Unity crashes with SIGSEGV when hitting debug DBus interface hard
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Unity |
Fix Released
|
High
|
Michal Hruby | ||
unity (Ubuntu) |
Fix Released
|
High
|
Michal Hruby | ||
Precise |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
SRU testcase
TO BE TESTED BY THE REPORTER(dev)
I have a branch that adds a very nice feature to autopilot. A side effect of this feature is that we send more requests to the unity Debug DBus interface.
When I run autopilot against unity trunk with my autopilot feature enabled, unity crashes. I'm unable to get apport to report the bug, so this information is all collected manually from gdb. Gdb breaks with this message:
Program received signal SIGSEGV, Segmentation fault.
__strlen_
The backtrace is:
#0 __strlen_
#1 0x00007ffff1bdd5e8 in ?? () from /usr/lib/
#2 0x00007ffff1bdd71f in ?? () from /usr/lib/
#3 0x00007ffff1bddcee in ?? () from /usr/lib/
#4 0x00007ffff1be110c in g_dbus_
#5 0x00007ffff1bd6292 in ?? () from /usr/lib/
#6 0x00007ffff1bd76dd in g_dbus_
#7 0x00007ffff1bd90cc in ?? () from /usr/lib/
#8 0x00007ffff1be68c9 in ?? () from /usr/lib/
#9 0x00007ffff1be8204 in g_dbus_proxy_call () from /usr/lib/
#10 0x00007fffe03ea7f7 in unity::
at /home/thomi/
#11 0x00007fffe03eae74 in unity::
at /home/thomi/
#12 0x00007fffe03c7bd6 in unity::
#13 0x00007fffe03c76c3 in unity::
#14 0x00007fffe03d0203 in sigc::bound_
at /usr/include/
#15 0x00007fffe03cf60d in sigc::adaptor_
_A_
#16 0x00007fffe03cdc24 in sigc::internal:
a_1=
#17 0x00007fffe332e39b in sigc::slot1<void, _GVariant*
#18 0x00007fffe03ea5eb in unity::
at /home/thomi/
#19 0x00007fffe03ef8b8 in sigc::bound_
_A_
#20 0x00007fffe03ef1bf in sigc::adaptor_
_A_
#21 0x00007fffe03ee1c4 in sigc::internal:
at /usr/include/
#22 0x00007fffe03eccf6 in sigc::slot4<void, _GDBusProxy*, char*, char*, _GVariant*
_A_
#23 0x00007fffe03ec079 in unity::
self=0x159f078) at /home/thomi/
#24 0x00007ffff3b81a14 in ffi_call_unix64 () from /usr/lib/
#25 0x00007ffff3b81435 in ffi_call () from /usr/lib/
#26 0x00007ffff4bef4eb in g_cclosure_
#27 0x00007ffff4beec82 in g_closure_invoke () from /usr/lib/
#28 0x00007ffff4bffd51 in ?? () from /usr/lib/
#29 0x00007ffff4c08079 in g_signal_
#30 0x00007ffff4c08222 in g_signal_emit () from /usr/lib/
#31 0x00007ffff1be4c14 in ?? () from /usr/lib/
#32 0x00007ffff1bd4645 in ?? () from /usr/lib/
#33 0x00007ffff5ba9c9a in g_main_
#34 0x00007ffff5baa060 in ?? () from /lib/x86_
#35 0x00007ffff5baa45a in g_main_loop_run () from /lib/x86_
#36 0x00000000004029ae in main ()
The interesting part starts at frame 10. The crash is on line 261, the code around that line looks like this:
247 if (proxy_)
248 {
249 CallData* data = new CallData();
250 data->callback = callback;
251 data->impl = this;
252 data->method_name = method_name;
253
254 g_dbus_
255 method_
256 parameters,
257 flags,
258 timeout_msec,
259 cancellable != NULL ? cancellable : cancellable_,
260 DBusProxy:
261 data);
262 }
The arguments look like this:
(gdb) print method_name.c_str()
$1 = 0x2aad5d8 "SyncOne"
(gdb) print flags
$2 = G_DBUS_
(gdb) print timeout_msec
$3 = -1
(gdb) print cancellable
$4 = (GCancellable *) 0x0
(gdb) print cancellable_
$5 = {object_ = 0xf54b30}
(gdb) print callback
$6 = {<sigc::slot1<void, _GVariant*>> = {<sigc::slot_base> = {<sigc:
The parameters argument looks a little suspicous to me:
(gdb) print parameters
$7 = (GVariant *) 0x7fffcc3cf590
(gdb) print g_variant_
$8 = -872203104
(gdb) print (const char*) g_variant_
$9 = 0xffffffffcc033ca0 <Address 0xffffffffcc033ca0 out of bounds>
The type string should return "(s)". Looking up the stack to the place where 'parameters' was created (frame 12 - frame 11 is just the public method calling into the impl class):
