev = (q921_frame *) 0xa5a425ff
#1  0x00e44d62 in q931_xmit (pri=0xb7b00338, h=0x1c54b50, len=9, cr=1) at q931.c:2606
No locals.
#2  0x00e44f5b in send_message (pri=0x95ad100, c=0xb7b6f5e0, msgtype=69, ies=0xe5b6d0) at q931.c:2649
       buf = "\b\002\2038E\b\002\201\220~", '\0' <repeats 1013 times>
       h = (q931_h *) 0x1c54b50
       mh = (q931_mh *) 0x1c54b54
       len = 9
       res = 0
       offset = 4
       x = 2
       codeset = 0
#3  0x00e4612a in q931_disconnect (pri=0x95ad100, c=0xb7b6f5e0, cause=16) at q931.c:2984
       __PRETTY_FUNCTION__ = "q931_disconnect"
#4  0x00e46a98 in q931_hangup (pri=0x95ad100, c=0xb7b6f5e0, cause=16) at q931.c:3194
       disconnect = 1
       release_compl = 0
ASTERISK-1  0x00e3a4bf in pri_hangup (pri=0x95ad100, call=0xb7b6f5e0, cause=16) at pri.c:605
No locals.
ASTERISK-2  0x044d5851 in dahdi_hangup (ast=0xb7b71420) at chan_dahdi.c:2718
       cause = 0x0
       icause = 16
       res = 0
       index = 0
       x = 0
       law = 0
       p = (struct dahdi_pvt *) 0x959e050
       tmp = (struct dahdi_pvt *) 0x0
       prev = (struct dahdi_pvt *) 0x0
       par = {channo = 6800540, spanno = 6801552, chanpos = 6797553, sigtype = 1, sigcap = 6800540, rxisoffhook = 248, rxbits = 16, txbits = 6448764, txhooksig = 29708424,
 rxhooksig = 6801552, curlaw = 29708440, idlebits = 135297511, name = "8Ô¶·\220Èg\000øPÅ\001Æy\020\bxÓ¶·\f.\026\b\\\000\000\0004.\026\bJ.\026\bôïc",
 prewinktime = -1213202416, preflashtime = -1212755080, winktime = 29708536, flashtime = 5685360, starttime = -1213202416, rxwinktime = -1212755080, rxflashtime = 9,
 debouncetime = 135671406, pulsebreaktime = 135671308, pulsemaketime = -1213202432, pulseaftertime = 135721192, chan_alarms = 0}
       __PRETTY_FUNCTION__ = "dahdi_hangup"
ASTERISK-3  0x08087ae3 in ast_hangup (chan=0xb7b71420) at channel.c:1507
       res = 0
       __PRETTY_FUNCTION__ = "ast_hangup"
ASTERISK-4  0x080d6245 in __ast_pbx_run (c=0xb7b71420) at pbx.c:2561
       found = 1
       res = -1
       autoloopflag = 0
       error = 1
       __PRETTY_FUNCTION__ = "__ast_pbx_run"
ASTERISK-5  0x080d6495 in pbx_thread (data=0xb7b71420) at pbx.c:2621
       c = (struct ast_channel *) 0xb7b71420
ASTERISK-6 0x08119e13 in dummy_start (data=0xb7b6a730) at utils.c:912
       __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {6848500, 0, 29711248, 29709256, 1127095624, 1257952009}, __mask_was_saved = 0}}, __pad = {0x1c55480, 0x0,
   0x98960c8, 0x98c0b48}}
---Type <return> to continue, or q <return> to quit---
       __cancel_routine = (void (*)(void *)) 0x806ab43 <ast_unregister_thread>
       __cancel_arg = (void *) 0x1c55b90
       not_first_call = 0
       ret = (void *) 0x678b8c
       a = {start_routine = 0x80d647e <pbx_thread>, data = 0xb7b71420, name = 0xb7b6b8a8 "pbx_thread", ' ' <repeats 11 times>, "started at [ 2645] pbx.c ast_pbx_start()"}
       lock_info = (struct thr_lock_info *) 0x98a98a8
       mutex_attr = {__size = "\001\000\000", __align = 1}
ASTERISK-7 0x0067946b in start_thread () from /lib/libpthread.so.0
No symbol table info available.
ASTERISK-8 0x005d0dbe in clone () from /lib/libc.so.6
No symbol table info available.
By: Ricardo Villa (ricvil) 2009-01-26 10:43:03.000-0600

