nautilus-sendto crashes with "double free or corruption"

[Andres Gomez (Tanty)]

Ubuntu natty ia64

nautilus-sendto 2.32.0-0ubuntu1.1

$ gdb nautilus-sendto
GNU gdb (Ubuntu/Linaro 7.2-1ubuntu11) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/nautilus-sendto...(no debugging symbols found)...done.
(gdb) r
Starting program: /usr/bin/nautilus-sendto
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffef6cf700 (LWP 23301)]
Expects URIs or filenames to be passed as options
[Thread 0x7fffef6cf700 (LWP 23301) exited]

Program exited with code 01.
(gdb) r hola.scr
Starting program: /usr/bin/nautilus-sendto hola.scr
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffef6cf700 (LWP 23388)]
[New Thread 0x7fffee232700 (LWP 23389)]
Init gajim plugin
Init evolution plugin
Init pidgin plugin
Init nautilus burn plugin
Init empathy plugin
Init removable-devices plugin
[New Thread 0x7fffdc6f0700 (LWP 23390)]

(nautilus-sendto:23387): Gtk-WARNING **: Error parsing gtk-icon-sizes string:
        'panel-menu=24,24
panel=20,20
gtk-button=18,18
gtk-large-toolbar=24,24'

(nautilus-sendto:23387): libebook-WARNING **: e-book.c:3095: cannot get book from factory: Invalid source

** (nautilus-sendto:23387): WARNING **: Invalid source

(nautilus-sendto:23387): libebook-WARNING **: e-book.c:3095: cannot get book from factory: Invalid source

(nautilus-sendto:23387): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
This indicates a bug in someone's code. You must ensure an error is NULL before it's set.
The overwriting error message was: Invalid source

