Bug 594951 – Crash in soup_socket_disconnect

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 594951 - Crash in soup_socket_disconnect


Summary:	Crash in soup_socket_disconnect


Status:	RESOLVED FIXED

Product:	libsoup
Classification:	Core
Component:	HTTP Transport
Version:	2.24.x
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	---
Assigned To:	libsoup-maint@gnome.bugs
QA Contact:	libsoup-maint@gnome.bugs

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2009-09-11 23:03 UTC by Olivier Crête
Modified:	2009-09-12 11:31 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
Keep reference on SoupSocket while emitting signals (1.24 KB, patch) 2009-09-11 23:06 UTC, Olivier Crête	none	Details \| Review
Keep reference on SoupSocket while emitting signals (1.24 KB, patch) 2009-09-12 11:31 UTC, Dan Winship	committed	Details \| Review

Description Olivier Crête 2009-09-11 23:03:50 UTC

It seems that the SoupSocket() can have its last reference dropped by soup_message_io_cleanup() during the "readable" signal. I guess SoupSocket should self-ref before emitting those signals and self-unref afterwards.

Stack trace:

Program terminated with signal 6, Aborted.

+ Trace 217513

#0 raise
from /lib/libc.so.6
#1 abort
from /lib/libc.so.6
#2 IA__g_logv
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/glib/gmessages.c line 512
#3 IA__g_log
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/glib/gmessages.c line 532
#4 IA__g_return_if_fail_warning
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/glib/gmessages.c line 547
#5 IA__g_signal_emit_valist
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/gobject/gsignal.c line 2913
#6 IA__g_signal_emit
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/gobject/gsignal.c line 3037
#7 soup_socket_disconnect
at soup-socket.c line 953
#8 socket_read_watch
at soup-socket.c line 1047
#9 g_io_unix_dispatch
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/glib/giounix.c line 162
#10 IA__g_main_context_dispatch
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/glib/gmain.c line 1836
#11 g_main_context_iterate
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/glib/gmain.c line 2467
#12 IA__g_main_loop_run
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/glib/gmain.c line 2675
#13 thread_func
at gupnp-simple-igd-thread.c line 222
#14 g_thread_create_proxy
at /home/bifh4/fremantle-arm-prereleased.cs2007q3/work/glib2.0-2.20.3/glib/gthread.c line 635
#15 start_thread
from /lib/libpthread.so.0
#16 clone
from /lib/libc.so.6

Comment 1 Olivier Crête 2009-09-11 23:06:11 UTC

Created attachment 143034 [details] [review]
Keep reference on SoupSocket while emitting signals

Potentiel fix:

The socket could have its last external referenced dropped by
soup_message_io_cleanup() during the "readable" signal and then
abort() when trying to emit the "disconnected" signal.

Comment 2 Dan Winship 2009-09-12 11:31:47 UTC

The following fix has been pushed:
bf89ea0 Keep reference on SoupSocket while emitting signals

Thanks for the patch.

Comment 3 Dan Winship 2009-09-12 11:31:49 UTC

Created attachment 143049 [details] [review]
Keep reference on SoupSocket while emitting signals

The socket could have its last external referenced dropped by
soup_message_io_cleanup() during the "readable" signal and then
abort() when trying to emit the "disconnected" signal.