scim-chewing will crash GNOME terminal.

[Shih-Yuan Lee]

Binary package hint: gnome-terminal

scim-chewing will crash GNOME terminal when I input chinese with scim-chewing.

ProblemType: Bug
Architecture: i386
Date: Tue Jun 19 19:49:39 2007
DistroRelease: Ubuntu 7.04
ExecutablePath: /usr/bin/gnome-terminal
Package: gnome-terminal 2.18.0-0ubuntu1
PackageArchitecture: i386
ProcCmdline: gnome-terminal
ProcCwd: /home/ubuntu
ProcEnviron:
 LANGUAGE=zh_TW:zh
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games
 LANG=zh_TW.UTF-8
 SHELL=/bin/bash
SourcePackage: gnome-terminal
Uname: Linux sumomo 2.6.20-16-386 #2 Thu Jun 7 20:16:13 UTC 2007 i686 GNU/Linux

[Micah Cowan (micahcowan)]

I have noticed the same problem with scim-anthy (for Japanese input), as well. This used to work, but when I don't remember. I don't see any recent package updates to either gnome-terminal, libvte-common or scim.

I don't seem to be able to reliably reproduce it, however, it appears at this time that the Japanese comma can tend to invoke the problem. Backspacing and retyping may also help, perhaps. At some random points, the currently-input text becomes an opaque white box (none of the text visible), and then later is visible again (after more typing). This is true of xfce4-terminal as well, which also crashes.

When running xfce4-terminal within gnome-terminal, I managed to get a "*** glibc detected *** xfce4-terminal: munmap_chunk(): invalid pointer: 0x08439c40 ***", followed by a "backtrace" that was not very informative (possibly because I don't have the debug symbols). After installing the debug symbols (for it and libvte), I was unable to reproduce that same crash. I also got "*** glibc detected *** xfce4-terminal: corrupted double-linked list: 0x0823aa20 ***" without a backtrace.

I also get random messages like (xfce4-terminal:18241): Vte-WARNING **: Can not find appropiate font for character U+823a2c0." or "...for character U+0019" (the former could never be a valid Unicode character, the latter is Ctrl+Y).

I'm reassigning to vte, since the same problem is in xfce4-terminal.

[Micah Cowan (micahcowan)]

Here is valgrind output (xfce4-terminal did not crash for this run, but valgrind seems to have found plenty to complain about). The test was to type the text, "echo 今日は、田中さん" ("Hello, Mr Tanaka"), twice, then exit via Ctrl+D.

[Micah Cowan (micahcowan)]

BTW, I checked to see if the "U+823a2c0" could have been some strange combination of actual Unicode characters involved in the text I typed; this does not appear to be the case.

[Sebastien Bacher (seb128)]

==19308== Invalid read of size 2
==19308== at 0x40F3DE5: vte_terminal_draw_cells (vte.c:8936)
==19308== by 0x40FD075: vte_terminal_expose (vte.c:10097)
==19308== by 0x42CE6AF: _gtk_marshal_BOOLEAN__BOXED (in /usr/lib/libgtk-x11-2.0.so.0.1000.11)
==19308== by 0x4693E48: (within /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x469562A: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x46A6752: (within /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x46A73EE: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x46A77E8: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x43E2E17: (within /usr/lib/libgtk-x11-2.0.so.0.1000.11)
==19308== by 0x42C8DE3: gtk_main_do_event (in /usr/lib/libgtk-x11-2.0.so.0.1000.11)
==19308== by 0x451264E: (within /usr/lib/libgdk-x11-2.0.so.0.1000.11)
==19308== by 0x4512886: gdk_window_process_all_updates (in /usr/lib/libgdk-x11-2.0.so.0.1000.11)
==19308== by 0x4512904: (within /usr/lib/libgdk-x11-2.0.so.0.1000.11)
==19308== by 0x46F2090: (within /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x46F3DF1: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x46F6DCE: (within /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x46F7178: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x42C9043: gtk_main (in /usr/lib/libgtk-x11-2.0.so.0.1000.11)
==19308== by 0x80533DC: main (main.c:277)
==19308== Address 0x75AC2D0 is 4 bytes after a block of size 36 alloc'd
==19308== at 0x4020620: malloc (vg_replace_malloc.c:149)
==19308== by 0x46FB2C5: g_malloc (in /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x40FCD6B: vte_terminal_expose (vte.c:10065)
==19308== by 0x42CE6AF: _gtk_marshal_BOOLEAN__BOXED (in /usr/lib/libgtk-x11-2.0.so.0.1000.11)
==19308== by 0x4693E48: (within /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x469562A: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x46A6752: (within /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x46A73EE: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x46A77E8: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.1200.11)
==19308== by 0x43E2E17: (within /usr/lib/libgtk-x11-2.0.so.0.1000.11)
==19308== by 0x42C8DE3: gtk_main_do_event (in /usr/lib/libgtk-x11-2.0.so.0.1000.11)
==19308== by 0x451264E: (within /usr/lib/libgdk-x11-2.0.so.0.1000.11)
==19308== by 0x4512886: gdk_window_process_all_updates (in /usr/lib/libgdk-x11-2.0.so.0.1000.11)
==19308== by 0x4512904: (within /usr/lib/libgdk-x11-2.0.so.0.1000.11)
==19308== by 0x46F2090: (within /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x46F3DF1: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x46F6DCE: (within /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x46F7178: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.1200.11)
==19308== by 0x42C9043: gtk_main (in /usr/lib/libgtk-x11-2.0.so.0.1000.11)
==19308== by 0x80533DC: main (main.c:277)

[Sebastien Bacher (seb128)]

I've sent the bug upstream, http://bugzilla.gnome.org/show_bug.cgi?id=449433

[Sebastien Bacher (seb128)]

Upstream think it looks like http://bugzilla.gnome.org/show_bug.cgi?id=433776, could you try if that's still happening with the gutsy version?

[Micah Cowan (micahcowan)]

Running under QEMU, I confirmed the bug in Feisty, and then after upgrading to Gutsy, confirmed that it appears to be working correctly.

[Sebastien Bacher (seb128)]

marking fixed then