** (nautilus-sendto:23387): WARNING **: (null)
*** glibc detected *** /usr/bin/nautilus-sendto: double free or corruption (out): 0x0000000000721c50 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x78a8f)[0x7ffff4c57a8f]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x73)[0x7ffff4c5b8e3]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_static_mutex_free+0x3a)[0x7ffff51fb6fa]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_unref+0xbe)[0x7ffff51d063e]
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0(+0x63df0)[0x7ffff6ffddf0]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(g_object_unref+0x174)[0x7ffff5aa0be4]
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0(g_dbus_connection_send_message_with_reply_sync+0x228)[0x7ffff7041a08]
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0(g_dbus_connection_call_sync+0x1d2)[0x7ffff70437c2]
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0(g_dbus_proxy_call_sync+0x232)[0x7ffff704e9d2]
/usr/lib/libebook-1.2.so.10(e_gdbus_book_factory_call_get_book_sync+0x6b)[0x7fffed3edd5b]
/usr/lib/libebook-1.2.so.10(e_book_new+0x163)[0x7fffed3dcd63]
/usr/lib/nautilus-sendto/plugins/libnstevolution.so(e_contact_entry_set_source_list+0x1d5)[0x7fffed608565]
/usr/lib/nautilus-sendto/plugins/libnstevolution.so(+0x361b)[0x7fffed60661b]
/usr/lib/nautilus-sendto/plugins/libnstevolution.so(+0x36fa)[0x7fffed6066fa]
/usr/bin/nautilus-sendto(main+0x80d)[0x4044fd]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xff)[0x7ffff4bfdeff]
/usr/bin/nautilus-sendto[0x403239]
======= Memory map: ========
00400000-00406000 r-xp 00000000 fc:02 785353 /usr/bin/nautilus-sendto
00605000-00606000 r--p 00005000 fc:02 785353 /usr/bin/nautilus-sendto
00606000-00607000 rw-p 00006000 fc:02 785353 /usr/bin/nautilus-sendto
00607000-008a7000 rw-p 00000000 00:00 0 [heap]
7fffd83ad000-7fffd83ef000 r-xp 00000000 fc:02 664902 /usr/lib/libibus.so.2.0.0
7fffd83ef000-7fffd85ef000 ---p 00042000 fc:02 664902 /usr/lib/libibus.so.2.0.0
7fffd85ef000-7fffd85f0000 r--p 00042000 fc:02 664902 /usr/lib/libibus.so.2.0.0
7fffd85f0000-7fffd85f1000 rw-p 00043000 fc:02 664902 /usr/lib/libibus.so.2.0.0
7fffd85f1000-7fffd85f2000 rw-p 00000000 00:00 0
7fffd85f2000-7fffd85f7000 r-xp 00000000 fc:02 664941 /usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so
7fffd85f7000-7fffd87f6000 ---p 00005000 fc:02 664941 /usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so
7fffd87f6000-7fffd87f7000 r--p 00004000 fc:02 664941 /usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so
7fffd87f7000-7fffd87f8000 rw-p 00005000 fc:02 664941 /usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so
7fffd87f8000-7fffd8858000 rw-s 00000000 00:04 14090267 /SYSV00000000 (deleted)
7fffd8858000-7fffd8b06000 r--p 00000000 fc:02 279379 /usr/share/fonts/truetype/unfonts/UnDotumBold.ttf
7fffd8b06000-7fffd8b23000 r--s 00000000 fc:02 157335 /usr/share/mime/mime.cache
7fffd8b23000-7fffd8b24000 r--s 00000000 fc:15 1045011 /home/tanty/.local/share/mime/mime.cache
7fffd8b24000-7fffd91f2000 r--p 00000000 fc:02 151689 /usr/share/icons/hicolor/icon-theme.cache
