nautilus crashed with SIGSEGV in rate_limiter_free()

[Marcos K]

opened nemo

ProblemType: Crash
DistroRelease: Ubuntu 14.04
Package: nautilus 1:3.10.1-0ubuntu9.3
ProcVersionSignature: Ubuntu 3.13.0-40.69-generic 3.13.11.10
Uname: Linux 3.13.0-40-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.5
Architecture: amd64
CurrentDesktop: Unity
Date: Mon Dec 1 23:50:52 2014
ExecutablePath: /usr/bin/nautilus
GsettingsChanges:
 b'org.gnome.nautilus.list-view' b'default-visible-columns' b"['name', 'size', 'type', 'date_modified', 'owner', 'permissions']"
 b'org.gnome.nautilus.list-view' b'default-zoom-level' b"'smallest'"
 b'org.gnome.nautilus.list-view' b'default-column-order' b"['name', 'size', 'type', 'date_modified', 'owner', 'group', 'permissions', 'mime_type', 'where', 'date_accessed']"
InstallationDate: Installed on 2014-02-17 (289 days ago)
InstallationMedia: Lubuntu 13.10 "Saucy Salamander" - Release amd64 (20131016.1)
ProcCmdline: /usr/bin/nautilus --no-default-window
SegvAnalysis:
 Segfault happened at: 0x7f021c0ce414: mov (%rdi),%rdi
 PC (0x7f021c0ce414) ok
 source "(%rdi)" (0x00000000) not located in a known VMA region (needed readable region)!
 destination "%rdi" ok
 Stack memory exhausted (SP below stack segment)
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: nautilus
StacktraceTop:
 ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
 ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
 ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
 g_file_monitor_emit_event () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
 ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
Title: nautilus crashed with SIGSEGV in g_file_monitor_emit_event()
UpgradeStatus: Upgraded to trusty on 2014-05-23 (193 days ago)
UserGroups: adm cdrom dip libvirtd lpadmin nopasswdlogin plugdev sambashare sudo

[Apport retracing service (apport)]

StacktraceTop:
 rate_limiter_free (limiter=0x0) at /build/buildd/glib2.0-2.40.2/./gio/gfilemonitor.c:165
 g_hash_table_foreach_remove_or_steal (hash_table=0x3b60460, func=func@entry=0x7f021c0ce3a0 <foreach_rate_limiter_update>, user_data=user_data@entry=0x7f01fbab3a30, notify=notify@entry=1) at /build/buildd/glib2.0-2.40.2/./glib/ghash.c:1436
 g_hash_table_foreach_remove (hash_table=<optimized out>, func=func@entry=0x7f021c0ce3a0 <foreach_rate_limiter_update>, user_data=user_data@entry=0x7f01fbab3a30) at /build/buildd/glib2.0-2.40.2/./glib/ghash.c:1480
 update_rate_limiter_timeout (monitor=monitor@entry=0x395cf70, new_time=new_time@entry=0) at /build/buildd/glib2.0-2.40.2/./gio/gfilemonitor.c:637
 g_file_monitor_emit_event (monitor=0x395cf70, child=child@entry=0x425db40, other_file=other_file@entry=0x0, event_type=event_type@entry=G_FILE_MONITOR_EVENT_DELETED) at /build/buildd/glib2.0-2.40.2/./gio/gfilemonitor.c:700

[Vlad Orlov (monsta)]

This looks more like a glib2.0 bug. The whole stacktrace is made of the functions from gio or glib.

First g_hash_table_foreach_remove_or_steal function calls g_hash_table_remove_node [1], then it gets to rate_limiter_free function, whose argument ("limiter") equals 0 at that moment for some reason. Right after that it crashes on dereferencing NULL pointer [2].

I can't explain why all that happens, it's all internal glib/gio stuff, but I'm pretty sure something should be corrected in that code.

The similar report from Fedora 20 where glib2.0 is 2.38 and it's another application (caja) that crashes also confirms that the problem is in glib2.0.

[1] https://git.gnome.org/browse/glib/tree/glib/ghash.c?h=glib-2-40#n1436
[2] https://git.gnome.org/browse/glib/tree/gio/gfilemonitor.c?h=glib-2-40#n165