228 void DBusIndicators:
229 {
230 GVariant* parameter = g_variant_
231
232 gproxy_
233 }
At this point, name seems to be valid:
(gdb) print name.c_str()
$10 = 0x5721d58 "libapplication.so"
...but the parameter still doesn't want to give us a valid type string:
(gdb) print (const char*) g_variant_
$11 = 0xffffffffcc033ca0 <Address 0xffffffffcc033ca0 out of bounds>
Related branches
- Marco Trevisan (Treviño): Approve
-
Diff: 64 lines (+13/-7)4 files modifiedUnityCore/GLibSignal.cpp (+1/-1)
UnityCore/Hud.cpp (+5/-5)
plugins/unityshell/src/DebugDBusInterface.cpp (+2/-1)
plugins/unityshell/src/PanelMenuView.cpp (+5/-0)
Changed in unity: | |
status: | New → Invalid |
Changed in unity: | |
status: | Invalid → Confirmed |
Changed in unity: | |
importance: | Undecided → High |
Changed in unity: | |
status: | Confirmed → In Progress |
assignee: | nobody → Michal Hruby (mhr3) |
milestone: | none → 5.12.0 |
Changed in unity: | |
status: | In Progress → Fix Committed |
Changed in unity (Ubuntu): | |
status: | New → Fix Committed |
status: | Fix Committed → Confirmed |
assignee: | nobody → Michal Hruby (mhr3) |
description: | updated |
Changed in unity (Ubuntu): | |
importance: | Undecided → High |
Changed in unity (Ubuntu Precise): | |
status: | New → Confirmed |
Changed in unity: | |
status: | Fix Committed → Fix Released |
Also worth noting: The unity log for the autopilot test that caused unity to crash looks like this:
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_unref: assertion `value->ref_count > 0' failed new_string: assertion `string != NULL' failed new_variant: assertion `value != NULL' failed type_is_ subtype_ of: assertion `g_variant_ type_check (type)' failed builder_ add_value: assertion `!GVSB( builder) ->expected_ type || g_variant_ is_of_type (value, GVSB(builder) ->expected_ type)' failed builder_ end: assertion `GVSB(builder) ->offset >= GVSB(builder) ->min_items' failed type_is_ subtype_ of: assertion `g_variant_ type_check (type)' failed builder_ add_value: assertion `!GVSB( builder) ->expected_ type || g_variant_ is_of_type (value, GVSB(builder) ->expected_ type)' failed new_string: assertion `string != NULL' failed new_variant: assertion `value != NULL' failed type_is_ subtype_ of: assertion `g_variant_ type_check (type)' failed builder_ add_value: assertion `!GVSB( builder) ->expected_ type || g_variant_ is_of_type (value, GVSB(builder) ->expected_ type)' failed builder_ end: assertion `GVSB(builder) ->offset >= GVSB(builder) ->min_items' failed type_is_ subtype_ of: assertion `g_variant_ type_check (type)' failed builder_ add_value: assertion `!GVSB( builder) ->expected_ type || g_variant_ is_of_type (value, GVSB(builder) ->expected_ type)' failed new_string: assertion `string != NULL' failed new_variant: assertion `value != NULL' failed
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_unref: assertion `value->ref_count > 0' failed
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_get_type: assertion `value != NULL' failed
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_get_type: assertion `value != NULL' failed
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_unref: assertion `value->ref_count > 0' failed
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_get_type: assertion `value != NULL' failed
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_get_type: assertion `value != NULL' failed
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_unref: assertion `value->ref_count > 0' failed
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_
ERROR 2012-04-12 10:42:15 unity.glib <unknown>:0 g_variant_get_type: assertion `value != NULL' ...