gallery-app crashed with SIGSEGV in ubuntu::application::mir::client::ua_ui_window_mir_handle_event()

[Jean-Baptiste Lallement]

TEST CASE:
1. Take a photo
2. Open system-settings -> background
3. In the gallery select a picture then 'Pick'

ProblemType: Crash
DistroRelease: Ubuntu 13.10
Package: gallery-app 0.0.67+13.10.20131001.3-0ubuntu1
Uname: Linux 3.4.0-3-mako armv7l
ApportVersion: 2.12.5-0ubuntu1
Architecture: armhf
Date: Mon Oct 7 08:06:36 2013
ExecutablePath: /usr/bin/gallery-app
ExecutableTimestamp: 1380657668
InstallationDate: Installed on 2013-10-05 (1 days ago)
InstallationMedia: Ubuntu Saucy Salamander (development branch) - armhf (20131005)
MarkForUpload: True
ProcCmdline: gallery-app --fullscreen
ProcCwd: /home/phablet
Signal: 11
SourcePackage: gallery-app
StacktraceTop:
 ?? ()
 ?? () from /usr/lib/arm-linux-gnueabihf/libubuntu_application_api_mirclient.so.1
 MirSurface::handle_event(MirEvent const&) () from /usr/lib/arm-linux-gnueabihf/libmirclient.so.3
 mir::client::ConnectionSurfaceMap::with_surface_do(int const&, std::function<void (MirSurface*)>) () from /usr/lib/arm-linux-gnueabihf/libmirclient.so.3
 mir::client::rpc::MirSocketRpcChannel::process_event_sequence(std::string const&) () from /usr/lib/arm-linux-gnueabihf/libmirclient.so.3
Title: gallery-app crashed with SIGSEGV in MirSurface::handle_event()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm autopilot cdrom dialout dip nopasswdlogin plugdev sudo tty video

[Apport retracing service (apport)]

StacktraceTop:
 ?? ()
 ubuntu::application::mir::client::ua_ui_window_mir_handle_event (surface=<optimized out>, mir_ev=<optimized out>, ctx=0x1884da8) at /build/buildd/platform-api-0.19+13.10.20131003/src/ubuntu/mirclient/window_mirclient.cpp:53
 MirSurface::handle_event(MirEvent const&) () at /build/buildd/mir-0.0.13+13.10.20131003/src/client/mir_surface.cpp:382
 mir::client::ConnectionSurfaceMap::with_surface_do(int const&, std::function<void (MirSurface*)>) () at /usr/include/c++/4.8/functional:2468
 mir::client::rpc::MirSocketRpcChannel::process_event_sequence(std::string const&) () at /build/buildd/mir-0.0.13+13.10.20131003/src/client/rpc/mir_socket_rpc_channel.cpp:400

[Jean-Baptiste Lallement (jibel)]

Setting to critical because the device is unusable when picking an image which is a very common task.

[Alexandros Frantzis (afrantzis)]

Haven't verified yet, but the problem seems to be that the ubuntu::application::mir::client:Window class destroys the InputContext before destroying the SurfacePtr, i.e., the order of the two variables is incorrect in the class.

[Alexandros Frantzis (afrantzis)]

> Haven't verified yet, but the problem seems to be that the ubuntu::application::mir::client:Window class
> destroys the InputContext before destroying the SurfacePtr, i.e., the order of the two variables is incorrect in the class.

That's in the platform-api project in src/ubuntu/mirclient/window_mirclient_priv.h .

[Alexandros Frantzis (afrantzis)]

Note that after applying the fix for this bug (see https://code.launchpad.net/~afrantzis/platform-api/fix-1236225/+merge/189954) you may stumble into bug 1237052 .

[Launchpad Janitor (janitor)]

This bug was fixed in the package platform-api - 0.19+13.10.20131009.2-0ubuntu1

---------------
platform-api (0.19+13.10.20131009.2-0ubuntu1) saucy; urgency=low

  [ Ubuntu daily release ]
  * New rebuild forced

  [ Kevin Gunn ]
  * bump mir build dep 0.0.14.

  [ Alexandros Frantzis ]
  * mirclient: Release Window resources in the proper order Release the
    InputContext after releasing the Surface that is using the
    InputContext in its event callback. Otherwise we get a crash when an
    input event comes to the Surface after the InputContext is
    destroyed, but before the Surface itself has been destroyed. (LP:
    #1236225)

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 161
 -- Ubuntu daily release <email address hidden> Wed, 09 Oct 2013 23:16:04 +0000

[Jean-Baptiste Lallement (jibel)]

I cannot reproduce in build 100