After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 661628 - search in gnome-shell causes segfault in _shell_app_match_search_terms
search in gnome-shell causes segfault in _shell_app_match_search_terms
Status: RESOLVED FIXED
Product: gnome-shell
Classification: Core
Component: general
3.2.x
Other Linux
: Normal blocker
: ---
Assigned To: Frederic Crozat
gnome-shell-maint
Depends on: 662409
Blocks:
 
 
Reported: 2011-10-13 05:54 UTC by Allen Hewes
Modified: 2011-10-22 20:08 UTC
See Also:
GNOME target: ---
GNOME version: 3.1/3.2

Attachments
gdb thread apply all bt full output (61.25 KB, text/plain)
2011-10-13 20:12 UTC, Allen Hewes 		Details
.desktop causing crash (160 bytes, text/plain)
2011-10-21 16:35 UTC, Frederic Crozat 		Details

Description Allen Hewes 2011-10-13 05:54:51 UTC 
gnome-shell 3.2.0 on Fedora 15 x86_64 with any version of glibc 2.14

log in
click on "Activities"
then click in "Type to search..."
start typing "F-i-r" and crash.

(gdb) cont
Continuing.
[New Thread 0x7fc76c8ff700 (LWP 3913)]

Program received signal SIGSEGV, Segmentation fault.
__strstr_sse2 (haystack_start=0x0, needle_start=0x3c41d30 "em") at ../string/strstr.c:63
63        while (*haystack && *needle)
(gdb) bt

+ Trace 228780

  • #0 __strstr_sse2
    at ../string/strstr.c line 63
  • #1 _shell_app_match_search_terms
    at shell-app.c line 1263
  • #2 _shell_app_do_match
    at shell-app.c line 1315
  • #3 search_tree
  • #4 ffi_call_unix64
    at ../src/x86/unix64.S line 75
  • #5 ffi_call
    at ../src/x86/ffi64.c line 486
  • #6 gjs_invoke_c_function
    at gi/function.c line 648
  • #7 function_call
    at gi/function.c line 970
  • #8 CallJSNative
    at jscntxtinlines.h line 701
  • #9 js::Invoke
    at jsinterp.cpp line 696
  • #10 js::Interpret
    at jsinterp.cpp line 4810
  • #11 js::RunScript
    at jsinterp.cpp line 653
  • #12 js::Invoke
    at jsinterp.cpp line 740
  • #13 js::CallOrConstructBoundFunction
    at jsfun.cpp line 2319
  • #14 CallJSNative
    at jscntxtinlines.h line 701
  • #15 js::Invoke
    at jsinterp.cpp line 703
  • #16 js::ExternalInvoke
    at jsinterp.cpp line 863
  • #17 JS_CallFunctionValue
    at jsapi.cpp line 5145
  • #18 gjs_call_function_value
    at gjs/jsapi-util.c line 1203
  • #19 gjs_closure_invoke
    at gi/closure.c line 267
  • #20 closure_source_func
    at modules/mainloop.c line 136
  • #21 closure_source_func
    at modules/mainloop.c line 115
  • #22 g_timeout_dispatch
    at gmain.c line 3907
  • #23 g_main_dispatch
    at gmain.c line 2441
  • #24 g_main_context_dispatch
    at gmain.c line 3011
  • #25 g_main_context_iterate
    at gmain.c line 3089
  • #26 g_main_loop_run
    at gmain.c line 3297
  • #27 meta_run
    at core/main.c line 555
  • #28 main
    at main.c line 571 






Comment 1


André Klapper





          2011-10-13 08:39:32 UTC
        



Did you try with another glibc where this does not happen, or why did you mention glibc? Or did you mix it up with glib mentioned in the stacktrace? :)






Comment 2


Allen Hewes





          2011-10-13 20:12:59 UTC
        



Created attachment 198971 [details]
gdb thread apply all bt full output






Comment 3


Allen Hewes





          2011-10-13 20:13:56 UTC
        



Hi Andre,

I am mentioning glibc because of this in me dmesg:

[  948.499599] gnome-shell[2321]: segfault at 0 ip 00007fc07e3d79d4 sp 00007fffc6136d80 error 4 in libc-2.14.1.so[7fc07e34a000+18e000]

$ rpm -qf /lib64/libc-2.14.1.so      
glibc-2.14.1-1.x86_64

I tried all builds of glibc for Fedora 15 and I also tried the latest glibc built as of today, which is glibc-2.14.90-11. Even though the segfault is in libc, I think gnome-shell is causing it by passing in invalid pointers. Hence my creating a ticket here and not with Fedora.

I built GNOME 3.2.0 against glibc-2.14-5.

I upgraded from GNOME 3.1.5 and this started happening.

I don't know much about GNOME other than I have been happy with GNOME 3, so I have been doing the upgrade myself to versions 3.1.5 and 3.2.0. Fedora 15 doesn't have any builds for this. GNOME 3.1.5 worked perfectly.

gnome-do works, so I have installed it so that I can find stuff. With the gnome-shell search being busted, it's hard to use... I used it all the time, instead of click on "Applications".

I am a layman but doesn't haystack_start=0x0 mean bad/invalid pointer?

Looking at http://git.gnome.org/browse/gnome-shell/tree/src/shell-app.c?id=3.2.0

Under what conditions could either of these return bad pointer data?
     p = strstr (app->casefolded_name, term);
     p = strstr (app->casefolded_exec, term);
         p = strstr (app->casefolded_description, term);


I have attached a gdb full bt for your perusal. Thread 1 is near the bottom and where crash is.

