System settings crashes after quickly backing out of storage

[Chris Gagnon]

summary:
System settings crashes after quickly backing out of storage

steps:
1. open system-settings
2. select about this phone
3. select storage
4. quickly tap back arrow on header a few times

expected results:
system settings is on main page and does not crash

actual results:
system settings crashes

version info can be seen @:
https://errors.ubuntu.com/oops/2d7649ec-48d9-11e4-8cd6-fa163e373683

[Pat McGowan (pat-mcgowan)]

To reproduce this I had to start tapping the spot where back would appear before the panel actually got displayed.
I'd like to lower the importance as it is not likely in the field and user simlpy restarts the app, please comment if you think otherwise.

[Chris Gagnon (chris.gagnon)]

When the app crashes the UI becomes unusable, there are a lot of crashes in the system-settings app in the long running tests.

Unless this is fixed we probably won't be able to reach our goal of 12 hours without failure on the long running tests.

[Joe Odukoya (jodukoya)]

Sorry Pat but I'd like to move this back to Critical.

1 - For the reasons Chris mentioned above (we need to improve the overall system stability and areas like this mount up)
2 - I managed to reproduce this very easily with just a double tap (basically simulating a user that presses on Storage, realises they did not mean to and taps on the back button, as nothing happens immediately they tap again and the system app crashes).

[Pat McGowan (pat-mcgowan)]

Ok thanks for the feedback

[Sebastien Bacher (seb128)]

The issue there seems to be in the storageabout backend destructor, the cancellable disconnect isn't effective but the function returns anyway, the structures are freed and when the callback come later they try to free things that are not there anymore which segfaults

[Sebastien Bacher (seb128)]

valgrind shows an invalid free on the delete of that code

" if (err != nullptr) {
        if (g_error_matches (err, G_IO_ERROR, G_IO_ERROR_CANCELLED)) {
            delete data->running;"

[Sebastien Bacher (seb128)]

Laney wrote that code/started looking for a fix, reassigning to him, thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-system-settings - 0.3+14.10.20141003-0ubuntu1

---------------
ubuntu-system-settings (0.3+14.10.20141003-0ubuntu1) utopic; urgency=low

  [ Iain Lane ]
  * [storage/about] Use a QSharedPointer to manage freeing of the
    counter which we use to display all of the collected sizes at once.
    If the measuring process was cancelled, we were freeing it multiple
    times - once for each outstanding size measurement. This led to a
    crash. (LP: #1375988)
  * [security-privacy] Link with gobject, uses symbols from this
    library. Prevents "[…]libUbuntuSecurityPrivacyPanel.so contains an
    unresolvable reference to symbol
    g_signal_handlers_disconnect_matched: it's probably a plugin"
    warnings.
 -- Ubuntu daily release <email address hidden> Fri, 03 Oct 2014 13:52:42 +0000