Segfault in LauncherIcon::TextureFromSpecificGtkTheme

[Sam Spilsbury]

==29781== Invalid read of size 1
==29781== at 0x8056C47: g_type_check_instance_cast (gtype.c:4033)
==29781== by 0x16DFC154: unity::launcher::LauncherIcon::TextureFromSpecificGtkTheme(_GtkIconTheme*, std::string const&, int, bool, bool) (LauncherIcon.cpp:432)
==29781== by 0x16DFC450: unity::launcher::LauncherIcon::TextureFromGtkTheme(std::string, int, bool) (LauncherIcon.cpp:379)
==29781== by 0x16E12998: unity::launcher::SimpleLauncherIcon::GetTextureForSize(int) (SimpleLauncherIcon.cpp:108)
==29781== by 0x16F0568F: unity::ui::IconRenderer::RenderIcon(nux::GraphicsEngine&, unity::ui::RenderArg const&, nux::Rect const&, nux::Rect const&) (IconRenderer.cpp:446)
==29781== by 0x16DD9D89: unity::launcher::Launcher::DrawContent(nux::GraphicsEngine&, bool) (Launcher.cpp:1871)
==29781== by 0x18754831: nux::View::ProcessDraw(nux::GraphicsEngine&, bool) (View.cpp:253)
==29781== by 0x1873820C: nux::Layout::ProcessDraw(nux::GraphicsEngine&, bool) (Layout.cpp:581)
==29781== by 0x18713BB7: nux::BaseWindow::DrawContent(nux::GraphicsEngine&, bool) (BaseWindow.cpp:142)
==29781== by 0x18754831: nux::View::ProcessDraw(nux::GraphicsEngine&, bool) (View.cpp:253)
==29781== by 0x18758386: nux::WindowCompositor::RenderTopViewContent(nux::BaseWindow*, bool) (WindowCompositor.cpp:1553)
==29781== by 0x1875F8EE: nux::WindowCompositor::RenderTopViews(bool, std::list<nux::ObjectWeakPtr<nux::BaseWindow>, std::allocator<nux::ObjectWeakPtr<nux::BaseWindow> > >&, bool) (WindowCompositor.cpp:1654)
==29781== Address 0x6168732f72737542 is not stack'd, malloc'd or (recently) free'd
==29781==
==29781==
==29781== Process terminating with default action of signal 11 (SIGSEGV)
==29781== General Protection Fault
==29781== at 0x8056C47: g_type_check_instance_cast (gtype.c:4033)
==29781== by 0x16DFC154: unity::launcher::LauncherIcon::TextureFromSpecificGtkTheme(_GtkIconTheme*, std::string const&, int, bool, bool) (LauncherIcon.cpp:432)
==29781== by 0x16DFC450: unity::launcher::LauncherIcon::TextureFromGtkTheme(std::string, int, bool) (LauncherIcon.cpp:379)
==29781== by 0x16E12998: unity::launcher::SimpleLauncherIcon::GetTextureForSize(int) (SimpleLauncherIcon.cpp:108)
==29781== by 0x16F0568F: unity::ui::IconRenderer::RenderIcon(nux::GraphicsEngine&, unity::ui::RenderArg const&, nux::Rect const&, nux::Rect const&) (IconRenderer.cpp:446)
==29781== by 0x16DD9D89: unity::launcher::Launcher::DrawContent(nux::GraphicsEngine&, bool) (Launcher.cpp:1871)
==29781== by 0x18754831: nux::View::ProcessDraw(nux::GraphicsEngine&, bool) (View.cpp:253)
==29781== by 0x1873820C: nux::Layout::ProcessDraw(nux::GraphicsEngine&, bool) (Layout.cpp:581)
==29781== by 0x18713BB7: nux::BaseWindow::DrawContent(nux::GraphicsEngine&, bool) (BaseWindow.cpp:142)
==29781== by 0x18754831: nux::View::ProcessDraw(nux::GraphicsEngine&, bool) (View.cpp:253)
==29781== by 0x18758386: nux::WindowCompositor::RenderTopViewContent(nux::BaseWindow*, bool) (WindowCompositor.cpp:1553)
==29781== by 0x1875F8EE: nux::WindowCompositor::RenderTopViews(bool, std::list<nux::ObjectWeakPtr<nux::BaseWindow>, std::allocator<nux::ObjectWeakPtr<nux::BaseWindow> > >&, bool) (WindowCompositor.cpp:1654)

GtkIconInfo * is released with g_object_unref, but its not actually a GObject. It should be released with gtk_icon_info_free

[Sam Spilsbury (smspillaz)]

g_object_clear / g_object_unref is broken on < 3.8 and gtk_icon_info_free is deprecated on >= 3.8. I like it when libraries do this. We'll have to ifdef it.