7fffd91f2000-7fffdb49c000 r--p 00000000 fc:02 140540 /usr/share/icons/gnome/icon-theme.cache
7fffdb49c000-7fffdb6b8000 r--p 00000000 fc:02 279378 /usr/share/fonts/truetype/unfonts/UnDotum.ttf
7fffdb6b8000-7fffdb6ba000 r-xp 00000000 fc:02 791782 /usr/lib/x86_64-linux-gnu/pango/1.6.0/modules/pango-basic-fc.so
7fffdb6ba000-7fffdb8b9000 ---p 00002000 fc:02 791782 /usr/lib/x86_64-linux-gnu/pango/1.6.0/modules/pango-basic-fc.so
7fffdb8b9000-7fffdb8ba000 r--p 00001000 fc:02 791782 /usr/lib/x86_64-linux-gnu/pango/1.6.0/modules/pango-basic-fc.so
7fffdb8ba000-7fffdb8bb000 rw-p 00002000 fc:02 791782 /usr/lib/x86_64-linux-gnu/pango/1.6.0/modules/pango-basic-fc.so
7fffdb8bb000-7fffdb8c6000 r-xp 00000000 fc:02 659574 /usr/lib/libgssdp-1.0.so.2.0.0
7fffdb8c6000-7fffdbac5000 ---p 0000b000 fc:02 659574 /usr/lib/libgssdp-1.0.so.2.0.0
7fffdbac5000-7fffdbac6000 r--p 0000a000 fc:02 659574 /usr/lib/libgssdp-1.0.so.2.0.0
7fffdbac6000-7fffdbac7000 rw-p 0000b000 fc:02 659574 /usr/lib/libgssdp-1.0.so.2.0.0
7fffdbac7000-7fffdbaeb000 r-xp 00000000 fc:02 659576 /usr/lib/libgupnp-1.0.so.3.0.0
7fffdbaeb000-7fffdbcea000 ---p 00024000 fc:02 659576 /usr/lib/libgupnp-1.0.so.3.0.0
7fffdbcea000-7fffdbceb000 r--p 00023000 fc:02 659576 /usr/lib/libgupnp-1.0.so.3.0.0
7fffdbceb000-7fffdbcec000 rw-p 00024000 fc:02 659576 /usr/lib/libgupnp-1.0.so.3.0.0
7fffdbcec000-7fffdbcef000 r-xp 00000000 fc:02 668344 /usr/lib/nautilus-sendto/plugins/libnstupnp.so
7fffdbcef000-7fffdbeee000 ---p 00003000 fc:02 668344 /usr/lib/nautilus-sendto/plugins/libnstupnp.so
7fffdbeee000-7fffdbeef000 r--p 00002000 fc:02 668344 /usr/lib/nautilus-sendto/plugins/libnstupnp.so
7fffdbeef000-7fffdbef0000 rw-p 00003000 fc:02 668344 /usr/lib/nautilus-sendto/plugins/libnstupnp.so
7fffdbef0000-7fffdbef1000 ---p 00000000 00:00 0
7fffdbef1000-7fffdc6f1000 rw-p 00000000 00:00 0
7fffdc6f1000-7fffdc708000 r-xp 00000000 fc:02 658356 /usr/lib/libdbusmenu-glib.so.3.0.14
7fffdc708000-7fffdc908000 ---p 00017000 fc:02 658356 /usr/lib/libdbusmenu-glib.so.3.0.14
7fffdc908000-7fffdc909000 r--p 00017000 fc:02 658356 /usr/lib/libdbusmenu-glib.so.3.0.14
7fffdc909000-7fffdc90a000 rw-p 00018000 fc:02 658356 /usr/lib/libdbusmenu-glib.so.3.0.14
7fffdc90a000-7fffdc91b000 r-xp 00000000 fc:02 655284 /usr/lib/libdbusmenu-gtk.so.3.0.14
7fffdc91b000-7fffdcb1a000 ---p 00011000 fc:02 655284 /usr/lib/libdbusmenu-gtk.so.3.0.14
7fffdcb1a000-7fffdcb1b000 r--p 00010000 fc:02 655284 /usr/lib/libdbusmenu-gtk.so.3.0.14
7fffdcb1b000-7fffdcb1c000 rw-p 00011000 fc:02 655284 /usr/lib/libdbusmenu-gtk.so.3.0.14
7fffdcb1c000-7fffdcb21000 r-xp 00000000 fc:02 658302 /usr/lib/gtk-2.0/2.10.0/menuproxies/libappmenu.so
7fffdcb21000-7fffdcd20000 ---p 00005000 fc:02 658302 /usr/lib/gtk-2.0/2.10.0/menuproxies/libappmenu.so
7fffdcd20000-7fffdcd21000 r--p 00004000 fc:02 658302 /usr/lib/gtk-2.0/2.10.0/menuproxies/libappmenu.so
7fffdcd21000-7fffdcd22000 rw-p 00005000 fc:02 658302 /usr/lib/gtk-2.0/2.10.0/menuproxies/libappmenu.so
7fffdcd22000-7fffdcd36000 r-xp 00000000 fc:02 661264 /usr/lib/gio/modules/libgioremote-volume-monitor.so
Program received signal SIGABRT, Aborted.
0x00007ffff4c12d05 in raise () from /lib/x86_64-linux-gnu/libc.so.6

