Bug 561105 – rhythmbox crashes after the first download when downloading two or more podcasts at the same time

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 561105 - rhythmbox crashes after the first download when downloading two or more podcasts at the same time


Summary:	rhythmbox crashes after the first download when downloading two or more podca...


Status:	RESOLVED DUPLICATE of bug 554556

Product:	rhythmbox
Classification:	Other
Component:	general
Version:	0.11.x
Hardware:	Other All

Importance:	Normal critical
Target Milestone:	---
Assigned To:	RhythmBox Maintainers
QA Contact:	RhythmBox Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2008-11-16 20:43 UTC by Martin Olsson
Modified:	2008-11-16 22:54 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Martin Olsson 2008-11-16 20:43:25 UTC

Steps to reproduce:
1. start rhythmbox 0.11.6 (the one that shipped in ubuntu intrepid ibex)
2. select "Music::New podcast feed"
3. type in the URL: http://www.sr.se/rssfeed/rssfeed.aspx?Poddfeed=4891
4. select the "podcasts" item in the listview on the left
5. select TWO podcasts at the same time and right click and click "download episode"

Actual:
The first download starts and finishes just fine but rhythmbox crashes right after the first download is finished

Expected:
Download should download the first episode and once finished move on and download the second episode as well.


Note: the crash doesn't happen if the episodes are downloaded one by one

Stack trace:

+ Trace 209890

#0 writev
from /lib/libc.so.6
#1 _dbus_write_two
at dbus-sysdeps-unix.c line 425
#2 do_writing
at dbus-transport-socket.c line 596
#3 socket_do_iteration
at dbus-transport-socket.c line 996
#4 _dbus_transport_do_iteration
at dbus-transport.c line 956
#5 _dbus_connection_do_iteration_unlocked
at dbus-connection.c line 1150
#6 _dbus_connection_send_preallocated_unlocked_no_update
at dbus-connection.c line 1971
#7 _dbus_connection_send_unlocked_no_update
at dbus-connection.c line 3060
#8 dbus_connection_send_with_reply
at dbus-connection.c line 3225
#9 dbus_connection_send_with_reply_and_block
at dbus-connection.c line 3303
#10 start_metadata_service
at rb-metadata-dbus-client.c line 186
#11 rb_metadata_load
at rb-metadata-dbus-client.c line 392
#12 rb_podcast_manager_save_metadata
at rb-podcast-manager.c line 1223
#13 download_progress
at rb-podcast-manager.c line 1386
#14 podcast_download_thread
at rb-podcast-manager.c line 1524
#15 g_thread_create_proxy
at /build/buildd/glib2.0-2.18.2/glib/gthread.c line 635
#16 start_thread
from /lib/libpthread.so.0
#17 clone
from /lib/libc.so.6
#18 ??
#0 writev
from /lib/libc.so.6
#1 _dbus_write_two
at dbus-sysdeps-unix.c line 425
#2 do_writing
at dbus-transport-socket.c line 596
#3 socket_do_iteration
at dbus-transport-socket.c line 996
#4 _dbus_transport_do_iteration
at dbus-transport.c line 956
#5 _dbus_connection_do_iteration_unlocked
at dbus-connection.c line 1150
#6 _dbus_connection_send_preallocated_unlocked_no_update
at dbus-connection.c line 1971
#7 _dbus_connection_send_unlocked_no_update
at dbus-connection.c line 3060
#8 dbus_connection_send_with_reply
at dbus-connection.c line 3225
#9 dbus_connection_send_with_reply_and_block
at dbus-connection.c line 3303
#10 start_metadata_service
at rb-metadata-dbus-client.c line 186
#11 rb_metadata_load
at rb-metadata-dbus-client.c line 392
#12 rb_podcast_manager_save_metadata
at rb-podcast-manager.c line 1223
#13 download_progress
at rb-podcast-manager.c line 1386
#14 podcast_download_thread
at rb-podcast-manager.c line 1524
#15 g_thread_create_proxy
at /build/buildd/glib2.0-2.18.2/glib/gthread.c line 635
#16 start_thread
from /lib/libpthread.so.0
#17 clone
from /lib/libc.so.6
#18 ??

