GNOME Bugzilla – Bug 96423
[PATCH] gnome-panel dies with a SIGBUS on exit
Last modified: 2004-12-22 21:47:04 UTC
Package: gnome-panel Severity: normal Version: 2.0.10 Synopsis: gnome-panel dies with a SIGBUS on exit Bugzilla-Product: gnome-panel Bugzilla-Component: Panel Description: If a drawer widget is in the panel, gnome-panel will die with a SIGBUS when it receives a session exit. The problem is in the GTK_IS_WIDGET of pd->panel in the panel_session_die function. I haven't been able to track down exactly what's causing this, but replacing the gtk_widget_destroy with a simple: pd->panel = NULL; Works around the problem. This problem only seems to happen on FreeBSD -CURRENT which uses: Using built-in specs. Configured with: FreeBSD/i386 system compiler Thread model: posix gcc version 3.2.1 [FreeBSD] 20021009 (prerelease) FreeBSD 4.x does not exhibit this problem. -CURRENT has some malloc debugs enabled, but I don't believe that's the culprit. Here is a back trace from gdb: Program received signal SIGBUS, Bus error. 0x2850cdda in gtk_widget_destroy () from /usr/X11R6/lib/libgtk-x11-2.0.so.0 (gdb) bt
+ Trace 29174
------- Bug moved to this database by unknown@bugzilla.gnome.org 2002-10-21 14:04 ------- Reassigning to the default owner of the component, gnome-panel-maint@bugzilla.gnome.org.
Sorry to have not answered before. Does it still happen ? Did you try gnome-panel 2.0.11 and/or 2.1.x ?
It still happens iff malloc is configured to scrub freed memory with junk for debugging. Therefore, there is malloc'd that is not being initialized in gnome-panel, or in one of the underlying components. If I turn off malloc debugging, the problem goes away. I am unable to try gnome-panel 2.1.x on this machine at this time. FreeBSD uses 0xd0d0d0d0 as junk to fill malloc'd memory. This can be done by setting the J option for malloc in /etc/malloc.conf. I can probably get a back trace with debugging symbols if that will help.
Hmmm, I just read my earlier comments. Looks like the malloc debugging _is_ the issue.
A backtrace with debugging info would be nice if it still happens with the 2.2.x sources.
This is fixed in 2.2. Sorry for not updating sooner.
Sorry, this wasn't fixed, just masked by not having malloc debugging enabled. The good news is, I found the problem. What happens is that drawers on other panels are being free'd asynchronously, thus causing a bus error in panel_session_die(). I added some debugging code to panel.c and session.c so this can be somewhat visualized. Take a look. The XXX lines occur as soon as I logout: ** (gnome-panel:62418): WARNING **: XXX: panel_list = 8212e98 ** (gnome-panel:62418): WARNING **: XXX: i = 0 ** (gnome-panel:62418): WARNING **: XXX: Entering panel_destroy for 822a120 ** (gnome-panel:62418): WARNING **: XXX: Found pd 822a120 in panel_list. ** (gnome-panel:62418): WARNING **: XXX: Leaving panel_destroy for 822a120 ** (gnome-panel:62418): WARNING **: XXX: i = 1 ** (gnome-panel:62418): WARNING **: XXX: Entering panel_destroy for 822ad00 ** (gnome-panel:62418): WARNING **: XXX: Found pd 822ad00 in panel_list. ** (gnome-panel:62418): WARNING **: XXX: Leaving panel_destroy for 822ad00 ** (gnome-panel:62418): WARNING **: XXX: Entering panel_destroy for 830f780 ** (gnome-panel:62418): WARNING **: XXX: Found pd 830f780 in panel_list. ** (gnome-panel:62418): WARNING **: XXX: Leaving panel_destroy for 830f780 ** (gnome-panel:62418): WARNING **: XXX: i = 2 (Crash on SIGBUS) Note what happens. The i lines are printed in session.c each time the loop through panels_to_destroy in panel_session_die() is started. Normally, as soon as a panel widget is destroyed, gtk_widget_destroy() calls panel_destroy() in panel.c. But, if you have a drawer within a panel (panel with i == 1), the drawer is also destroyed by panel_destroy(). This would be fine since panel_session_die() checks to see that pd->panel is not NULL. However, you're assuming that g_free() will render a pointer NULL. This is not always the case. With FreeBSD's malloc scrubbing enabled (default for 5.x -CURRENT), each free'd pointer is set to 0xd0d0d0d0. While I don't think my attached patch is a perfect solution, it definitely solves the problem we're seeing. I think the best solution would be to destroy each sub-panel in order in panel_session_die() so that it isn't "accidentally" destroyed in panel_destroy(). However, since gnome-panel 2.3.x changes this whole thing, I'm not yet sure this bug exists in HEAD. It would be nice if this patch could be applied to the gnome-2-2 branch, though. I hope this explanation makes sense. Let me know if you require additional info.
Created attachment 18840 [details] [review] Patch to correct bus error on panel exit
Okay, I'm a bit confused about all this, but I think I see what you're getting at - does the patch below fix the problem ? Note, this is for gnome-panel HEAD ... a similar thing could be done with 2.2 by doing if (DRAWER_IS_WIDGET (l->data)) continue; Could you test this out and let me know ? Thanks.
There was no patch below. However, as a note, I tested gnome-panel HEAD yesterday, and I could not reproduce the crash.
Joe: Is it ok to close the bug ?
Yeah, I haven't been able to reproduce the crash in GNOME 2.3. Thanks.