(originally sent this to support email, was advised to send to forum.)
I just had an OTA crash when updating an ESP32 over device shadow (the downloaded URL is in S3, accessed via https:). I have the core file if you need it. Not sure how reproducible it is (first failure today out of a dozen tests).
[May 30 14:03:45.949] net.c:76 MQTT_EV_MQTT_PUBLISH (msg_id: 1, payload: "{"state":{"reported":{"ota":{"message":"Waiting for data","status":1,"is_committed":true,"commit_timeout":300,"partition":0,"progress_percent":64}}},"metadata":{"reported":{"ota":{"message":{"timestamp":1559239425},"status":{"timestamp":1559239425},"is_committed":{"timestamp":1559239425},"commit_timeout":{"timestamp":1559239425},"partition":{"timestamp":1559239425},"progress_percent":{"timestamp":1559239425}}}},"version":706,"timestamp":1559239425,"clientToken":"344a016b"}")
[May 30 14:03:47.591] assertion "p->tot_len == p->len" failed: file "/opt/Espressif/esp-idf/components/lwip/lwip/src/core/pbuf.c", line 950, function: pbuf_dechain
[May 30 14:03:47.603] abort() was called at PC 0x400d20ab on core 0
[May 30 14:03:47.603]
[May 30 14:03:47.603] Backtrace: 0x4008ebb3 0x4008ed35 0x400d20ab 0x401495da 0x401878db 0x4017fccd 0x4018f962 0x40191028 0x40191a02 0x40181e85 0x40184dc2 0x401850a1 0x40187f44 0x4019a501 0x4017fbe1 0x400839b6 0x40083b7d
[May 30 14:03:47.625]
[May 30 14:03:47.626] --- BEGIN CORE DUMP ---
[May 30 14:03:47.626] mos: catching core dump
[May 30 14:03:50.481] .............
[May 30 14:04:27.515] ---- END CORE DUMP ----
[May 30 14:04:27.531] mos: wrote to /home/wegscd/Jenesis/sti-gateway/core-sti-gateway-esp32-20190530-140427.194867205 (459483 bytes)
[May 30 14:04:27.531] mos: analyzing core dump
Core dump by sti-gateway/esp32 1.2.2 20190530-164643/1.2.1-gaab1d61-master-dirty
Using ELF file at: /home/wegscd/Jenesis/sti-gateway/build/objs/sti-gateway.elf
Using Docker image: docker.io/mgos/esp32-build:3.2-r4a
Running docker run --rm -v /home/wegscd/Jenesis/sti-gateway/build/objs/sti-gateway.elf:/fw.elf -v /home/wegscd/Jenesis/sti-gateway/core-sti-gateway-esp32-20190530-140427.194867205:/core -v /home/wegscd/Jenesis/sti-gateway:/home/wegscd/Jenesis/sti-gateway docker.io/mgos/esp32-build:3.2-r4a bash -c /usr/local/bin/serve_core.py --rom=/opt/Espressif/rom/rom.bin --rom_addr=0x40000000 --xtensa_addr_fixup=true /fw.elf /core & $MGOS_TARGET_GDB /fw.elf -ex 'target remote 127.0.0.1:1234' -ex 'set confirm off' -ex bt -ex quit
GNU gdb (crosstool-NG crosstool-ng-1.22.0-80-g6c4433a) 7.10
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=x86_64-build_pc-linux-gnu --target=xtensa-esp32-elf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /fw.elf...done.