[PS Jenkins bot (ps-jenkins)]

Fix committed into lp:unity at revision None, scheduled for release in unity, milestone 7.1.0

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.0.0daily13.06.07-0ubuntu1

---------------
unity (7.0.0daily13.06.07-0ubuntu1) saucy; urgency=low

  [ Ted Gould ]
  * gtk_icon_info_free() is deprecated for g_object_unref().
  * Upstart event for when the indicators are loaded by the panel
    service.
  * Add an upstart job to unity-common.
  * Manage Unity Panel Service's lifecycle with Upstart.

  [ Didier Roche ]
  * add dep on autopilot-desktop.
  * Revert the panel on upstart from ted, it doesn't respawn as expected
    when another service try to communicate with the panel service and
    the consequence is a lot of tests failing

  [ Nick Dedekind ]
  * Uses a gobject weak ref to test for object deletion in the
    GLibObject tests. Previously was checking with G_IS_OBJECT on an
    invalid pointer, which was causing a segfault

  [ Manuel de la Pena ]
  * Adds support for payment previews that will allow users to buy music
    from within the dash. .

  [ Mathieu Trudel-Lapierre ]
  * Increase timeouts for hud functional and search tests.

  [ Francis Ginther ]
  * Handle StateNotFoundError when querying the label of a hud button.

  [ Łukasz 'sil2100' Zemczak ]
  * Now that we're using the new HUD, there have been some changes that
    typically cause test_hud tests to fail. Fix the tests to fit the new
    model. The first one is that generally we do not have indicator
    entries visible in the HUD anymore. Only application menu entries
    are in it now. The second one - the way the results are displayed is
    different. Now, instead of "Menu > Entry" we have "Entry (Menu)"
    etc.
  * Fix two HUD failures related to HUD slow action activation.
  * Fix some autopilot test failures, some related to test_shortcut_hint
    and some to test_scroll in launcher.
  * Modify all the hud_query_check lambdas to be more smart and error-
    checking. Same for the selected_hud_button method in the HUD
    emulator. Also, get rid of the troublesome test_gedit_undo and
    change it into test_gedit_save, which is easier to test and anyway
    tests what we want. Besides that we also now try to handle the
    StateNotFoundError exception in the HUD emulator, another cause of
    some AP failures.
  * Add a flag for -Wno-error=unused-local-typedefs, since this causes a
    FTBFS on ARM

  [ Michal Hruby ]
  * Don't activate a result twice after pressing Enter. (LP: #1188191)

  [ Sebastien Bacher ]
  * Use '%s:' string for preview hints, rather than just appending ':'.
    (LP: #1074038)

  [ Marco Trevisan (Treviño) ]
  * IconRenderer: preprocess an icon if its emblem has been shown/hidden
    In that way we can update its transformation. (LP: #1171476,
    #1171663)
  * UnityWindow: don't draw the panel shadow above a fullscreen window.
    (LP: #1171934)
  * UnityCore: add GtkWrapper to handle GtkIconInfo correctly for
    different GTK versions Fix a memory leak in LauncherIcon. (LP:
    #1180790)
  * SwitcherController: use proper long long types for
    WindowActiveNumber Otherwise an overflow can cause bad window
    selection after long uptime.
  * Unity: "s/unsigned long long/uint64_t/g".

  [ Chris Townsend ]
  * Fixes issue where minimiz...

[Stephen M. Webb (bregma)]

Fix Released in Unity Unity 7.1.0.

[Rolf Leggewie (r0lf)]

raring has seen the end of its life and is no longer receiving any updates. Marking the raring task for this ticket as "Won't Fix".