I upgraded to libpri 1.4.9 and the problem still happens.  Here is the latest crash:

Program terminated with signal 11, Segmentation fault.
#0  0x009d6ce2 in pri_schedule_event (pri=0x12, ms=0, function=0x9d43a4 <t200_expire>, data=0xb7a502e0) at prisched.c:44
44              while (pri->master)

(gdb) bt
#0  0x009d6ce2 in pri_schedule_event (pri=0x12, ms=0, function=0x9d43a4 <t200_expire>, data=0xb7a502e0) at prisched.c:44
#1  0x009d3c0f in reschedule_t200 (pri=0xb7a502e0) at q921.c:259
#2  0x009d4ba7 in q921_transmit_iframe (pri=0xb7a502e0, buf=0x5725b50, len=9, cr=1) at q921.c:537
#3  0x009dd489 in q931_xmit (pri=0xb7a502e0, h=0x5725b50, len=9, cr=1) at q931.c:2611
#4  0x009dd682 in send_message (pri=0xb7d73540, c=0xb7a383a0, msgtype=69, ies=0x9f501c) at q931.c:2654
ASTERISK-1  0x009de935 in q931_disconnect (pri=0xb7d73540, c=0xb7a383a0, cause=16) at q931.c:3020
ASTERISK-2  0x009df2a3 in q931_hangup (pri=0xb7d73540, c=0xb7a383a0, cause=16) at q931.c:3230
ASTERISK-3  0x009d2693 in pri_hangup (pri=0xb7d73540, call=0xb7a383a0, cause=16) at pri.c:623
ASTERISK-4  0x012e9851 in dahdi_hangup (ast=0xb7a0b9a8) at chan_dahdi.c:2718
ASTERISK-5  0x08087ae3 in ast_hangup (chan=0xb7a0b9a8) at channel.c:1507
ASTERISK-6 0x080d6245 in __ast_pbx_run (c=0xb7a0b9a8) at pbx.c:2561
ASTERISK-7 0x080d6495 in pbx_thread (data=0xb7a0b9a8) at pbx.c:2621
ASTERISK-8 0x08119e13 in dummy_start (data=0xb7a6d360) at utils.c:912
ASTERISK-9 0x0067946b in start_thread () from /lib/libpthread.so.0
ASTERISK-10 0x005d0dbe in clone () from /lib/libc.so.6

