Bug 335432 – [gst0.10] mixer applet crash when removed, freeze gnome-panel

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 335432 - [gst0.10] mixer applet crash when removed, freeze gnome-panel


Summary:	[gst0.10] mixer applet crash when removed, freeze gnome-panel


Status:	RESOLVED FIXED

Product:	gnome-applets
Classification:	Other
Component:	mixer
Version:	2.14.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	gnome-applets Maintainers
QA Contact:	gnome-applets Maintainers

URL:
Whiteboard:

Duplicates:	333917 (view as bug list)
Depends on:
Blocks:

Reported:	2006-03-21 23:18 UTC by Sebastien Bacher
Modified:	2010-01-24 01:05 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
proposed fix (3.02 KB, patch) 2006-03-22 20:06 UTC, Tim-Philipp Müller	committed	Details \| Review

Description Sebastien Bacher 2006-03-21 23:18:46 UTC

That bug has been described on https://launchpad.net/distros/ubuntu/+source/gnome-applets/+bug/34519

"If you add a second Volume applet to your panel, and then remove it, it freezes the panel.

1. Add a second Volume applet.
2. Right click-> Remove
... Panel freezes

On an up-to-date Dapper system.
...."


Backtrace of the crash when the applets is removed from the panel:

Starting program: /usr/lib/gnome-applets/mixer_applet2
[Thread debugging using libthread_db enabled]
[New Thread -1224640832 (LWP 2958)]
*** glibc detected *** double free or corruption (fasttop): 0x083ab0d0 ***

Program received signal SIGABRT, Aborted.

+ Trace 67119

Thread NaN (LWP 2958)

#0 __kernel_vsyscall
#1 raise
from /lib/tls/i686/cmov/libc.so.6
#2 abort
from /lib/tls/i686/cmov/libc.so.6
#3 __libc_message
from /lib/tls/i686/cmov/libc.so.6
#4 _int_free
from /lib/tls/i686/cmov/libc.so.6
#5 free
from /lib/tls/i686/cmov/libc.so.6
#6 IA__g_free
at gmem.c line 187
#7 IA__g_datalist_clear
at gdataset.c line 120
#8 g_object_finalize
at gobject.c line 538
#9 gst_object_finalize
at gstobject.c line 533
#10 gst_element_finalize
at gstelement.c line 2471
#11 IA__g_object_unref
at gobject.c line 1762
#12 gst_object_unref
at gstobject.c line 414
#13 gnome_volume_applet_dispose
at applet.c line 476
#14 IA__g_object_run_dispose
at gobject.c line 571
#15 IA__gtk_object_destroy
at gtkobject.c line 404
#16 IA__gtk_widget_destroy
at gtkwidget.c line 1995
#17 bonobo_control_add_listener
from /usr/lib/libbonoboui-2.so.0
#18 IA__g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#19 g_type_class_meta_marshal
at gclosure.c line 567
#20 IA__g_closure_invoke
at gclosure.c line 490
#21 signal_emit_unlocked_R
at gsignal.c line 2476
#22 IA__g_signal_emit_valist
at gsignal.c line 2197
#23 IA__g_signal_emit
at gsignal.c line 2241
#24 bonobo_object_unref
from /usr/lib/libbonobo-2.so.0
#25 bonobo_object_unref
from /usr/lib/libbonobo-2.so.0
#26 _ORBIT_skel_small_Bonobo_Unknown_unref
from /usr/lib/libbonobo-activation.so.4
#27 ORBit_POA_setup_root
from /usr/lib/libORBit-2.so.0
#28 ORBit_OAObject_invoke
from /usr/lib/libORBit-2.so.0
#29 ORBit_small_invoke_adaptor
from /usr/lib/libORBit-2.so.0
#30 ORBit_POAObject_post_invoke
from /usr/lib/libORBit-2.so.0
#31 ORBit_POAObject_post_invoke
from /usr/lib/libORBit-2.so.0
#32 ORBit_c_stub_invoke
from /usr/lib/libORBit-2.so.0
#33 ORBit_handle_request
from /usr/lib/libORBit-2.so.0
#34 giop_connection_handle_input
from /usr/lib/libORBit-2.so.0
#35 link_connection_set_max_buffer
from /usr/lib/libORBit-2.so.0
#36 link_servers_move_io_T
from /usr/lib/libORBit-2.so.0
#37 IA__g_main_context_dispatch
at gmain.c line 1916
#38 g_main_context_iterate
at gmain.c line 2547
#39 IA__g_main_loop_run
at gmain.c line 2751
#40 bonobo_main
from /usr/lib/libbonobo-2.so.0
#41 bonobo_generic_factory_main_timeout
from /usr/lib/libbonobo-2.so.0
#42 bonobo_generic_factory_main
from /usr/lib/libbonobo-2.so.0

Comment 1 Tim-Philipp Müller 2006-03-22 20:02:07 UTC

The minimalist fix for this would be:

diff -u -p -r1.50 applet.c
--- applet.c    14 Feb 2006 01:07:39 -0000      1.50
+++ applet.c    22 Mar 2006 19:15:46 -0000
@@ -471,8 +471,6 @@ gnome_volume_applet_dispose (GObject *ob
       GstElement *element = GST_ELEMENT (item->data);

       gst_element_set_state (element, GST_STATE_NULL);
-      g_free (g_object_get_data (G_OBJECT (element),
-                                "gnome-volume-applet-name"));
       gst_object_unref (GST_OBJECT (element));
     }
     g_list_free (applet->elements);


In the course of the port-to-gst-0.10 I had changed the g_object_set_data() calls to g_object_set_data_full (..., g_free) and removed this g_free() line, but somehow it seems to have slipped back in when the 0.8 compatibility stuff was added again.

Proper patch will follow in a sec.

Comment 2 Tim-Philipp Müller 2006-03-22 20:06:06 UTC

Created attachment 61789 [details] [review]
proposed fix


Proposed fix:
 - minor addition to the gst-0.10 part of the code
   to make string ownership clearer
 - fixes for gst-0.8 part of the code (use _set_data_full here too)

Comment 3 Sebastien Bacher 2006-03-22 22:29:15 UTC

Thanks for the patch, it fixes the issue for me

Comment 4 Tim-Philipp Müller 2006-04-04 17:51:43 UTC

Ping? This should really be committed for 2.14.1 ...

Comment 5 Danielle Madeley 2006-04-05 01:30:57 UTC

Ok. Commit to HEAD (we haven't branched yet). According to me GNOME 2.14.1 tarbalsl are being rolled on Monday.

Comment 6 Tim-Philipp Müller 2006-04-07 20:37:04 UTC

Thanks, committed:

2006-04-07  Tim-Philipp Müller  <tim at centricular dot net>

        * applet.c: (gnome_volume_applet_dispose):
        * load.c: (_filter_func), (create_mixer_collection):
          Fix double-free on quit which would cause the panel to
          freeze under certain circumstances (#335432). Make string
          ownership in 0.10 part of the code clearer; fix 0.8 part
          of the code to use g_object_set_data_full() as well.

Comment 7 Kjartan Maraas 2006-05-07 11:01:48 UTC

*** Bug 333917 has been marked as a duplicate of this bug. ***