Thanks for any pointers you can offer up.






Comment 4


Milan Bouchet-Valat





          2011-10-14 07:20:06 UTC
        



(In reply to comment #3)
> Even though the segfault is in libc, I think gnome-shell is causing it by 
> passing in invalid pointers.
glibc is the GNU version of the base library that is used by all C programs on the system. When programs pass invalid pointers, crashes happen in glibc, but as you say, it's not glibc's fault at all (in general).

> I am a layman but doesn't haystack_start=0x0 mean bad/invalid pointer?
Yes, you're not such a newbie as you pretend... ;-)

> Looking at
> http://git.gnome.org/browse/gnome-shell/tree/src/shell-app.c?id=3.2.0
> 
> Under what conditions could either of these return bad pointer data?
>      p = strstr (app->casefolded_name, term);
>      p = strstr (app->casefolded_exec, term);
>          p = strstr (app->casefolded_description, term);
> 
> 
> I have attached a gdb full bt for your perusal. Thread 1 is near the bottom and
> where crash is.
> 
> Thanks for any pointers you can offer up.
I think devs have all they need now, thanks!

I'm copying the relevant stack here for convenience:




+
Trace
    228793






    

  • 
#0
__strstr_sse2

    
                at ../string/strstr.c
                  line
                  63

    

    • 

  • 
#1
_shell_app_match_search_terms

    
                at shell-app.c
                  line
                  1263

    

    • 

  • 
#2
_shell_app_do_match

    
                at shell-app.c
                  line
                  1315

    

    • 

  • 
#3
search_tree

    • 

  • 
#4
ffi_call_unix64

    
                at ../src/x86/unix64.S
                  line
                  75

    

    • 

  • 
#5
ffi_call

    
                at ../src/x86/ffi64.c
                  line
                  486

    

    • 

  • 
#6
gjs_invoke_c_function

    
                at gi/function.c
                  line
                  648

    

    • 

  • 
#7
function_call

    
                at gi/function.c
                  line
                  970

    

    • 

  • 
#8
CallJSNative

    
                at jscntxtinlines.h
                  line
                  701

    

    • 

  • 
#9
js::Invoke

    
                at jsinterp.cpp
                  line
                  696

    

    • 

  • 
#10
js::Interpret

    
                at jsinterp.cpp
                  line
                  4810

    

    • 

  • 
#11
js::RunScript

    
                at jsinterp.cpp
                  line
                  653

    

    • 

  • 
#12
js::Invoke

    
                at jsinterp.cpp
                  line
                  740

    

    • 

  • 
#13
js::CallOrConstructBoundFunction

    
                at jsfun.cpp
                  line
                  2319

    

    • 

  • 
#14
CallJSNative

    
                at jscntxtinlines.h
                  line
                  701

    

    • 

  • 
#15
js::Invoke

    
                at jsinterp.cpp
                  line
                  703

    

    • 

  • 
#16
js::ExternalInvoke

    
                at jsinterp.cpp
                  line
                  863

    

    • 

  • 
#17
JS_CallFunctionValue

    
                at jsapi.cpp
                  line
                  5145

    

    • 

  • 
#18
gjs_call_function_value

    
                at gjs/jsapi-util.c
                  line
                  1203

    

    • 

  • 
#19
gjs_closure_invoke

    
                at gi/closure.c
                  line
                  267

    

    • 

  • 
#20
closure_source_func

    
                at modules/mainloop.c
                  line
                  136

    

    • 

  • 
#21
closure_source_func

    
                at modules/mainloop.c
                  line
                  115

    

    • 

  • 
#22
g_timeout_dispatch

    
                at gmain.c
                  line
                  3907

    

    • 

  • 
#23
g_main_dispatch

    
                at gmain.c
                  line
                  2441

    

    • 

  • 
#24
g_main_context_dispatch

    
                at gmain.c
                  line
                  3011

    

    • 

  • 
#25
g_main_context_iterate

    
                at gmain.c
                  line
                  3089

    

    • 

  • 
#26
g_main_loop_run

    
                at gmain.c
                  line
                  3297

    

    • 

  • 
#27
meta_run

    
                at core/main.c
                  line
                  555

    

    • 

  • 
#28
main

    
                at main.c
                  line
                  571

    

    • 













Comment 5


Frederic Crozat





          2011-10-21 16:35:18 UTC
        



Created attachment 199668 [details]
.desktop causing crash

confirming, I've got it on openSUSE Factory with gnome-shell 3.2.1 when attached .desktop was installed (incorrectly in /usr/share/applications, it should be ma mime entry).






Comment 6


Vincent Untz





          2011-10-21 16:42:42 UTC
        



One thing worth noting is that gnome-shell should probably completely ignore a .desktop file without an Exec or a Name key since those .desktop files should be considered invalid.






Comment 7


Florian Müllner





          2011-10-21 16:51:57 UTC
        



Should we implement this in gmenu?






Comment 8


Vincent Untz





          2011-10-21 17:03:36 UTC
        



(In reply to comment #7)
> Should we implement this in gmenu?

Sounds reasonable. desktop_entry_load() in desktop-entries.c should be changed to look if the exec of the appinfo is null or not (apparently, the name can never be null).






Comment 9


Florian Müllner





          2011-10-21 18:04:14 UTC
        



OK, I filed bug 662409.






Comment 10


Allen Hewes





          2011-10-22 20:08:14 UTC
        



Everyone,

When the supplied patch is applied to gnome-menus 3.2.0.1, I no longer get any segfaults when searching in gnome-shell 3.2.0

Thanks guys!