wireshark: Segfault on exit

[Dave Gilbert]

Binary package hint: wireshark

Version: 1.0.7-1ubuntu1 (In Karmic)

As a normal non-root user, start up wireshark, click the close x on the window.
In the console it started from is:

GLib-GObject-WARNING **: invalid uninstantiatable type `(null)' in cast to `GtkList'

[1]+ Segmentation fault wireshark

Backtrace in gdb:

#0 0x00007f9f3871edde in ?? () from /usr/lib/gtk-2.0/modules/libgail.so
#1 0x00007f9f387145e1 in ?? () from /usr/lib/gtk-2.0/modules/libgail.so
#2 0x00007f9f41f8f4df in gtk_widget_real_get_accessible (widget=0x23e5d40)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkwidget.c:9376
#3 0x00007f9f38720263 in ?? () from /usr/lib/gtk-2.0/modules/libgail.so
#4 0x00007f9f4038362e in IA__g_closure_invoke (closure=0x23f3de0,
    return_value=0x0, n_param_values=2, param_values=0x247d030,
    invocation_hint=0x7fff4c101540)
    at /build/buildd/glib2.0-2.21.1/gobject/gclosure.c:767
#5 0x00007f9f40399836 in signal_emit_unlocked_R (node=0x1662830,
    detail=<value optimized out>, instance=<value optimized out>,
    emission_return=<value optimized out>,
    instance_and_params=<value optimized out>)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:3247
#6 0x00007f9f4039ac7e in IA__g_signal_emit_valist (instance=0x23e1480,
    signal_id=<value optimized out>, detail=0, var_args=0x7fff4c101730)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:2980
#7 0x00007f9f4039b203 in IA__g_signal_emit (instance=0x24eb000,
    signal_id=36841344, detail=0)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:3037
#8 0x00007f9f41f8ca9e in gtk_widget_dispose (object=0x23e5d40)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkwidget.c:7898
#9 0x00007f9f40385ad0 in IA__g_object_run_dispose (object=0x23e5d40)
---Type <return> to continue, or q <return> to quit---
    at /build/buildd/glib2.0-2.21.1/gobject/gobject.c:789
#10 0x00007f9f41f33202 in gtk_toolbar_forall (container=<value optimized out>,
    include_internals=0, callback=0x7f9f41f8b0c0 <IA__gtk_widget_destroy>,
    callback_data=0x0) at /build/buildd/gtk+2.0-2.17.0/gtk/gtktoolbar.c:2541
#11 0x00007f9f41dcf0e6 in gtk_container_destroy (object=0x23e1480)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkcontainer.c:1066
#12 0x00007f9f40383579 in IA__g_closure_invoke (closure=0x1658f00,
    return_value=0x0, n_param_values=1, param_values=0x23ef3a0,
    invocation_hint=0x7fff4c1019d0)
    at /build/buildd/glib2.0-2.21.1/gobject/gclosure.c:767
#13 0x00007f9f40399b96 in signal_emit_unlocked_R (node=0x1658f90,
    detail=<value optimized out>, instance=<value optimized out>,
    emission_return=<value optimized out>,
    instance_and_params=<value optimized out>)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:3363
#14 0x00007f9f4039ac7e in IA__g_signal_emit_valist (instance=0x23e1480,
    signal_id=<value optimized out>, detail=0, var_args=0x7fff4c101bc0)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:2980
#15 0x00007f9f4039b203 in IA__g_signal_emit (instance=0x24eb000,
    signal_id=36841344, detail=0)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:3037
#16 0x00007f9f41e89f0e in gtk_object_dispose (gobject=0x23e1480)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkobject.c:421
---Type <return> to continue, or q <return> to quit---
#17 0x00007f9f40385ad0 in IA__g_object_run_dispose (object=0x23e1480)
    at /build/buildd/glib2.0-2.21.1/gobject/gobject.c:789
#18 0x00007f9f41d983f3 in gtk_box_forall (container=<value optimized out>,
    include_internals=<value optimized out>,
    callback=0x7f9f41f8b0c0 <IA__gtk_widget_destroy>, callback_data=0x0)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkbox.c:1249