Remote debugging using 127.0.0.1:1234
0x4008ebb3 in invoke_abort ()
at /opt/Espressif/esp-idf/components/esp32/panic.c:155
155 *((int *) 0) = 0;
#0 0x4008ebb3 in invoke_abort ()
at /opt/Espressif/esp-idf/components/esp32/panic.c:155
#1 0x4008ed38 in abort ()
at /opt/Espressif/esp-idf/components/esp32/panic.c:170
#2 0x400d20ae in __assert_func (
file=0x3f45fbec "/opt/Espressif/esp-idf/components/lwip/lwip/src/core/pbuf.c", line=950, func=<optimized out>,
failedexpr=0x3f45fe35 "p->tot_len == p->len")
at ../../../.././newlib/libc/stdlib/assert.c:63
#3 0x401495dd in pbuf_dechain (p=<optimized out>)
at /opt/Espressif/esp-idf/components/lwip/lwip/src/core/pbuf.c:950
#4 0x401878de in mg_lwip_if_tcp_recv (nc=<optimized out>,
buf=<optimized out>, len=15197)
at common/platforms/lwip/mg_lwip_net_if.c:634
#5 0x4017fcd0 in mg_ssl_if_mbed_recv (ctx=0x3ffe822c, buf=0x3ffec0ad "",
len=16384) at mongoose/src/mg_ssl_if_mbedtls.c:189
#6 0x4018f965 in mbedtls_ssl_fetch_input (ssl=0x3ffeb804, nb_want=16389)
at /data/tmp/mos_prebuild/tmp/mos_libs/mbedtls/mbedtls/library/ssl_tls.c:2877
#7 0x4019102b in ssl_get_next_record (ssl=0x3ffeb804)
at /data/tmp/mos_prebuild/tmp/mos_libs/mbedtls/mbedtls/library/ssl_tls.c:5197
#8 mbedtls_ssl_read_record (ssl=0x3ffeb804, update_hs_digest=1)
at /data/tmp/mos_prebuild/tmp/mos_libs/mbedtls/mbedtls/library/ssl_tls.c:4510
#9 0x40191a05 in mbedtls_ssl_read (ssl=0x3ffeb804, buf=0x3ffea0a8 "u",
len=488)
at /data/tmp/mos_prebuild/tmp/mos_libs/mbedtls/mbedtls/library/ssl_tls.c:8532
#10 0x40181e88 in mg_ssl_if_read (nc=0x3ffe822c, buf=0x3ffea0a8, len=488)
at mongoose/src/mg_ssl_if_mbedtls.c:272
#11 0x40184dc5 in mg_recv_tcp (len=488, buf=0x3ffea0a8 "u",
nc=<optimized out>) at mongoose/src/mg_net.c:614
#12 mg_do_recv (nc=0x3ffe822c) at mongoose/src/mg_net.c:599
#13 0x401850a4 in mg_if_poll (nc=0x3ffe822c, now=1559239428.2044151)
at mongoose/src/mg_net.c:153
#14 0x40187f47 in mg_lwip_if_poll (iface=<optimized out>,
timeout_ms=<optimized out>) at common/platforms/lwip/mg_lwip_ev_mgr.c:136
#15 0x4019a504 in mg_mgr_poll (m=0x3ffd26ec <s_mgr>, timeout_ms=0)
at mongoose/src/mg_net.c:301
#16 0x4017fbe4 in mongoose_poll (ms=0)
at /data/tmp/mos_prebuild/tmp/cesanta/mos-libs/mongoose/src/mgos_mongoose.c:61
#17 0x400839b9 in mgos_mg_poll_cb (arg=<optimized out>)
at /home/wegscd/Jenesis/sti-gateway/deps/freertos/src/mgos_freertos.c:101
#18 0x40083b80 in mgos_task (arg=<optimized out>)
at /home/wegscd/Jenesis/sti-gateway/deps/freertos/src/mgos_freertos.c:220
Detaching from program: /fw.elf, Remote target
Waiting for gdb on 1234
Dump contains FreeRTOS task info
Found core at 23 - 459434
Mapping DRAM: 335872 @ 0x3ffae000
Mapping /opt/Espressif/rom/rom.bin at 0x40000000
Mapping /fw.elf .iram0.vectors: 1024 @ 0x40080000
Mapping /fw.elf .iram0.text: 69917 @ 0x40080400
Mapping /fw.elf .dram0.data: 12444 @ 0x3ffb0000
Mapping /fw.elf .dram0.bss: 128624 @ 0x3ffb30a0
Mapping /fw.elf .flash.rodata: 476724 @ 0x3f400020
Mapping /fw.elf .flash.text: 830135 @ 0x400d0018
Loaded core dump from last snippet in /core
GDB closed the connection
Ending remote debugging.