After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 731788 - Crash in _vte_terminal_cleanup_fragments()
Crash in _vte_terminal_cleanup_fragments()
Status: RESOLVED FIXED
Product: vte
Classification: Core
Component: general
0.37.x
Other Linux
: Normal critical
: ---
Assigned To: VTE Maintainers
VTE Maintainers
Depends on:
Blocks:
 
 
Reported: 2014-06-17 16:14 UTC by Egmont Koblinger
Modified: 2014-06-17 17:29 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
backtrace (48.60 KB, text/plain)
2014-06-17 16:15 UTC, Egmont Koblinger 		  Details
typescript file as requested by egmont (9.00 KB, application/octet-stream)
2014-06-17 16:37 UTC, Adam Williamson 		  Details
Fix (1.04 KB, patch)
2014-06-17 17:14 UTC, Egmont Koblinger 		none Details | Review

Description Egmont Koblinger 2014-06-17 16:14:30 UTC 
https://bugzilla.redhat.com/show_bug.cgi?id=1110047

"I was ssh'ed into another Fedora box (F19), running htop, and scrolling to the right..."

Crash in _vte_sequence_handler_dc /* Delete a character at the current cursor position. */ => _vte_terminal_cleanup_fragments.

Vte:ERROR:vte.c:2966:_vte_terminal_cleanup_fragments: assertion failed: (end - col == 1 && cell_col->attr.columns == 2)

This code was written by me recently :/  I'll take a look.
Comment 1 Egmont Koblinger 2014-06-17 16:15:00 UTC 
Created attachment 278610 [details]
backtrace
Comment 2 Adam Williamson 2014-06-17 16:37:44 UTC 
Created attachment 278611 [details]
typescript file as requested by egmont

Here's the typescript file egmont requested downstream. It seems to work as a reproducer, for me at least. If I run 'cat typescript' in a gnome-terminal, it crashes. If I run it in xterm or XFCE's Terminal, I see the appropriately formatted htop "screenshot".
Comment 3 Egmont Koblinger 2014-06-17 17:14:01 UTC 
Created attachment 278616 [details] [review]
Fix
Comment 4 Egmont Koblinger 2014-06-17 17:17:42 UTC 
It wasn't the first call to handler_cb that crashed vte right away.  There was a call when the rowdata got corrupted (some empty cells followed by fragment TAB cells, without the leading non-fragment TAB) and this caused a subsequent call to the same method to crash.