unity-panel-service crashed with SIGSEGV in atk_object_get_n_accessible_children()

[Guy Schlosser]

Log into Unity 2d with orca, and try navigating the launcher and dash. This bug is highly reproducible.

ProblemType: Crash
DistroRelease: Ubuntu 11.10
Package: unity-services 4.20.0-0ubuntu2
ProcVersionSignature: Ubuntu 3.0.0-12.19-generic-pae 3.0.4
Uname: Linux 3.0.0-12-generic-pae i686
NonfreeKernelModules: nvidia
.proc.driver.nvidia.gpus.0: Error: [Errno 21] Is a directory: '/proc/driver/nvidia/gpus/0'
.proc.driver.nvidia.registry: Binary: ""
.proc.driver.nvidia.version:
 NVRM version: NVIDIA UNIX x86 Kernel Module 280.13 Wed Jul 27 16:55:43 PDT 2011
 GCC version: gcc version 4.6.1 (Ubuntu/Linaro 4.6.1-9ubuntu3)
.tmp.unity.support.test.0:

ApportVersion: 1.23-0ubuntu2
Architecture: i386
CompizPlugins: [core,bailer,detection,composite,opengl,decor,grid,compiztoolbox,gnomecompat,regex,move,animation,vpswitch,resize,workarounds,imgpng,snap,mousepoll,place,wall,fade,unitymtgrabhandles,session,expo,ezoom,scale,unityshell]
CompositorRunning: None
Date: Fri Sep 30 18:41:59 2011
DistUpgraded: Log time: 2011-09-17 17:07:19.818068
DistroCodename: oneiric
DistroVariant: ubuntu
ExecutablePath: /usr/lib/unity/unity-panel-service
GraphicsCard:
 nVidia Corporation G72 [GeForce 7300 LE] [10de:01d1] (rev a1) (prog-if 00 [VGA controller])
   Subsystem: Dell Device [1028:0405]
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Beta i386 (20100901.1)
MachineType: Dell Inc. Dell DM061
ProcCmdline: /usr/lib/unity/unity-panel-service
ProcEnviron:
 SHELL=/bin/bash
 LANG=en_US.UTF-8
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.0.0-12-generic-pae root=UUID=5c17e2e5-c4ff-4c50-b45f-ad377fea3db7 ro quiet splash vt.handoff=7
SegvAnalysis:
 Segfault happened at: 0x804c7c6: mov (%ebx),%edx
 PC (0x0804c7c6) ok
 source "(%ebx)" (0x00000038) not located in a known VMA region (needed readable region)!
 destination "%edx" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: unity
StacktraceTop:
 ?? ()
 atk_object_get_n_accessible_children () from /usr/lib/i386-linux-gnu/libatk-1.0.so.0
 ?? () from /usr/lib/gtk-3.0/modules/libatk-bridge.so
 g_hash_table_foreach () from /lib/i386-linux-gnu/libglib-2.0.so.0
 spi_cache_foreach () from /usr/lib/gtk-3.0/modules/libatk-bridge.so
Title: unity-panel-service crashed with SIGSEGV in atk_object_get_n_accessible_children()
UpgradeStatus: Upgraded to oneiric on 2011-09-17 (13 days ago)
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare vboxusers
XsessionErrors:
 (nautilus:1895): Gtk-CRITICAL **: gtk_action_set_visible: assertion `GTK_IS_ACTION (action)' failed
 (nautilus:1895): Gtk-CRITICAL **: gtk_action_set_visible: assertion `GTK_IS_ACTION (action)' failed
dmi.bios.date: 10/25/2006
dmi.bios.vendor: Dell Inc.
dmi.bios.version: 2.0.4
dmi.board.name: 0WG864
dmi.board.vendor: Dell Inc.
dmi.chassis.type: 6
dmi.chassis.vendor: Dell Inc.
dmi.modalias: dmi:bvnDellInc.:bvr2.0.4:bd10/25/2006:svnDellInc.:pnDellDM061:pvr:rvnDellInc.:rn0WG864:rvr:cvnDellInc.:ct6:cvr:
dmi.product.name: Dell DM061
dmi.sys.vendor: Dell Inc.
version.compiz: compiz 1:0.9.6+bzr20110929-0ubuntu1
version.libdrm2: libdrm2 2.4.26-1ubuntu1
version.libgl1-mesa-dri: libgl1-mesa-dri 7.11-0ubuntu3
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 7.11-0ubuntu3
version.nvidia-graphics-drivers: nvidia-graphics-drivers N/A
version.xserver-xorg: xserver-xorg 1:7.6+7ubuntu7
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.6.0-1ubuntu13
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.14.99~git20110811.g93fc084-0ubuntu1
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.15.901-1ubuntu2
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:0.0.16+git20110411+8378443-1

[Apport retracing service (apport)]

