GNOME Bugzilla – Bug 94806
crash with automatic closes
Last modified: 2011-02-04 16:10:20 UTC
I'm getting this crash very often. Last cvs version of gnome-2-0 branch. It crash sometimes when some new windows closes automatically (before redraw?) like mozilla downloads and simitar. Attached the trace.
Created attachment 11392 [details] Trace of crash
Hmm, there was another report about refcounting issues with GdkDrawable/GdkColormap. I can't find it right now though.
Strange. I can't find it either. But that one was a leak, so it's not likely to cause a crash.
What I mean is, there was another report claiming that your fix for the leak created a crash. But when I looked at your fix I couldn't see any way it would do that.
*** Bug 95188 has been marked as a duplicate of this bug. ***
*** Bug 94804 has been marked as a duplicate of this bug. ***
*** Bug 96222 has been marked as a duplicate of this bug. ***
Note that 96222 has a stack trace.
Created attachment 11804 [details] Metacity log
I've attached the log from metacity, from when this happened to me.
"wm-tester/wm-tester --evil" from the metacity source tree basically just creates and autocloses windows, and it's not causing this for me. Does it cause it for any of you? What themes (GTK and metacity) are you using?
Crux and Crux here.
Hmm, switching to Crux gtk engine and metacity theme doesn't help me reproduce.
Ok, I've been getting this crash 95% of the time when I close xine ( both CVS and 0.9.13 ) What I do to replicate the crash is this: open avi file, start playing, press 'q' in the display window. Metacity crashes 95%-99% of the time. I recompiled metacity with -g -O3 -march=athlon attached from a ssh session, and got the following backtrace: create_constraints (constraints=0x825b2e8, windows=0x80ca628) at stack.c:496 496 if (c->above == above) (gdb) bt
+ Trace 29824
Hope this is more helpful.
I believe I fixed the create_constraints() crash with xine last night. I'm not sure if that was the whole bug here (some of the backtraces look different).
Apologies for the spam- I'm removing 'bugsquad' from some keywords via the web interface. This is a one-time only thing before I re-add bugsquad via the SQL interface, which will generate no mail. Apologies again.
I am getting the same crash with metacity. CVS version doesn't crash with xine but 'wm-tester --evil' makes it crash after some time. Here are the last lines from /tmp/metacity-22123-debug-log-COPMXN (23 MB) before crash. If you need full log I can put it somewhere in the web. (...) ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x4c005c5: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x4c005b9: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x4c00582: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x4c00579: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x4a0007e: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x4800234: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x4800031: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x140bc34: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 ERRORS: 1 traps remain ERRORS: 0 traps EVENTS: PropertyNotify on 0x260001a: atom: _NET_WM_ICON_GEOMETRY state: PropertyNewValue serial 204274 EVENTS: UnmapNotify on 0xe01391: event: 0xe01391 window: 0xe01391 from_configure: 0 serial 204412 EVENTS: UnmapNotify on root 0: event: 0x56 window: 0xe01391 from_configure: 0 serial 204412 EVENTS: DestroyNotify on 0xe01391 serial 204412
Can someone get a gdb backtrace with MALLOC_CHECK_=2 set, or a valgrind/purify report?
cc'ing Ben as he said he spent some time tracking this down the other day.
Created attachment 12235 [details] gdb backtrace
Created attachment 12237 [details] Valgrind report (with valgrind metacity doesn't show. it segfaults at start)
Just for info, I'm not experimenting this bug after upgrading to HEAD (2.1.x branch)
I have two Linux distributions in my computer: Debian unstable (glib 2.0.7, gtk 2.0.8, glibc 2.3.1) and RedHat 8.0 (glib 2.0.6, gtk 2.0.6, glibc 2.2.93). The same binary works fine in RedHat but crash in Debian. Maybe a glib or gtk bug?
Yes. It's a GTK bug. Talking to clahey, a colormap patch which was applied between 2.0.6 and 2.0.7 exposed this bug. (He says the patch was correct, but that it exposes this bug which is somewhere else.) Anyway, reverting the patch makes the crash go away.
Chris can you give more details on the exact patch and what bug it creates?
Created attachment 12287 [details] [review] Adds missing ref.
So, I found an extra unref from a GdkWindowImplX11 to a GdkColormap reading through stacktraces. I also found a missing ref from a GdkWindowImplX11 to a GdkColormap reading the code of gdkwindow-x11.c:304. Patch is attached.
So the reproduction instructions are: - Create a window with gdk_window_foreign_new() - call gdk_drawable_get_colormap() on it (probably happens implicitely from drawing calls) - Unref the window ?
Looks fine to commit with a changelog entry. [ Note that, however, the GTK+-2.0 code is completely conceptually broken if the window doesn't have the default system colormap, so there may be metacity bugs hiding here if it ever uses anything but the default system colormap. ]
With patch from Chris, metacity works fine here. "wm-tester/wm-tester --evil" was running for a long time without crashing metacity.
2002-11-13 Christopher James Lahey <clahey@ximian.com> * gdk/x11/gdkwindow-x11.c (gdk_window_impl_x11_get_colormap): Ref the colormap returned from gdk_colormap_lookup.
*** Bug 97992 has been marked as a duplicate of this bug. ***