#19 0x00007f9f41dcf0e6 in gtk_container_destroy (object=0x167b320)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkcontainer.c:1066
#20 0x00007f9f40383579 in IA__g_closure_invoke (closure=0x1658f00,
    return_value=0x0, n_param_values=1, param_values=0x246dc20,
    invocation_hint=0x7fff4c101e60)
    at /build/buildd/glib2.0-2.21.1/gobject/gclosure.c:767
#21 0x00007f9f40399b96 in signal_emit_unlocked_R (node=0x1658f90,
    detail=<value optimized out>, instance=<value optimized out>,
    emission_return=<value optimized out>,
    instance_and_params=<value optimized out>)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:3363
#22 0x00007f9f4039ac7e in IA__g_signal_emit_valist (instance=0x167b320,
    signal_id=<value optimized out>, detail=0, var_args=0x7fff4c102050)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:2980
#23 0x00007f9f4039b203 in IA__g_signal_emit (instance=0x24eb000,
    signal_id=36841344, detail=0)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:3037
---Type <return> to continue, or q <return> to quit---
#24 0x00007f9f41e89f0e in gtk_object_dispose (gobject=0x167b320)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkobject.c:421
#25 0x00007f9f40385ad0 in IA__g_object_run_dispose (object=0x167b320)
    at /build/buildd/glib2.0-2.21.1/gobject/gobject.c:789
#26 0x00007f9f41dcf0e6 in gtk_container_destroy (object=0x16af2c0)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkcontainer.c:1066
#27 0x00007f9f4038362e in IA__g_closure_invoke (closure=0x1658f00,
    return_value=0x0, n_param_values=1, param_values=0x246dea0,
    invocation_hint=0x7fff4c1022c0)
    at /build/buildd/glib2.0-2.21.1/gobject/gclosure.c:767
#28 0x00007f9f40399b96 in signal_emit_unlocked_R (node=0x1658f90,
    detail=<value optimized out>, instance=<value optimized out>,
    emission_return=<value optimized out>,
    instance_and_params=<value optimized out>)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:3363
#29 0x00007f9f4039ac7e in IA__g_signal_emit_valist (instance=0x16af2c0,
    signal_id=<value optimized out>, detail=0, var_args=0x7fff4c1024b0)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:2980
#30 0x00007f9f4039b203 in IA__g_signal_emit (instance=0x24eb000,
    signal_id=36841344, detail=0)
    at /build/buildd/glib2.0-2.21.1/gobject/gsignal.c:3037
#31 0x00007f9f41e89f0e in gtk_object_dispose (gobject=0x16af2c0)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkobject.c:421
---Type <return> to continue, or q <return> to quit---
#32 0x00007f9f40385ad0 in IA__g_object_run_dispose (object=0x16af2c0)
    at /build/buildd/glib2.0-2.21.1/gobject/gobject.c:789
#33 0x00007f9f41e5a022 in IA__gtk_main_do_event (event=0x24efc30)
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkmain.c:1549
#34 0x00007f9f41ab490c in gdk_event_dispatch (source=<value optimized out>,
    callback=<value optimized out>, user_data=<value optimized out>)
    at /build/buildd/gtk+2.0-2.17.0/gdk/x11/gdkevents-x11.c:2364
#35 0x00007f9f3fce18be in IA__g_main_context_dispatch (context=0x164eb50)
    at /build/buildd/glib2.0-2.21.1/glib/gmain.c:1814
#36 0x00007f9f3fce4f98 in g_main_context_iterate (context=0x164eb50,
    block=<value optimized out>, dispatch=<value optimized out>,
    self=<value optimized out>)
    at /build/buildd/glib2.0-2.21.1/glib/gmain.c:2445
#37 0x00007f9f3fce53f5 in IA__g_main_loop_run (loop=0x24ec4f0)
    at /build/buildd/glib2.0-2.21.1/glib/gmain.c:2653
#38 0x00007f9f41e5a2b7 in IA__gtk_main ()
    at /build/buildd/gtk+2.0-2.17.0/gtk/gtkmain.c:1205
#39 0x0000000000449ac3 in main ()