StacktraceTop:
 panel_indicator_entry_accessible_get_n_children (accessible=0x965b1b0) at /build/buildd/unity-4.20.0/services/panel-indicator-entry-accessible.c:256
 atk_object_get_n_accessible_children (accessible=0x965b1b0) at atkobject.c:800
 append_cache_item (obj=0x965b1b0, data=0xbff71a98) at cache-adaptor.c:153
 g_hash_table_foreach (hash_table=0x96ac318, func=0xb64dd770 <append_accessible_hf>, user_data=0xbff71a98) at /build/buildd/glib2.0-2.30.0/./glib/ghash.c:1420
 spi_cache_foreach (cache=0xb5b14b80, func=0xb64dd770 <append_accessible_hf>, data=0xbff71a98) at ../../atk-adaptor/accessible-cache.c:417

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Alejandro Piñeiro (apinheiro)]

I had a interesting talking with mhr3 about this bug. It crashes in this line:

  if (GTK_IS_MENU (piea->priv->entry->menu))

So probably entry is NULL, or menu is not anymore a valid object.

Taking a look to the code, this is a custom atk object associated to a non-GTK object. Taking a look to the parent (ParentIndicatorAccessible) it have a callback when the entry is removed, so it is removed from the list. But PanelIndicatorEntryAccessible doesn't have any code managing this.

As the accessibility object can survive the base object, atk objects requires to manage if the base object is destroyed, and changing his state to ATK_STATE_DEFUNCT accordingly. So the atk-bridge will usually not interact with a accessible object with that state.

In the case of gtk, they implement this adding a weak_ref to the base object. But as I said this is custom atk object (not a gtkaccessible subclass). As far as I see the purpose of this object is expose the menu.

So I think that it is worth to add a weak_ref to entry->menu. If the crash happens because the entry->menu is freed, then ATK_STATE_DEFUNCT management should be added. The easiest way to do that:

  * add that weak_ref to the menu: when the menu is destroyed notify the state change and save somehow that the object was destroyed
       atk_object_notify_state_change (self, ATK_STATE_DEFUNCT)
  * return ATK_STATE_DEFUNCT on panel_indicator_entry_accessible_ref_state_set if the menu was destroyed

BTW: in order to return the ROLE and NAME on the initialize method, it is check entry->label and entry->image, instead of entry->menu. Not sure if this is correct. Probably it is worth to ask Rodrigo Moya about it.

[SamHu (hsy19891228)]

I got same when i am using 3d unity, i guess it has something to do with gui lib like qt because it always happen when i am using qucs or other qt app

[emptythevoid (emptythevoid)]

Just happened to me with Unity 3D. Had Totem open, and the panel vanished and returned quickly.

[Marco Biscaro (marcobiscaro2112)]

This same error occurs in precise, when using Eclipse and changing tabs (see duplicate bug #997444).

[Karthik Inbasekar (karthik-inbasekar)]

Verified that the Bug #997444 referenced above happens when using Kile Latex editor and changing tabs.
using Ubuntu 12.04 precise.

[Antec (info-janmob)]

Crashes for me with 12.04 and kernel 3.5.0-2-generic

[Antec (info-janmob)]

Sorry I mean of course that it crashes for me with 12.10 and kernel 3.5.0-2-generic.

[Leodardo (leodardo)]

I have this bug happening continuosly with Kile (see bug #997444).
I have this with Ubuntu 12.04 i386, Unity-2d and Unity-3d (unity -v: 5.16.0) and previous, kernel 3.2.0-32-generic-pae and previous.
The panel takes several seconds to die and restart making Kile unusable during this period and the system very slow.
Being an academic I work with latex a lot and this is very frustrating with this bug.

As it seems to persist still with 12.10, the bug needs be assigned to a developer.

[DFOXpro (dfoxpro)]

I just use unity 2d panel (12.04) and no orca, btw it still crash

[Floris Van den Abeele (florisvda)]

I can confirm comment #13, when working with Kile the unity-panel-service crashes everytime a tab is switched in Kile (i.e. this triggers the titel in the panel to be updated I suppose). I've tried running unity in verbose and debug mode, but the unity-panel-service process crashing doesn't get captured when running `unity --verbose --debug'.

[Floris Van den Abeele (florisvda)]

So far I can only provide the crash file attached, note that I'm running plain unity (not 2d as the OP). Running unity 5.20.0 by the way.

[Stephen M. Webb (bregma)]

Thank you for trying to make Ubuntu better. The stack trace in the attached .crash file in comment #16 shows a completely different problem than the one reported in this bug. Please open a new bug by using the "ubuntu-bug _usr_lib_unity_unity-panel-service.1000.crash" command from the terminal and include your nicely detailed description of how we can reproduce the problem so we can handle it appropriately.

[Floris Van den Abeele (florisvda)]

I've created a new report at https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1213829. Apologies for polluting this report though.