Segmentation fault whilst opening Rubbish Bin/ trash://

[jondee]

Package version 1:3.14.2-0ubuntu9 from http://gb.archive.ubuntu.com/ubuntu/ vivid/main amd64 Packages
Ubuntu 15.04 amd64 on an i5-4670K CPU

Hi, I'm currently getting a consistent SIGSEGV from Nautilus when attempting to open the rubbish bin. This happens whether I click the bookmark on the left or instantaneously if I run `nautilus trash://`. The crash occurs before the icons have fully loaded, but a second after the rubbish bin is selected.

I installed the debug symbols for nautilus and ran with gdb and got the following output:

(gdb) run
Starting program: /usr/bin/nautilus
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

(nautilus:21736): Gtk-CRITICAL **: gtk_icon_theme_get_for_screen: assertion 'GDK_IS_SCREEN (screen)' failed

(nautilus:21736): GLib-GObject-WARNING **: invalid (NULL) pointer instance

(nautilus:21736): GLib-GObject-CRITICAL **: g_signal_connect_object: assertion 'G_TYPE_CHECK_INSTANCE (instance)' failed
[Thread 0x7ffff7f8ba00 (LWP 21736) exited]
[Inferior 1 (process 21736) exited normally]
(gdb) run
Starting program: /usr/bin/nautilus
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
nautilus-wipe-Message: Initializing
[New Thread 0x7fffe9017700 (LWP 22649)]
[Thread 0x7fffe9017700 (LWP 22649) exited]
[New Thread 0x7fffc1347700 (LWP 22680)]
[New Thread 0x7fffe35f1700 (LWP 22651)]
[New Thread 0x7fffe3fff700 (LWP 22650)]
[New Thread 0x7fffe9818700 (LWP 22648)]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff372332e in __GI__IO_default_xsputn (f=0x7fffff7ff5f0, data=0x50e080, n=6) at genops.c:447
447 genops.c: No such file or directory.

I can provide more info if needed as I can easily reproduce the bug. I know a little about using gdb as well, but may need a bit of guidance as I'm no hardened C programmer. Thanks!

[jondee (jonathandilks)]

Just ran again with the source directory for libio enabled in gdb and the line that's going wrong is as follows:
463 f->_IO_write_ptr = __mempcpy (f->_IO_write_ptr, s, count);

[Sebastien Bacher (seb128)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please try to obtain a backtrace following the instructions at http://wiki.ubuntu.com/DebuggingProgramCrash and upload the backtrace (as an attachment) to the bug report. This will greatly help us in tracking down your problem.

[jondee (jonathandilks)]

Please find attached the Valgrind log of `_SLICE=always-malloc G_DEBUG=gc-friendly valgrind -v --tool=memcheck --leak-check=full --num-callers=40 --log-file=valgrind.log $(which nautilus) trash://`

[jondee (jonathandilks)]

Please also find attached the backtrace obtained from GDB using the instructions at https://wiki.ubuntu.com/Backtrace

[Sebastien Bacher (seb128)]

weird, it seems that it keeps getting change events ... does "gvfs-ls trash:///" works? does it work if you uninstall python-nautilus? do you get the same issue in a guest session?

[jondee (jonathandilks)]

Can confirm gvfs-ls trash:/// works fine producing the output of all the files in the trash:// location.

I have another account on the system with plenty of files in that trash:// works perfectly fine for. Guest mode trash:// also works perfectly fine.

The program still crashes with SIGSEGV (__GI__IO_default_xsputn (f=0x7fffff7ff600, data=<optimised out>, n=38) at genops.c:463) with python-nautilus uninstalled and pruged out (I did not restart the system, but I ensured that nautilus was completely killed before I re-attempted the test)

I'm guessing there's probably something in my trash:// that's triggering this right? Any particular file types I should look for? Interestingly opening `nautilus ~/.local/share/Trash/files` causes a sefault too!

[Sebastien Bacher (seb128)]

not sure, do you have symlinks in there? maybe a looping one?

[jondee (jonathandilks)]

Result! XD There were indeed some (now broken after being moved to trash) symlinks in there! Moving two of them out of the trash stopped the crash! The symlinks that caused the SIGSEGV, were also relative-based ones, I've posted the result of ls -la below.

lrwxrwxrwx 1 jonathan jonathan 13 Apr 8 05:04 ToggleRGB.c -> ToggleRGB.ino
lrwxrwxrwx 1 jonathan jonathan 11 Apr 8 05:05 ToggleRGB.ino -> ToggleRGB.c

There is indeed a circular reference created here is there not as they're now referencing each other? These files weren't originally ever together at the same time until they were deleted, and then this problem occurred when they were moved into the trash together. I wasn't aware Nautilus would try to resolve the symlinks in some way, but surely crashing when this situation occurs is still undesirable behaviour?

Many thanks for helping work out what was going wrong though :)

[jondee (jonathandilks)]

Just discovered Nautilus will crash wherever these two files are placed together! Attached .tar.gz with a folder that upon opening should crash Nautilus. Hopefully the symlinks will be preserved in the archive!

[Sebastien Bacher (seb128)]

Thanks, the issue is an upstream one, it would be nice if somebody could send the bug to the developers of the software by following the instructions at https://wiki.ubuntu.com/Bugs/Upstream/GNOME.

[Ads20000 (ads20000)]

I've reported the bug here: https://gitlab.gnome.org/GNOME/nautilus/issues/289

Proper tracking is blocked by bug 1603679

[Ads20000 (ads20000)]

(Btw I can confirm this bug is reproducible in Ubuntu 17.10)

[Ads20000 (ads20000)]

* bug 1745210

[Ads20000 (ads20000)]

Upstream says their latest stable and master works fine (see previous link), so this is an Ubuntu-specific bug

[jondee (jonathandilks)]

@ads20000 we are still waiting to confirm they tested this on trash:// though :)

[Ads20000 (ads20000)]

As per the upstream bug:
The bug doesn't exist in the Files 3.24.1 Flatpak.
Also I got a newer stacktrace here: https://paste.ubuntu.com/p/R8bvFbbw77/

[Ads20000 (ads20000)]

Upstream: 'Having nautilus-dropbox installed is a shortcut to reproducing the crash. Otherwise, you can trigger it by copying/moving the two files together somewhere.'

They've reopened the bug.

( I wouldn't be commenting this if bug 1745210 were fixed ;) )

[Ads20000 (ads20000)]

This is fixed upstream (I'm assuming this means it'll get into GNOME 3.30 and Ubuntu 18.10)

[Ads20000 (ads20000)]

(well, supposedly fixed by a commit, will test in the Files Nightly Flatpak soon to see if I can reproduce the bug post-commit)

[Sebastien Bacher (seb128)]

The upstream commit is https://gitlab.gnome.org/GNOME/nautilus/commit/0d24b6a1

Could you confirm if the fix is working?

[Ads20000 (ads20000)]

As far as I understand, Fix Committed is the wrong status for the Ubuntu task since the fix is not committed into Ubuntu.

I'm waiting for someone to rebuild the Files Nightly Flatpak (the last build was 2018-03-18 08:53:15 +0000) since I don't really want to build master by hand.

[Sebastien Bacher (seb128)]

The new version is in Ubuntu now