No symbol table info available.

Other information:

Comment 1 Martin Olsson 2008-11-16 20:59:03 UTC

Here is another stack which I actually think it _MORE_ useful than the first one:

Program received signal SIGSEGV, Segmentation fault.

+ Trace 209891

Thread 1094543696 (LWP 6433)

#0 IA__g_type_check_instance_cast
at /build/buildd/glib2.0-2.18.2/gobject/gtype.c line 3723
#1 podcast_download_thread
at rb-podcast-manager.c line 1528
#2 g_thread_create_proxy
at /build/buildd/glib2.0-2.18.2/glib/gthread.c line 635
#3 start_thread
from /lib/libpthread.so.0
#4 clone
from /lib/libc.so.6
#5 ??
#0 IA__g_type_check_instance_cast
at /build/buildd/glib2.0-2.18.2/gobject/gtype.c line 3723
#1 podcast_download_thread
at rb-podcast-manager.c line 1528
#2 g_thread_create_proxy
at /build/buildd/glib2.0-2.18.2/glib/gthread.c line 635
#3 start_thread
from /lib/libpthread.so.0
#4 clone
from /lib/libc.so.6
#5 ??

(gdb)

Comment 2 Martin Olsson 2008-11-16 21:30:31 UTC

valgrind spits out the following which I think could be interesting with respect to this crash:

==7062== Thread 2:
==7062== Invalid read of size 8
==7062==    at 0x45E175: podcast_download_thread (rb-podcast-manager.c:1530)
==7062==    by 0xD10D263: g_thread_create_proxy (gthread.c:635)
==7062==    by 0x58893E9: start_thread (in /lib/libpthread-2.8.90.so)
==7062==    by 0xDABEC6C: clone (in /lib/libc-2.8.90.so)
==7062==  Address 0x16aa25f0 is 80 bytes inside a block of size 96 free'd
==7062==    at 0x4C252AF: free (vg_replace_malloc.c:323)
==7062==    by 0x45CF7F: end_job (rb-podcast-manager.c:1555)
==7062==    by 0xD0E3D3A: g_main_context_dispatch (gmain.c:2144)
==7062==    by 0xD0E750C: g_main_context_iterate (gmain.c:2778)
==7062==    by 0xD0E7A3C: g_main_loop_run (gmain.c:2986)
==7062==    by 0xA1BB7A6: gtk_main (gtkmain.c:1200)
==7062==    by 0x423150: main (main.c:330)
==7062== 
==7062== Invalid read of size 8
==7062==    at 0x45E179: podcast_download_thread (rb-podcast-manager.c:1530)
==7062==    by 0xD10D263: g_thread_create_proxy (gthread.c:635)
==7062==    by 0x58893E9: start_thread (in /lib/libpthread-2.8.90.so)
==7062==    by 0xDABEC6C: clone (in /lib/libc-2.8.90.so)
==7062==  Address 0x16aa25d0 is 48 bytes inside a block of size 96 free'd
==7062==    at 0x4C252AF: free (vg_replace_malloc.c:323)
==7062==    by 0x45CF7F: end_job (rb-podcast-manager.c:1555)
==7062==    by 0xD0E3D3A: g_main_context_dispatch (gmain.c:2144)
==7062==    by 0xD0E750C: g_main_context_iterate (gmain.c:2778)
==7062==    by 0xD0E7A3C: g_main_loop_run (gmain.c:2986)
==7062==    by 0xA1BB7A6: gtk_main (gtkmain.c:1200)
==7062==    by 0x423150: main (main.c:330)

Comment 3 Jonathan Matthew 2008-11-16 22:54:42 UTC

Thanks for the bug report. This particular bug has already been reported into our bug tracking system, but please feel free to report any further bugs you find.


*** This bug has been marked as a duplicate of 554556 ***