[Sebastien Bacher (seb128)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please try to obtain a valgrind log following the instructions at https://wiki.ubuntu.com/Valgrind and attach the file to the bug report. This will greatly help us in tracking down your problem.

[Andres Gomez (Tanty) (tanty)]

Unfortunately, now the crash is different and maybe related to a race condition (?).

The problem seems to happen in 2 of the nautilus-sendto plugins: libnstbluetooth.so and libnstevolution.so.

What I've done was removing the rest of the plugins and just running valgrind and gdb with each of those 2 plugins.

libnstevolution.so :
===============

Valgrind:

The problem is not reproducible. I will attach the log.

GDB:

$ gdb nautilus-sendto
GNU gdb (Ubuntu/Linaro 7.2-1ubuntu11) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/nautilus-sendto...(no debugging symbols found)...done.
(gdb) r /home/tanty/SketchI.pdf
Starting program: /usr/bin/nautilus-sendto /home/tanty/SketchI.pdf
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffef822700 (LWP 11167)]
[New Thread 0x7fffee58a700 (LWP 11169)]
Init evolution plugin
[New Thread 0x7fffea439700 (LWP 11185)]

(nautilus-sendto:11164): Gtk-WARNING **: Error parsing gtk-icon-sizes string:
        'panel-menu=24,24
panel=20,20
gtk-button=18,18
gtk-large-toolbar=24,24'

(nautilus-sendto:11164): libebook-WARNING **: e-book.c:3095: cannot get book from factory: Invalid source

** (nautilus-sendto:11164): WARNING **: Invalid source

(nautilus-sendto:11164): libebook-WARNING **: e-book.c:3095: cannot get book from factory: Invalid source

(nautilus-sendto:11164): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
This indicates a bug in someone's code. You must ensure an error is NULL before it's set.
The overwriting error message was: Invalid source

** (nautilus-sendto:11164): WARNING **: (null)

(nautilus-sendto:11164): libebook-WARNING **: e-book.c:3095: cannot get book from factory: Invalid source

(nautilus-sendto:11164): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
This indicates a bug in someone's code. You must ensure an error is NULL before it's set.
The overwriting error message was: Invalid source

** (nautilus-sendto:11164): WARNING **: (null)

Program received signal SIGSEGV, Segmentation fault.
0x00007fffebc84a77 in gconf_value_compare () from /usr/lib/libgconf-2.so.4
(gdb) bt
#0 0x00007fffebc84a77 in gconf_value_compare () from /usr/lib/libgconf-2.so.4
#1 0x00007fffebc84c1c in gconf_value_compare () from /usr/lib/libgconf-2.so.4
#2 0x00007fffebc85247 in gconf_entry_equal () from /usr/lib/libgconf-2.so.4
#3 0x00007fffebc8b58e in ?? () from /usr/lib/libgconf-2.so.4
#4 0x00007fffebc8b6ea in ?? () from /usr/lib/libgconf-2.so.4
#5 0x00007fffebc8b7bf in ?? () from /usr/lib/libgconf-2.so.4
#6 0x00007fffebc8e7eb in gconf_client_add_dir () from /usr/lib/libgconf-2.so.4
#7 0x00007fffedb8472b in ?? () from /usr/lib/nautilus-sendto/plugins/libnstevolution.so
#8 0x00000000004044fd in main ()
(...

[Sebastien Bacher (seb128)]

Thank you for your efforts, could you install nautilus-sendto-dbgsym (details on how to do that on https://wiki.ubuntu.com/DebuggingProgramCrash) and get a new stacktrace? Do you have evolution-data-server installed?

[Andres Gomez (Tanty) (tanty)]

Yes, evolution-data-server is installed.

Attaching logs.

[Andres Gomez (Tanty) (tanty)]

Now, running with Valgrind, nautilus-sendto is not crashing and the UI is shown properly.

[Sebastien Bacher (seb128)]

"Now, running with Valgrind, nautilus-sendto is not crashing and the UI is shown properly."

right, valgrind tends to workaround the segfaults issues, it still lists the code error, i.e in that log

"==12406== Invalid write of size 4
==12406== at 0x4C2AF5B: memset (mc_replace_strmem.c:738)
==12406== by 0x77EBA1A: g_slice_free1 (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.2800.6)
==12406== by 0xF6B1599: e_contact_entry_set_source_list (e-contact-entry.c:518)
==12406== by 0xF6AF61A: add_sources (evolution.c:179)
==12406== by 0xF6AF6F9: get_contacts_widget (evolution.c:217)
==12406== by 0x4044FC: main (nautilus-sendto-command.c:415)
==12406== Address 0x1fed9270 is 0 bytes inside a block of size 16 free'd
==12406== at 0x4C282ED: free (vg_replace_malloc.c:366)
==12406== by 0xF6B1599: e_contact_entry_set_source_list (e-contact-entry.c:518)
==12406== by 0xF6AF61A: add_sources (evolution.c:179)
==12406== by 0xF6AF6F9: get_contacts_widget (evolution.c:217)
==12406== by 0x4044FC: main (nautilus-sendto-command.c:415)"