GNOME Bugzilla – Bug 572549
Memory corruption in gnome-terminal
Last modified: 2009-03-16 18:44:57 UTC
I had a bunch of crashes which all occured when using multiple tabs for a while and ctrl-d-ing out of one of the sessions causing a tab to be closed. This resulted in crashes like http://launchpadlibrarian.net/22903593/ThreadStacktrace.txt http://launchpadlibrarian.net/22883648/ThreadStacktrace.txt http://launchpadlibrarian.net/22892052/ThreadStacktrace.txt Here relevant portions of the valgrind log: ==22315== Invalid free() / delete / delete[] ==22315== at 0x4025B4A: free (vg_replace_malloc.c:323) ==22315== by 0x485A0C5: g_free (gmem.c:190) ==22315== by 0x806A4BC: terminal_screen_finalize (terminal-screen.c:653) ==22315== by 0x47E4FB8: g_object_unref (gobject.c:2421) ==22315== by 0x4069C46: vte_terminal_catch_child_exited (vte.c:3359) ==22315== by 0x404BDE2: _vte_marshal_VOID__INT_INT (marshal.c:143) ==22315== by 0x47E2CAA: g_closure_invoke (gclosure.c:767) ==22315== by 0x47FA3A8: signal_emit_unlocked_R (gsignal.c:3244) ==22315== by 0x47FBA1A: g_signal_emit_valist (gsignal.c:2977) ==22315== by 0x47FBD72: g_signal_emit_by_name (gsignal.c:3071) ==22315== by 0x404DAD9: vte_reaper_child_watch_cb (reaper.c:34) ==22315== by 0x484FC51: g_child_watch_dispatch (gmain.c:3631) ==22315== by 0x4851AF7: g_main_context_dispatch (gmain.c:1814) ==22315== by 0x485505A: g_main_context_iterate (gmain.c:2448) ==22315== by 0x4855529: g_main_loop_run (gmain.c:2656) ==22315== by 0x4362798: gtk_main (gtkmain.c:1205) ==22315== by 0x805A604: main (terminal.c:486) ==22315== Address 0x5b061e8 is 0 bytes inside a block of size 28 free'd ==22315== at 0x4025B4A: free (vg_replace_malloc.c:323) ==22315== by 0x485A0C5: g_free (gmem.c:190) ==22315== by 0x4637D2F: gdk_region_destroy (gdkregion-generic.c:340) ==22315== by 0x40524D1: update_regions (vte.c:14050) ==22315== by 0x40699A3: update_repeat_timeout (vte.c:14103) ==22315== by 0x4852225: g_timeout_dispatch (gmain.c:3253) ==22315== by 0x4851AF7: g_main_context_dispatch (gmain.c:1814) ==22315== by 0x485505A: g_main_context_iterate (gmain.c:2448) ==22315== by 0x4855529: g_main_loop_run (gmain.c:2656) ==22315== by 0x4362798: gtk_main (gtkmain.c:1205) ==22315== by 0x805A604: main (terminal.c:486) gnome-terminal 2.25.91. Please let me know if you need anything else.
Do you have a full valgrind log for that? A test run here didn't show this...
Created attachment 129164 [details] valgrind log
Was that valgrinding done with G_DEBUG=gc-friendly G_SLICE=always-malloc ? You also could try to run g-t with G_SLICE=always-malloc MALLOC_CHECK_=2 under gdb, and get a trace from the crash this should eventually produce.
I used G_SLICE=always-malloc G_DEBUG=gc-friendly valgrind -v --tool=memcheck --leak-check=full --num-callers=40 --log-file=valgrind.log <program> <arguments> I'll try to get a gdb crash now. Might take a while.
(gdb) thread apply all bt full
+ Trace 212854
Thread 1 (Thread 0x7f004f07f7d0 (LWP 4676))
Thanks! Should be fixed in svn trunk now.
Thanks a bunch - I'll take it for a ride and let you know.
It's looking good and I merged the change into the Ubuntu package - great work!
*** Bug 575487 has been marked as a duplicate of this bug. ***
*** Bug 574369 has been marked as a duplicate of this bug. ***
*** Bug 574425 has been marked as a duplicate of this bug. ***