[Dave Gilbert (ubuntu-treblig)]

This might be more related to a generic libgail problem - I'm seeing rhythmbox and sound-juicer also crashing in libgail.
These kicked in maybe about 2 weeks ago.

Dave

[Dave Gilbert (ubuntu-treblig)]

I've rolled back to 2.17.0 and this bug is still present while by rhythmbox and sound-juicer ones are fixed so it looks separate.
I'm going to say rhythmbox and sound-juicer are probably related to #391398.

Dave

[Dave Gilbert (ubuntu-treblig)]

I can confirm this still happens with 2.17.3-0ubuntu1 libgtk2.0 and wireshark 1.2.0~repack1-0ubuntu1.

Still backtrace also looks like a gail issue:

0x00007fffea532e2e in gail_combo_real_initialize (obj=0x17f0690,
    data=0x1790480)
    at /build/buildd/gtk+2.0-2.17.3/modules/other/gail/gailcombo.c:113
113 /build/buildd/gtk+2.0-2.17.3/modules/other/gail/gailcombo.c: No such file or directory.
 in /build/buildd/gtk+2.0-2.17.3/modules/other/gail/gailcombo.c
(gdb) where
#0 0x00007fffea532e2e in gail_combo_real_initialize (obj=0x17f0690,
    data=0x1790480)
    at /build/buildd/gtk+2.0-2.17.3/modules/other/gail/gailcombo.c:113
#1 0x00007fffea528631 in gail_combo_factory_create_accessible (
    object=0x1790480)
    at /build/buildd/gtk+2.0-2.17.3/modules/other/gail/gail.c:85
#2 0x00007ffff4478c8f in gtk_widget_real_get_accessible (widget=0x1790480)
    at /build/buildd/gtk+2.0-2.17.3/gtk/gtkwidget.c:9379
#3 0x00007fffea5342b3 in gail_container_real_remove_gtk (container=0x1787360,
    widget=0x1790480, data=0x17fc6a0)
    at /build/buildd/gtk+2.0-2.17.3/modules/other/gail/gailcontainer.c:186
#4 0x00007ffff25cf62e in IA__g_closure_invoke (closure=0x178faa0,
    return_value=0x0, n_param_values=2, param_values=0x175f240,
   invocation_hint=0x7fffffffcfa0)
    at /build/buildd/glib2.0-2.21.3/gobject/gclosure.c:767
#5 0x00007ffff25e5846 in signal_emit_unlocked_R (node=0x814ae0,
    detail=<value optimized out>, instance=<value optimized out>,
    emission_return=<value optimized out>,
    instance_and_params=<value optimized out>)
    at /build/buildd/glib2.0-2.21.3/gobject/gsignal.c:3247
#6 0x00007ffff25e6c8e in IA__g_signal_emit_valist (instance=0x1787360,
    signal_id=<value optimized out>, detail=0, var_args=0x7fffffffd190)
    at /build/buildd/glib2.0-2.21.3/gobject/gsignal.c:2980
---Type <return> to continue, or q <return> to quit---
#7 0x00007ffff25e7213 in IA__g_signal_emit (instance=0x17f0690,
    signal_id=25332112, detail=0)
    at /build/buildd/glib2.0-2.21.3/gobject/gsignal.c:3037
#8 0x00007ffff447624e in gtk_widget_dispose (object=0x1790480)
    at /build/buildd/gtk+2.0-2.17.3/gtk/gtkwidget.c:7901
#9 0x00007ffff25d1ad0 in IA__g_object_run_dispose (object=0x1790480)
    at /build/buildd/glib2.0-2.21.3/gobject/gobject.c:789
#10 0x00007ffff441cc62 in gtk_toolbar_forall (container=<value optimized out>,
    include_internals=0, callback=0x7ffff4474930 <IA__gtk_widget_destroy>,
    callback_data=0x0) at /build/buildd/gtk+2.0-2.17.3/gtk/gtktoolbar.c:2541
#11 0x00007ffff42b29c6 in gtk_container_destroy (object=0x1787360)
    at /build/buildd/gtk+2.0-2.17.3/gtk/gtkcontainer.c:1066
#12 0x00007ffff25cf579 in IA__g_closure_invoke (closure=0x8031c0,
    return_value=0x0, n_param_values=1, param_values=0x177e4e0,
    invocation_hint=0x7fffffffd430)
    at /build/buildd/glib2.0-2.21.3/gobject/gclosure.c:767
#13 0x00007ffff25e5ba6 in signal_emit_unlocked_R (node=0x803250,
    detail=<value optimized out>, instance=<value optimized out>,
    emission_return=<value optimized out>,
    instance_and_params=<value optimized out>)
    at /build/buildd/glib2.0-2.21.3/gobject/gsignal.c:3363
#14 0x00007ffff25e6c8e in IA__g_signal_...

[Martin Olsson (mnemo)]

I just his this libgail crasher in pre-release lucid (using wireshark). Repro steps for my crash is similar to what you described above (my bug is https://bugs.launchpad.net/ubuntu/+source/wireshark/+bug/514767 ).

[Dave Gilbert (ubuntu-treblig)]

Wireshark is looking good for me on full Lucid on wireshark 1.2.7-1

Martin: Is it also fixed for you?
If so then I think we should close these?

Dave

[Dave Gilbert (ubuntu-treblig)]

Working for me (on Maverick and as previously stated on Lucid); other reporter hasn't replied in a few months.