GNOME Bugzilla – Bug 746013
Invalid write of size 8
Last modified: 2015-03-11 10:49:04 UTC
Valgrind claims this when running evolution under it. Invalid writes (use-after-free) can cause bad crashes, due to memory corruption, as you know. This is gtk3-3.15.10-1.fc23.x86_64 ==2434== Invalid write of size 8 ==2434== at 0xF41B1D5: g_nullify_pointer (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xF15EE4E: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF161B48: g_object_run_dispose (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD4FE67E: gtk_box_forall (gtkbox.c:2558) ==2434== by 0xD54B790: gtk_container_destroy (gtkcontainer.c:1524) ==2434== by 0xF15AE9E: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF16DC05: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17613F: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17650E: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD76D497: gtk_widget_dispose (gtkwidget.c:11949) ==2434== by 0xF161B48: g_object_run_dispose (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD5BD4DE: gtk_frame_forall (gtkframe.c:368) ==2434== by 0xD54B790: gtk_container_destroy (gtkcontainer.c:1524) ==2434== by 0xF15AF44: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF16DC05: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17613F: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17650E: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD76D497: gtk_widget_dispose (gtkwidget.c:11949) ==2434== by 0xF16002B: g_object_unref (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD54999F: gtk_container_remove (gtkcontainer.c:1737) ==2434== by 0x4E54FDE: ??? (in /usr/lib64/evolution/libevolution-shell.so) ==2434== by 0xF15EE4E: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF16002B: g_object_unref (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0x2D6266C0: ??? (in /usr/lib64/evolution/libevolution-mail.so) ==2434== by 0x2D62678C: ??? (in /usr/lib64/evolution/libevolution-mail.so) ==2434== by 0xEE4C393: ??? (in /usr/lib64/libgio-2.0.so.0.4391.0) ==2434== by 0xEE4C3B8: ??? (in /usr/lib64/libgio-2.0.so.0.4391.0) ==2434== by 0xF3E7229: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xF3E75BF: ??? (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xF3E78E1: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xD60B7D4: gtk_main (gtkmain.c:1219) ==2434== by 0x10C7BD: main (in /usr/bin/evolution) ==2434== Address 0x366b37b0 is 176 bytes inside a block of size 224 free'd ==2434== at 0x4C2CD29: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==2434== by 0xF3ECF3E: g_free (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xF40484C: g_slice_free1 (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xF17CFD6: g_type_free_instance (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD50B9C8: gtk_button_destroy (gtkbutton.c:708) ==2434== by 0xF15AE9E: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF16DC05: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17613F: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17650E: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD76D497: gtk_widget_dispose (gtkwidget.c:11949) ==2434== by 0xF161B48: g_object_run_dispose (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD4FE67E: gtk_box_forall (gtkbox.c:2558) ==2434== by 0xD54B790: gtk_container_destroy (gtkcontainer.c:1524) ==2434== by 0xF15AE9E: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF16DC05: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17613F: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17650E: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD76D497: gtk_widget_dispose (gtkwidget.c:11949) ==2434== by 0xF161B48: g_object_run_dispose (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD5BD4DE: gtk_frame_forall (gtkframe.c:368) ==2434== by 0xD54B790: gtk_container_destroy (gtkcontainer.c:1524) ==2434== by 0xF15AF44: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF16DC05: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17613F: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF17650E: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD76D497: gtk_widget_dispose (gtkwidget.c:11949) ==2434== by 0xF16002B: g_object_unref (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xD54999F: gtk_container_remove (gtkcontainer.c:1737) ==2434== by 0x4E54FDE: ??? (in /usr/lib64/evolution/libevolution-shell.so) ==2434== by 0xF15EE4E: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0xF16002B: g_object_unref (in /usr/lib64/libgobject-2.0.so.0.4391.0) ==2434== by 0x2D6266C0: ??? (in /usr/lib64/evolution/libevolution-mail.so) ==2434== by 0x2D62678C: ??? (in /usr/lib64/evolution/libevolution-mail.so) ==2434== by 0xEE4C393: ??? (in /usr/lib64/libgio-2.0.so.0.4391.0) ==2434== by 0xEE4C3B8: ??? (in /usr/lib64/libgio-2.0.so.0.4391.0) ==2434== by 0xF3E7229: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xF3E75BF: ??? (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xF3E78E1: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.4391.0) ==2434== by 0xD60B7D4: gtk_main (gtkmain.c:1219) ==2434== by 0x10C7BD: main (in /usr/bin/evolution)
gtk3-demo exhibits the same issue, when changing the demo in the left tree.
(In reply to Milan Crha from comment #0) > Valgrind claims this when running evolution under it. Invalid writes > (use-after-free) can cause bad crashes, due to memory corruption, as you > know. This is gtk3-3.15.10-1.fc23.x86_64 > > ==2434== Invalid write of size 8 > ==2434== at 0xF41B1D5: g_nullify_pointer (in > /usr/lib64/libglib-2.0.so.0.4391.0) > ==2434== by 0xF15EE4E: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) > ==2434== by 0xF161B48: g_object_run_dispose (in > /usr/lib64/libgobject-2.0.so.0.4391.0) > ==2434== by 0xD4FE67E: gtk_box_forall (gtkbox.c:2558) > ==2434== by 0xD54B790: gtk_container_destroy (gtkcontainer.c:1524) > ==2434== by 0xF15AE9E: g_closure_invoke (in > /usr/lib64/libgobject-2.0.so.0.4391.0) > ==2434== by 0xF16DC05: ??? (in /usr/lib64/libgobject-2.0.so.0.4391.0) > ==2434== by 0xF17613F: g_signal_emit_valist (in > /usr/lib64/libgobject-2.0.so.0.4391.0) > ==2434== by 0xF17650E: g_signal_emit (in > /usr/lib64/libgobject-2.0.so.0.4391.0) > ==2434== by 0xD76D497: gtk_widget_dispose (gtkwidget.c:11949) Wild guess. I think this is because we are not removing the weak pointers that we added here: commit 7c4bf742e82d812ecc5b0c3280db86d2689eb093 Author: Debarshi Ray <debarshir@gnome.org> Date: Sun Mar 1 13:28:21 2015 +0100 eventcontroller, widget: Don't crash if destroyed before the other There are two scenarios. A widget sub-class owns a GtkEventController and passes itself to it, or a controller owned by something else is passed a widget. In the second case, if the widget is destroyed before the controller, we will have a crash when destructing the controller because we will be accessing invalid memory. Adding a weak reference on the widget addresses that problem. This leads to a crash in the first case. When the widget is getting destroyed, it will drop the reference to its own controller. The controller will skip touching the widget because the weak reference would have turned it to NULL. However, when the widget sub-class chains up to GtkWidget it will try to free all the controllers in its list. Unfortunately, all these controllers have already been destroyed. So we need to guard against this too. https://bugzilla.gnome.org/show_bug.cgi?id=745225