nautilus crashed with SIGSEGV in magazine_chain_pop_head()

[Hew]

Binary package hint: nautilus

Navigating using the back and forward drop down lists seems to get things out of sync, and can cause crashes when moving this way or when moving up a level.

Steps to reproduce:
1) Navigate into any 2 folders (eg /home/user/one/a)
2) Navigate back up 2 levels (back to /home/user)
3) Navigate into any 2 other folders (eg /home/user/two/b)
4) Use the Back drop down menu to go back 4 views (to folder a)
5) Use the Forward drop down menu to go forward 4 views (to folder b)

What should happen:
The Forward button should be greyed out since we haven't been any further forward. We should be able to continue navigating as normal.

What actually happens:
The Forward button still shows some folders. Continuing to navigate using Forward, Back and Up will eventually cause a crash of some kind.

ProblemType: Crash
DistroRelease: Ubuntu 10.04
Package: nautilus 1:2.30.0-0ubuntu4
ProcVersionSignature: Ubuntu 2.6.32-21.32-generic 2.6.32.11+drm33.2
Uname: Linux 2.6.32-21-generic x86_64
Architecture: amd64
CrashCounter: 1
Date: Sun Apr 18 15:52:28 2010
ExecutablePath: /usr/bin/nautilus
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Beta amd64 (20100318)
ProcCmdline: nautilus
ProcEnviron:
 PATH=(custom, user)
 LANG=en_AU.utf8
 SHELL=/bin/bash
SegvAnalysis:
 Segfault happened at: 0x7f53395613a4 <IA__g_slice_alloc+292>: mov (%rdx),%rcx
 PC (0x7f53395613a4) ok
 source "(%rdx)" (0x00000017) not located in a known VMA region (needed readable region)!
 destination "%rcx" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: nautilus
StacktraceTop:
 magazine_chain_pop_head (mem_size=32)
 thread_memory_magazine1_alloc (mem_size=32)
 IA__g_slice_alloc (mem_size=32)
 g_data_set_internal (datalist=0x11485a0, key_id=54,
 IA__g_datalist_id_set_data_full (datalist=0x11485a0, key_id=54,
Title: nautilus crashed with SIGSEGV in magazine_chain_pop_head()
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[Apport retracing service (apport)]

StacktraceTop:
 g_slice_alloc () from /lib/libglib-2.0.so.0
 g_datalist_id_set_data_full ()
 ?? () from /usr/lib/libgobject-2.0.so.0
 g_type_create_instance ()
 ?? () from /usr/lib/libgobject-2.0.so.0

[Hew (hew)]

See original stacktrace for one with symbols.

[Pedro Villavicencio (pedro)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please try to obtain a valgrind log following the instructions at https://wiki.ubuntu.com/Valgrind and attach the file to the bug report. This will greatly help us in tracking down your problem.

[Hew (hew)]

Attached valgrind.log. I did my best adding the large number of symbol packages but I see there are still warnings and ???'s. Hopefully the log is good enough, but let me know what I should do if it's not.

I expect this to easily reproducible on any Ubuntu 10.04 install.

[Pedro Villavicencio (pedro)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. A new version of Nautilus is available on Maverick and we are wondering if this bug is still an issue for you with that version? Could you please test and comment back? Thanks in advance.

[Hew (hew)]

Confirmed this is still reproducible with nautilus 1:2.32.0-0ubuntu1 on maverick.

[Pedro Villavicencio (pedro)]

Thanks for the report, is this reproducible on Ubuntu 11.10 ? May you please try the same and comment back? Thanks.

[Hew (hew)]

Reproduced the same issue, including the crash after enough navigating. Ubuntu 11.10 with nautilus 1:3.2.0-0ubuntu5.

[Mörgæs (moergaes)]

Closing due to age.

If a similar bug is found in 13.10 please open a new report.