GNOME Bugzilla – Bug 411867
baobab crashed with SIGSEGV in pango_fc_font_lock_face()
Last modified: 2007-02-26 13:45:25 UTC
That bug has been opened on https://launchpad.net/bugs/85787 "Binary package hint: gnome-utils Baobab (disk usage analyzer app) in Feisty Herd4 crashed badly. Clicked repeatedly menu selection Edit -> Expand All and Stop button + Scan Home button. ... libpango1.0-0 1.15.6-0ubuntu1 ... http://librarian.launchpad.net/6527108/valgrind-logs-baobab-7009.tar.gz valgrind -v --tool=memcheck --leak-check=full --num-callers=12 --log-file=valgrind.log baobab Second run of Baobab with libglib2.0-0-dbg libgtk2.0-0-dbg libpango1.0-0-dbg libraries. $ valgrind -v --tool=memcheck --leak-check=full --num-callers=12 --log-file=valgrind.log baobab Segmentation fault (core dumped) ... ==7009== Invalid read of size 4 ==7009== at 0x4B39C40: g_slice_alloc (gslice.c:423) ==7009== by 0x4B3A074: g_slice_alloc0 (gslice.c:784) ==7009== by 0x4B20881: g_list_alloc (glist.c:47) ==7009== by 0x4AC26A9: g_object_init (gobjectnotifyqueue.c:74) ==7009== by 0x4ADE59C: g_type_create_instance (gtype.c:1561) ==7009== by 0x4AC57E1: g_object_constructor (gobject.c:1041) ==7009== by 0x4AC3A6A: g_object_newv (gobject.c:937) ==7009== by 0x4AC45CE: g_object_new_valist (gobject.c:981) ==7009== by 0x4AC477F: g_object_new (gobject.c:795) ==7009== by 0x4939155: pango_layout_new (in /usr/lib/libpango-1.0.so.0.1504.2) ==7009== by 0x46D6DF2: gtk_widget_create_pango_layout (gtkwidget.c:5525) ==7009== by 0x44FF7A1: get_layout (gtkcellrenderertext.c:1355) ==7009== Address 0x5 is not stack'd, malloc'd or (recently) free'd ..." Debug backtrace for the crash: (gdb) thread apply all bt full
+ Trace 113743
Thread 1 (process 7758)
As valgrind has not been taught about the custom GSlice allocator (or rather vice versa), all this indicates is an earlier invalid memory write. For instance, I guess this is actually a use-after-free. The first step is to rerun valgrind with G_SLICE=always-malloc and G_DEBUG=gc-friendly environment variables set. Even then there are certain classes of error that will go undetected and for those G_SLICE=debug-blocks was introduced into glib-2.13. Sebastien, if you don't mind updating ubuntu's wiki with these glib specific instructions... Thanks.
new valgrind log: ==20067== Invalid write of size 1 ==20067== at 0x402250C: memset (mc_replace_strmem.c:479) ==20067== by 0x4B42778: g_slice_free1 (gslice.c:823) ==20067== by 0x4B3B1F7: g_queue_free (gqueue.c:57) ==20067== by 0x8052950: start_proc_on_dir (baobab.c:156) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4ADAD6D: g_signal_emit_by_name (gsignal.c:2267) ==20067== by 0x4696BA6: button_clicked (gtktoolbutton.c:660) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F8152: gtk_button_clicked (gtkbutton.c:889) ==20067== by 0x44F9D9D: gtk_real_button_released (gtkbutton.c:1484) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7589: signal_emit_unlocked_R (gsignal.c:2370) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F81E2: gtk_button_released (gtkbutton.c:881) ==20067== by 0x44F8240: gtk_button_button_release (gtkbutton.c:1377) ==20067== by 0x45C85DF: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:84) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7742: signal_emit_unlocked_R (gsignal.c:2478) ==20067== by 0x4AD83DE: g_signal_emit_valist (gsignal.c:2209) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x46DCA67: gtk_widget_event_internal (gtkwidget.c:3915) ==20067== by 0x45C1902: gtk_propagate_event (gtkmain.c:2358) ==20067== by 0x45C2B06: gtk_main_do_event (gtkmain.c:1592) ==20067== by 0x48220E9: gdk_event_dispatch (gdkevents-x11.c:2318) ==20067== by 0x4B2AC41: g_main_context_dispatch (gmain.c:2045) ==20067== by 0x4B2DC1E: g_main_context_iterate (gmain.c:2677) ==20067== by 0x4B2E184: g_main_context_iteration (gmain.c:2736) ==20067== by 0x45C2DF3: gtk_main_iteration (gtkmain.c:1254) ==20067== by 0x8051AF4: set_statusbar (baobab.c:457) ==20067== Address 0x55DEACA is 2 bytes inside a block of size 12 free'd ==20067== at 0x4020F9A: free (vg_replace_malloc.c:233) ==20067== by 0x4B31F90: g_free (gmem.c:187) ==20067== by 0x4B42600: g_slice_free1 (gslice.c:824) ==20067== by 0x4B3B1F7: g_queue_free (gqueue.c:57) ==20067== by 0x8052950: start_proc_on_dir (baobab.c:156) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4ADAD6D: g_signal_emit_by_name (gsignal.c:2267) ==20067== by 0x4696BA6: button_clicked (gtktoolbutton.c:660) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F8152: gtk_button_clicked (gtkbutton.c:889) ==20067== by 0x44F9D9D: gtk_real_button_released (gtkbutton.c:1484) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7589: signal_emit_unlocked_R (gsignal.c:2370) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F81E2: gtk_button_released (gtkbutton.c:881) ==20067== by 0x44F8240: gtk_button_button_release (gtkbutton.c:1377) ==20067== by 0x45C85DF: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:84) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7742: signal_emit_unlocked_R (gsignal.c:2478) ==20067== by 0x4AD83DE: g_signal_emit_valist (gsignal.c:2209) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x46DCA67: gtk_widget_event_internal (gtkwidget.c:3915) ==20067== by 0x45C1902: gtk_propagate_event (gtkmain.c:2358) ==20067== by 0x45C2B06: gtk_main_do_event (gtkmain.c:1592) ==20067== by 0x48220E9: gdk_event_dispatch (gdkevents-x11.c:2318) ==20067== by 0x4B2AC41: g_main_context_dispatch (gmain.c:2045) ==20067== by 0x4B2DC1E: g_main_context_iterate (gmain.c:2677) ==20067== by 0x4B2E184: g_main_context_iteration (gmain.c:2736) ==20067== by 0x45C2DF3: gtk_main_iteration (gtkmain.c:1254) ==20067== ==20067== Invalid free() / delete / delete[] ==20067== at 0x4020F9A: free (vg_replace_malloc.c:233) ==20067== by 0x4B31F90: g_free (gmem.c:187) ==20067== by 0x4B42600: g_slice_free1 (gslice.c:824) ==20067== by 0x4B3B1F7: g_queue_free (gqueue.c:57) ==20067== by 0x8052950: start_proc_on_dir (baobab.c:156) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4ADAD6D: g_signal_emit_by_name (gsignal.c:2267) ==20067== by 0x4696BA6: button_clicked (gtktoolbutton.c:660) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F8152: gtk_button_clicked (gtkbutton.c:889) ==20067== by 0x44F9D9D: gtk_real_button_released (gtkbutton.c:1484) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7589: signal_emit_unlocked_R (gsignal.c:2370) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F81E2: gtk_button_released (gtkbutton.c:881) ==20067== by 0x44F8240: gtk_button_button_release (gtkbutton.c:1377) ==20067== by 0x45C85DF: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:84) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7742: signal_emit_unlocked_R (gsignal.c:2478) ==20067== by 0x4AD83DE: g_signal_emit_valist (gsignal.c:2209) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x46DCA67: gtk_widget_event_internal (gtkwidget.c:3915) ==20067== by 0x45C1902: gtk_propagate_event (gtkmain.c:2358) ==20067== by 0x45C2B06: gtk_main_do_event (gtkmain.c:1592) ==20067== by 0x48220E9: gdk_event_dispatch (gdkevents-x11.c:2318) ==20067== by 0x4B2AC41: g_main_context_dispatch (gmain.c:2045) ==20067== by 0x4B2DC1E: g_main_context_iterate (gmain.c:2677) ==20067== by 0x4B2E184: g_main_context_iteration (gmain.c:2736) ==20067== by 0x45C2DF3: gtk_main_iteration (gtkmain.c:1254) ==20067== Address 0x55DEAC8 is 0 bytes inside a block of size 12 free'd ==20067== at 0x4020F9A: free (vg_replace_malloc.c:233) ==20067== by 0x4B31F90: g_free (gmem.c:187) ==20067== by 0x4B42600: g_slice_free1 (gslice.c:824) ==20067== by 0x4B3B1F7: g_queue_free (gqueue.c:57) ==20067== by 0x8052950: start_proc_on_dir (baobab.c:156) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4ADAD6D: g_signal_emit_by_name (gsignal.c:2267) ==20067== by 0x4696BA6: button_clicked (gtktoolbutton.c:660) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F8152: gtk_button_clicked (gtkbutton.c:889) ==20067== by 0x44F9D9D: gtk_real_button_released (gtkbutton.c:1484) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7589: signal_emit_unlocked_R (gsignal.c:2370) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F81E2: gtk_button_released (gtkbutton.c:881) ==20067== by 0x44F8240: gtk_button_button_release (gtkbutton.c:1377) ==20067== by 0x45C85DF: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:84) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7742: signal_emit_unlocked_R (gsignal.c:2478) ==20067== by 0x4AD83DE: g_signal_emit_valist (gsignal.c:2209) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x46DCA67: gtk_widget_event_internal (gtkwidget.c:3915) ==20067== by 0x45C1902: gtk_propagate_event (gtkmain.c:2358) ==20067== by 0x45C2B06: gtk_main_do_event (gtkmain.c:1592) ==20067== by 0x48220E9: gdk_event_dispatch (gdkevents-x11.c:2318) ==20067== by 0x4B2AC41: g_main_context_dispatch (gmain.c:2045) ==20067== by 0x4B2DC1E: g_main_context_iterate (gmain.c:2677) ==20067== by 0x4B2E184: g_main_context_iteration (gmain.c:2736) ==20067== by 0x45C2DF3: gtk_main_iteration (gtkmain.c:1254) ==20067== ==20067== Invalid read of size 4 ==20067== at 0x4B3B1DE: g_queue_free (gqueue.c:56) ==20067== by 0x8052950: start_proc_on_dir (baobab.c:156) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC662A: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4ADAD6D: g_signal_emit_by_name (gsignal.c:2267) ==20067== by 0x4696BA6: button_clicked (gtktoolbutton.c:660) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC662A: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F8152: gtk_button_clicked (gtkbutton.c:889) ==20067== by 0x44F9D9D: gtk_real_button_released (gtkbutton.c:1484) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC662A: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7589: signal_emit_unlocked_R (gsignal.c:2370) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F81E2: gtk_button_released (gtkbutton.c:881) ==20067== by 0x44F8240: gtk_button_button_release (gtkbutton.c:1377) ==20067== by 0x45C85DF: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:84) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC662A: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7742: signal_emit_unlocked_R (gsignal.c:2478) ==20067== by 0x4AD83DE: g_signal_emit_valist (gsignal.c:2209) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x46DCA67: gtk_widget_event_internal (gtkwidget.c:3915) ==20067== by 0x45C1902: gtk_propagate_event (gtkmain.c:2358) ==20067== by 0x45C2B06: gtk_main_do_event (gtkmain.c:1592) ==20067== by 0x48220E9: gdk_event_dispatch (gdkevents-x11.c:2318) ==20067== by 0x4B2AC41: g_main_context_dispatch (gmain.c:2045) ==20067== by 0x4B2DC1E: g_main_context_iterate (gmain.c:2677) ==20067== by 0x4B2DFC8: g_main_loop_run (gmain.c:2881) ==20067== by 0x45C2F83: gtk_main (gtkmain.c:1171) ==20067== by 0x80531F7: main (baobab.c:766) ==20067== Address 0x55DEAC8 is 0 bytes inside a block of size 12 free'd ==20067== at 0x4020F9A: free (vg_replace_malloc.c:233) ==20067== by 0x4B31F90: g_free (gmem.c:187) ==20067== by 0x4B42600: g_slice_free1 (gslice.c:824) ==20067== by 0x4B3B1F7: g_queue_free (gqueue.c:57) ==20067== by 0x8052950: start_proc_on_dir (baobab.c:156) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4ADAD6D: g_signal_emit_by_name (gsignal.c:2267) ==20067== by 0x4696BA6: button_clicked (gtktoolbutton.c:660) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD70F2: signal_emit_unlocked_R (gsignal.c:2440) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F8152: gtk_button_clicked (gtkbutton.c:889) ==20067== by 0x44F9D9D: gtk_real_button_released (gtkbutton.c:1484) ==20067== by 0x4AD39C8: g_cclosure_marshal_VOID__VOID (gmarshal.c:77) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7589: signal_emit_unlocked_R (gsignal.c:2370) ==20067== by 0x4AD8616: g_signal_emit_valist (gsignal.c:2199) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x44F81E2: gtk_button_released (gtkbutton.c:881) ==20067== by 0x44F8240: gtk_button_button_release (gtkbutton.c:1377) ==20067== by 0x45C85DF: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:84) ==20067== by 0x4AC4E48: g_type_class_meta_marshal (gclosure.c:567) ==20067== by 0x4AC670C: g_closure_invoke (gclosure.c:490) ==20067== by 0x4AD7742: signal_emit_unlocked_R (gsignal.c:2478) ==20067== by 0x4AD83DE: g_signal_emit_valist (gsignal.c:2209) ==20067== by 0x4AD87D8: g_signal_emit (gsignal.c:2243) ==20067== by 0x46DCA67: gtk_widget_event_internal (gtkwidget.c:3915) ==20067== by 0x45C1902: gtk_propagate_event (gtkmain.c:2358) ==20067== by 0x45C2B06: gtk_main_do_event (gtkmain.c:1592) ==20067== by 0x48220E9: gdk_event_dispatch (gdkevents-x11.c:2318) ==20067== by 0x4B2AC41: g_main_context_dispatch (gmain.c:2045) ==20067== by 0x4B2DC1E: g_main_context_iterate (gmain.c:2677) ==20067== by 0x4B2E184: g_main_context_iteration (gmain.c:2736) ==20067== by 0x45C2DF3: gtk_main_iteration (gtkmain.c:1254) reassigning to gnome-utils, that's probably the application causing the problem The Ubuntu wiki page has been updated
This problem has been fixed in the development version. The fix will be available in the next major software release. Thank you for your bug report.