(gdb) bt full
#0  0x009d6ce2 in pri_schedule_event (pri=0x12, ms=0, function=0x9d43a4 <t200_expire>, data=0xb7a502e0) at prisched.c:44
       x = 91380392
       tv = {tv_sec = -1215299568, tv_usec = 134000}
#1  0x009d3c0f in reschedule_t200 (pri=0xb7a502e0) at q921.c:259
No locals.
#2  0x009d4ba7 in q921_transmit_iframe (pri=0xb7a502e0, buf=0x5725b50, len=9, cr=1) at q921.c:537
       f = (q921_frame *) 0xb79354e0
       prev = (q921_frame *) 0x0
#3  0x009dd489 in q931_xmit (pri=0xb7a502e0, h=0x5725b50, len=9, cr=1) at q931.c:2611
No locals.
#4  0x009dd682 in send_message (pri=0xb7d73540, c=0xb7a383a0, msgtype=69, ies=0x9f501c) at q931.c:2654
       buf = "\b\002\203@E\b\002\201\220~", '\0' <repeats 1013 times>
       h = (q931_h *) 0x5725b50
       mh = (q931_mh *) 0x5725b54
       len = 9
       res = 0
       offset = 4
       x = 2
       codeset = 0
ASTERISK-1  0x009de935 in q931_disconnect (pri=0xb7d73540, c=0xb7a383a0, cause=16) at q931.c:3020
       __PRETTY_FUNCTION__ = "q931_disconnect"
ASTERISK-2  0x009df2a3 in q931_hangup (pri=0xb7d73540, c=0xb7a383a0, cause=16) at q931.c:3230
       disconnect = 1
       release_compl = 0
ASTERISK-3  0x009d2693 in pri_hangup (pri=0xb7d73540, call=0xb7a383a0, cause=16) at pri.c:623
No locals.
ASTERISK-4  0x012e9851 in dahdi_hangup (ast=0xb7a0b9a8) at chan_dahdi.c:2718
       cause = 0x0
       icause = 16
       res = 0
       index = 0
       x = 0
       law = 0
       p = (struct dahdi_pvt *) 0xb7d569d8
       tmp = (struct dahdi_pvt *) 0x0
       prev = (struct dahdi_pvt *) 0x0
       par = {channo = 6800540, spanno = 6801552, chanpos = 6797553, sigtype = 1, sigcap = 6800540, rxisoffhook = 264, rxbits = 16,
 txbits = 6448764, txhooksig = 91381896, rxhooksig = 6801552, curlaw = 91381912, idlebits = 135297511,
 name = "Xµ¦·\220Èg\000ø`r\005Æy\020\b\230´¦·\f.\026\b\\\000\000\0004.\026\bJ.\026\bôïc", prewinktime = -1214250992,
 preflashtime = -1213811560, winktime = 91382008, flashtime = 5685360, starttime = -1214250992, rxwinktime = -1213811560, rxflashtime = 9,
 debouncetime = 135671406, pulsebreaktime = 135671308, pulsemaketime = -1214251008, pulseaftertime = 151821184, chan_alarms = 0}
       __PRETTY_FUNCTION__ = "dahdi_hangup"
ASTERISK-5  0x08087ae3 in ast_hangup (chan=0xb7a0b9a8) at channel.c:1507
       res = 0
       __PRETTY_FUNCTION__ = "ast_hangup"
ASTERISK-6 0x080d6245 in __ast_pbx_run (c=0xb7a0b9a8) at pbx.c:2561
       found = 1
       res = -1
       autoloopflag = 0
       error = 1
       __PRETTY_FUNCTION__ = "__ast_pbx_run"
ASTERISK-7 0x080d6495 in pbx_thread (data=0xb7a0b9a8) at pbx.c:2621
       c = (struct ast_channel *) 0xb7a0b9a8
ASTERISK-8 0x08119e13 in dummy_start (data=0xb7a6d360) at utils.c:912
       __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {6848500, 0, 91384720, 91382728, -2088642970, -1897781209},
     __mask_was_saved = 0}}, __pad = {0x5726480, 0x0, 0x94daec0, 0x9309c30}}
       __cancel_routine = (void (*)(void *)) 0x806ab43 <ast_unregister_thread>
       __cancel_arg = (void *) 0x5726b90
       not_first_call = 0
       ret = (void *) 0x678b8c
       a = {start_routine = 0x80d647e <pbx_thread>, data = 0xb7a0b9a8,
 name = 0xb7a51048 "pbx_thread", ' ' <repeats 11 times>, "started at [ 2645] pbx.c ast_pbx_start()"}
       lock_info = (struct thr_lock_info *) 0x94daec0
       mutex_attr = {__size = "\001\000\000", __align = 1}
ASTERISK-9 0x0067946b in start_thread () from /lib/libpthread.so.0
No symbol table info available.
ASTERISK-10 0x005d0dbe in clone () from /lib/libc.so.6
No symbol table info available.
(gdb)
By: Ricardo Villa (ricvil) 2009-01-26 11:00:20.000-0600

I am reopening case under the LibPRI project.  http://bugs.digium.com/view.php?id=14335.

You can close this case since it really did not belong here.
By: Joshua C. Colp (jcolp) 2009-03-04 14:15:26.000-0600

Closed per reporter.