I've been having a few reboots due to aborts. Any ideas on where I might look at for this one which is in the TCPIP stack: //. ---8<------ 0x4008ddae is in invoke_abort (/home/michaelg/esp/esp-idf/components/esp32/panic.c:156). 151 #endif 152 while (1) { 153 if (esp_cpu_in_ocd_debug_mode()) { 154 __asm__ ("break 0,0"); 155 } 156 *((int *) 0) = 0; 157 } 158 } 159 160 void abort() 0x4008e049 is in abort (/home/michaelg/esp/esp-idf/components/esp32/panic.c:171). 166 * don't overwrite that. 167 */ 168 if (esp_reset_reason_get_hint() == ESP_RST_UNKNOWN) { 169 esp_reset_reason_set_hint(ESP_RST_PANIC); 170 } 171 invoke_abort(); 172 } 173 174 175 static const char *edesc[] = { 0x400925ff is in multi_heap_assert (/home/michaelg/esp/esp-idf/components/heap/multi_heap_platform.h:54). 49 #ifndef NDEBUG 50 if(!condition) { 51 #ifndef CONFIG_OPTIMIZATION_ASSERTIONS_SILENT 52 ets_printf(format, line, address); 53 #endif // CONFIG_OPTIMIZATION_ASSERTIONS_SILENT 54 abort(); 55 } 56 #else // NDEBUG 57 (void) condition; 58 #endif // NDEBUG 0x40092629 is in get_prev_free_block (/home/michaelg/esp/esp-idf/components/heap/multi_heap.c:187). 182 static heap_block_t *get_prev_free_block(heap_t *heap, const heap_block_t *block) 183 { 184 assert(!is_first_block(heap, block)); /* can't look for a block before first_block */ 185 186 for (heap_block_t *b = &heap->first_block; b != NULL && b < block; b = b->next_free) { 187 MULTI_HEAP_ASSERT(is_free(b), b); // Block should be free 188 if (b->next_free == NULL || b->next_free >= block) { 189 if (is_free(block)) { 190 /* if block is on freelist, 'b' should be the item before it. */ 191 MULTI_HEAP_ASSERT(b->next_free == block, &b->next_free); 0x40092a9a is in multi_heap_free_impl (/home/michaelg/esp/esp-idf/components/heap/multi_heap.c:484). 479 MULTI_HEAP_ASSERT(!is_first_block(heap, pb), pb); // block should not be first block 480 481 heap_block_t *next = get_next_block(pb); 482 483 /* Update freelist pointers */ 484 heap_block_t *prev_free = get_prev_free_block(heap, pb); 485 // freelist validity check 486 MULTI_HEAP_ASSERT(prev_free->next_free == NULL || prev_free->next_free > pb, &prev_free->next_free); 487 pb->next_free = prev_free->next_free; 488 prev_free->next_free = pb; 0x4009302e is in multi_heap_free (/home/michaelg/esp/esp-idf/components/heap/multi_heap_poisoning.c:225). 220 #ifdef SLOW 221 /* replace everything with FREE_FILL_PATTERN, including the poison head/tail */ 222 memset(head, FREE_FILL_PATTERN, 223 head->alloc_size + POISON_OVERHEAD); 224 #endif 225 multi_heap_free_impl(heap, head); 226 227 multi_heap_internal_unlock(heap); 228 } 229 0x4008449d is in heap_caps_free (/home/michaelg/esp/esp-idf/components/heap/heap_caps.c:268). 263 ptr = (void *)dramAddrPtr[-1]; 264 } 265 266 heap_t *heap = find_containing_heap(ptr); 267 assert(heap != NULL && "free() target pointer is outside heap areas"); 268 multi_heap_free(heap->heap, ptr); 269 } 270 271 IRAM_ATTR void *heap_caps_realloc( void *ptr, size_t size, int caps) 272 { 0x40084a91 is in _free_r (/home/michaelg/esp/esp-idf/components/newlib/syscalls.c:42). 37 return heap_caps_malloc_default( size ); 38 } 39 40 void IRAM_ATTR _free_r(struct _reent *r, void* ptr) 41 { 42 heap_caps_free( ptr ); 43 } 44 45 void* IRAM_ATTR _realloc_r(struct _reent *r, void* ptr, size_t size) 46 { 0x40118a48 is in mem_free (/home/michaelg/esp/esp-idf/components/lwip/lwip/src/core/mem.c:176). 171 LWIP_ASSERT("rmem == MEM_ALIGN(rmem)", (rmem == LWIP_MEM_ALIGN(rmem))); 172 #if LWIP_STATS && MEM_STATS 173 rmem = (u8_t*)rmem - MEM_LIBC_STATSHELPER_SIZE; 174 MEM_STATS_DEC_USED(used, *(mem_size_t*)rmem); 175 #endif 176 mem_clib_free(rmem); 177 } 178 179 #elif MEM_USE_POOLS 180 0x40118a9f is in do_memp_free_pool (/home/michaelg/esp/esp-idf/components/lwip/lwip/src/core/memp.c:432). 427 #endif 428 429 #if MEMP_MEM_MALLOC 430 LWIP_UNUSED_ARG(desc); 431 SYS_ARCH_UNPROTECT(old_level); 432 mem_free(memp); 433 #else /* MEMP_MEM_MALLOC */ 434 memp->next = *desc->tab; 435 *desc->tab = memp; 436 0x40118b17 is in memp_free (/home/michaelg/esp/esp-idf/components/lwip/lwip/src/core/memp.c:489). 484 485 #ifdef LWIP_HOOK_MEMP_AVAILABLE 486 old_first = *memp_pools[type]->tab; 487 #endif 488 489 do_memp_free_pool(memp_pools[type], mem); 490 491 #ifdef LWIP_HOOK_MEMP_AVAILABLE 492 if (old_first == NULL) { 493 LWIP_HOOK_MEMP_AVAILABLE(type); 0x4011e911 is in sys_timeouts_mbox_fetch (/home/michaelg/esp/esp-idf/components/lwip/lwip/src/core/timeouts.c:354). 349 if (handler != NULL) { 350 LWIP_DEBUGF(TIMERS_DEBUG, ("sct calling h=%s arg=%p\n", 351 tmptimeout->handler_name, arg)); 352 } 353 #endif /* LWIP_DEBUG_TIMERNAMES */ 354 memp_free(MEMP_SYS_TIMEOUT, tmptimeout); 355 if (handler != NULL) { 356 #if !NO_SYS 357 /* For LWIP_TCPIP_CORE_LOCKING, lock the core before calling the 358 timeout handler function. */ 0x401186f8 is in tcpip_thread (/home/michaelg/esp/esp-idf/components/lwip/lwip/src/api/tcpip.c:109). 104 LOCK_TCPIP_CORE(); 105 while (1) { /* MAIN Loop */ 106 UNLOCK_TCPIP_CORE(); 107 LWIP_TCPIP_THREAD_ALIVE(); 108 /* wait for a message, timeouts are processed while waiting */ 109 TCPIP_MBOX_FETCH(&mbox, (void **)&msg); 110 LOCK_TCPIP_CORE(); 111 if (msg == NULL) { 112 LWIP_DEBUGF(TCPIP_DEBUG, ("tcpip_thread: invalid message: NULL\n")); 113 LWIP_ASSERT("tcpip_thread: invalid message", 0);