Crash after opening small PNG

[Dan Dascalescu]

I've just built Pinta from the GitHub source.

After I open the attached PNG, Pinta freezes.

[Dan Dascalescu (ddascalescu+launchpad)]

Sorry, submitted too quickly. I'm on Ubuntu 18.04.4. It's the same freeze I experience with Pinta 1.6 (the 2015 build).

[Cameron White (cameronwhite91)]

Does it freeze or crash?
It loads fine for me with the latest build on Ubuntu 18.04, mono version 4.6.2

[Dan Dascalescu (ddascalescu+launchpad)]

It crashes after I simply move the mouse around for a few seconds. I've been seeing this behavior for years, on various flavors of Ubuntu (including Google's Goobuntu in ~2018 when I worked there) Here's the core dump:

$ pinta
Gtk-Message: 05:02:05.056: Failed to load module "canberra-gtk-module"
double free or corruption (out)
Stacktrace:

  at <unknown> <0xffffffff>
  at (wrapper managed-to-native) GLib.SList.g_free (intptr) <0x0005f>
  at GLib.ListBase.Empty () <0x0013c>
  at GLib.ListBase.Dispose (bool) <0x0000f>
  at GLib.ListBase.Finalize () <0x0001d>
  at (wrapper runtime-invoke) object.runtime_invoke_virtual_void__this__ (object,intptr,intptr,intptr) <0x00068>

Native stacktrace:

 /usr/bin/mono(+0xc8514) [0x557e702fb514]
 /lib/x86_64-linux-gnu/libpthread.so.0(+0x12890) [0x7fa62d89d890]
 /lib/x86_64-linux-gnu/libc.so.6(gsignal+0xc7) [0x7fa62d2c0e97]
 /lib/x86_64-linux-gnu/libc.so.6(abort+0x141) [0x7fa62d2c2801]
 /lib/x86_64-linux-gnu/libc.so.6(+0x89897) [0x7fa62d30b897]
 /lib/x86_64-linux-gnu/libc.so.6(+0x9090a) [0x7fa62d31290a]
 /lib/x86_64-linux-gnu/libc.so.6(cfree+0x525) [0x7fa62d319e75]
 [0x41672c00]

Debug info from gdb:

[New LWP 30985]
[New LWP 30986]
[New LWP 30987]
[New LWP 30988]
[New LWP 31067]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
__lll_lock_wait_private () at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:95
95 ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S: No such file or directory.
  Id Target Id Frame
* 1 Thread 0x7fa62e453780 (LWP 30984) "Main" __lll_lock_wait_private () at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:95
  2 Thread 0x7fa62c3ff700 (LWP 30985) "SGen worker" 0x00007fa62d8989f3 in futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x557e707eea08) at ../sysdeps/unix/sysv/linux/futex-internal.h:88
  3 Thread 0x7fa62a034700 (LWP 30986) "Finalizer" 0x00007fa62d89d23a in __waitpid (pid=31083, stat_loc=0x7fa62a03276c, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:30
  4 Thread 0x7fa61c780700 (LWP 30987) "gmain" 0x00007fa62d396bf9 in __GI___poll (fds=0x557e725575c0, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
  5 Thread 0x7fa61bf7f700 (LWP 30988) "gdbus" 0x00007fa62d396bf9 in __GI___poll (fds=0x557e72561f70, nfds=3, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
  6 Thread 0x7fa607fff700 (LWP 31067) "pool" syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38

Thread 6 (Thread 0x7fa607fff700 (LWP 31067)):
#0 0x00007fa62d39d839 in syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1 0x00007fa622de487a in g_cond_wait_until () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#2 0x00007fa622d71571 in () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3 0x00007fa622d71b2c in g_async_queue_timeout_pop () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#4 0x00007fa622dc6c1e in () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#5 0x00007fa622dc6175 in () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#6 0x00007fa62d8926db in start_thread (arg=0x7fa607fff700) at pthread_create.c:463
#7 0x00007fa62d3a388f in clone () at ../sysdeps/unix/...

[Cameron White (cameronwhite91)]

I think this is the same as bug 1857149, which crashes somewhere in mono's garbage collection