After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 607687 - f-spot crashes when using themes using the pixmap engine
f-spot crashes when using themes using the pixmap engine
Status: RESOLVED FIXED
Product: gtk+
Classification: Platform
Component: Backend: X11
2.19.x
Other Linux
: Normal normal
: ---
Assigned To: gtk-bugs
gtk-bugs
csw
: 607683 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2010-01-21 17:37 UTC by Sebastien Bacher
Modified: 2010-01-22 10:37 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Sebastien Bacher 2010-01-21 17:37:18 UTC
The bug has been described on https://bugs.launchpad.net/ubuntu/+source/gtk+2.0/+bug/411941

steps to trigger the crash:

* set a theme use the pixmap engine (new wave is one example)
* f-spot -b empty_dir (or start f-spot without any image on a new install)
* click on the f-spot toolbar on "edit" and back on "browse"

error:

"Gdk-ERROR **: The program 'f-spot' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 3446 error_code 11 request_code 53 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() "

The issue happens on i386 (not on amd64 apparently) when using GTK 2.18 or 2.19 (tried on 2.19.3), it doesn't happen with GDK_NATIVE_WINDOWS set

the crash stacktrace using --sync:

"#0  gdk_x_error (display=0x8419720, error=0xbfffa8ac)
    at /build/buildd/gtk+2.0-2.18.3/gdk/x11/gdkmain-x11.c:439
  • #1 _XError
    at ../../src/XlibInt.c line 2924
  • #2 process_responses
    at ../../src/xcb_io.c line 207
  • #3 _XReply
    at ../../src/xcb_io.c line 457
  • #4 XSync
    at ../../src/Sync.c line 48
  • #5 _XSyncFunction
    at ../../src/Synchro.c line 37
  • #6 XShmPutImage
    from /usr/lib/libXext.so.6
  • #7 gdk_x11_draw_image
    at /build/buildd/gtk+2.0-2.18.3/gdk/x11/gdkdrawable-x11.c line 847
  • #8 IA__gdk_draw_image
    at /build/buildd/gtk+2.0-2.18.3/gdk/gdkdraw.c line 726
  • #9 IA__gdk_draw_image
    at /build/buildd/gtk+2.0-2.18.3/gdk/gdkdraw.c line 726
  • #10 draw_with_images
  • #11 gdk_x11_draw_pixbuf
    at /build/buildd/gtk+2.0-2.18.3/gdk/x11/gdkdrawable-x11.c line 1520
  • #12 gdk_window_draw_pixbuf
    at /build/buildd/gtk+2.0-2.18.3/gdk/gdkwindow.c line 4589
  • #13 IA__gdk_draw_pixbuf
    at /build/buildd/gtk+2.0-2.18.3/gdk/gdkdraw.c line 788
  • #14 pixbuf_render
    at /build/buildd/gtk+2.0-2.18.3/modules/engines/pixbuf/pixbuf-render.c line 447
  • #15 theme_pixbuf_render
    at /build/buildd/gtk+2.0-2.18.3/modules/engines/pixbuf/pixbuf-render.c line 764
  • #16 draw_simple_image
    at /build/buildd/gtk+2.0-2.18.3/modules/engines/pixbuf/pixbuf-draw.c line 135
  • #17 draw_shadow
    at /build/buildd/gtk+2.0-2.18.3/modules/engines/pixbuf/pixbuf-draw.c line 422
  • #18 IA__gtk_paint_shadow
    at /build/buildd/gtk+2.0-2.18.3/gtk/gtkstyle.c line 5893
  • #19 gtk_default_draw_box
    at /build/buildd/gtk+2.0-2.18.3/gtk/gtkstyle.c line 3555
  • #20 draw_box
    at /build/buildd/gtk+2.0-2.18.3/modules/engines/pixbuf/pixbuf-draw.c line 660
  • #21 IA__gtk_paint_box
  • #22 ??

Comment 1 Sebastien Bacher 2010-01-21 17:39:06 UTC
*** Bug 607683 has been marked as a duplicate of this bug. ***
Comment 2 Alexander Larsson 2010-01-21 17:39:52 UTC
While there are some weird x and width args in the stack at the end in the
XShmPutImage that causes BadAlloc the arguments seem sane:

  • #7 gdk_x11_draw_image
    at /build/buildd/gtk+2.0-2.18.3/gdk/x11/gdkdrawable-x11.c line 847


These should not cause excessive allocations in the xserver.

Maybe there is some form of leak instead that slowly builds up to this
allocation failure?

Look at xrestop?
Comment 3 Sebastien Bacher 2010-01-21 17:54:31 UTC
there is nothing slowly building up since this crash happens as soon as you switch between views mode in the software with an empty collection, xrestop doesn't list anything looking weird there
Comment 4 Benjamin Berg 2010-01-21 19:00:00 UTC
I have looked a bit. It looks like it is an integer overflow in gdk_rectangle_intersect. The first rectangle is:

a=gtk.gdk.Rectangle(-2147482765,65, 1, 2)

the second is something like:

b=gtk.gdk.Rectangle(1167,65, 1, 1)

you get the following

b.intersect(a)
gtk.gdk.Rectangle(1167, 65, 2147483365, 1)

This results in a huge pixmap to be allocated.
Comment 5 Anton Kerezov 2010-01-21 19:34:06 UTC
So is it related to my theme or it is something wrong with the gtk side? I can help resolving the conflict if it is on my side.
Comment 6 Alexander Larsson 2010-01-22 08:45:12 UTC
This fixes the overflow: 

http://git.gnome.org/browse/gtk+/commit/?id=3c618f2f1f2181cb86226515e894f235f35b5fef

Can anyone verify if this fixes this bug?

The backtraces don't really show where the x = -2147483484 come from, probably because its from the mono side. So, i don't really know if that is a bug or not.
However, it may well be that it used to work but now accidentally hits the rectangle intersect overflow.
Comment 7 Sebastien Bacher 2010-01-22 10:34:06 UTC
The patch is working correctly and fixes the crash issue