shotwell crashed with SIGSEGV in g_menu_model_get_n_items()

[Jan Adamic]

* Impact

Shotwell hits a segfault in some situations

* Test case

There is no specific steps described to lead to the issue. The upstream commit "Fix crash when dismissing modifications".

The issue is being reported to e.u.c though at least under those ids
https://errors.ubuntu.com/problem/9dfc154a07b6ec76929e2c3c74419ac85a1de015
https://errors.ubuntu.com/problem/44455d848d6d64d4838e9a5af557eb0b092bd669

If the fix is right the new version should get no report

* Regression potential

Check that the notifications still work as they should and that there is no other visible regressions

--------------------------------

It happened during opening and closing some raw photos.

ProblemType: Crash
DistroRelease: Ubuntu 17.10
Package: shotwell 0.26.3-1ubuntu1
ProcVersionSignature: Ubuntu 4.13.0-12.13-generic 4.13.3
Uname: Linux 4.13.0-12-generic x86_64
NonfreeKernelModules: wl
ApportVersion: 2.20.7-0ubuntu3
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Thu Oct 12 18:27:38 2017
ExecutablePath: /usr/bin/shotwell
InstallationDate: Installed on 2017-10-06 (5 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Alpha amd64 (20170926)
ProcCmdline: shotwell /media/username/podatki\ in\ backup/SLIKE\ iz\ MY\ PICTURES\ 18GB/PIKNIK\ 3.VS/IMG_3803.CR2
SegvAnalysis:
 Segfault happened at: 0x7fa291b2e510 <g_menu_model_get_n_items>: mov (%rdi),%rax
 PC (0x7fa291b2e510) ok
 source "(%rdi)" (0x00000000) not located in a known VMA region (needed readable region)!
 destination "%rax" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: shotwell
StacktraceTop:
 g_menu_model_get_n_items () at /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
 () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
 () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
 () at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
 g_signal_emit_valist () at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
Title: shotwell crashed with SIGSEGV in g_menu_model_get_n_items()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip libvirt lpadmin plugdev sambashare sudo

[Joachim (joachim-redhat-bugs)]

Version-Release number of selected component:
shotwell-0.26.2-1.fc26

Additional info:
reporter: libreport-2.9.1
backtrace_rating: 4
cmdline: shotwell file:///run/media/frieben/SD512M
crash_function: g_menu_model_get_n_items
executable: /usr/bin/shotwell
journald_cursor: s=ac04244c790f4e229ea8422e9c44aa15;i=141d6;b=b7423e34eeba4ad3b12d0d3758dd916c;m=3efef56c1;t=5546cfe8731dd;x=8e6f04acb61f6706
kernel: 4.11.9-300.fc26.x86_64
rootdir: /
runlevel: N 5
type: CCpp
uid: 1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 g_menu_model_get_n_items at gmenumodel.c:494
 #1 gtk_application_window_update_shell_shows_app_menu at gtkapplicationwindow.c:316
 #2 gtk_application_window_real_realize at gtkapplicationwindow.c:683
 #3 _g_closure_invoke_va at gclosure.c:867
 #6 gtk_widget_realize at gtkwidget.c:5461
 #14 single_photo_page_blank_display at /home/jens/Source/shotwell/src/Page.vala:2186
 #15 import_queue_page_on_import_complete at /home/jens/Source/shotwell/src/library/ImportQueuePage.vala:195
 #16 _import_queue_page_on_import_complete_batch_import_import_complete at /home/jens/Source/shotwell/src/library/ImportQueuePage.vala:86
 #20 g_signal_emit_by_name at gsignal.c:3487
 #21 batch_import_report_completed at /home/jens/Source/shotwell/src/BatchImport.vala:621

[Joachim (joachim-redhat-bugs)]

Created attachment 1299895
File: backtrace

[Joachim (joachim-redhat-bugs)]

Created attachment 1299896
File: cgroup

[Joachim (joachim-redhat-bugs)]

Created attachment 1299897
File: core_backtrace

[Joachim (joachim-redhat-bugs)]

Created attachment 1299898
File: cpuinfo

[Joachim (joachim-redhat-bugs)]

Created attachment 1299899
File: dso_list

[Joachim (joachim-redhat-bugs)]

Created attachment 1299900
File: environ

[Joachim (joachim-redhat-bugs)]

Created attachment 1299901
File: exploitable

[Joachim (joachim-redhat-bugs)]

Created attachment 1299902
File: limits

[Joachim (joachim-redhat-bugs)]

Created attachment 1299903
File: maps

[Joachim (joachim-redhat-bugs)]

Created attachment 1299904
File: open_fds

[Joachim (joachim-redhat-bugs)]

Created attachment 1299905
File: proc_pid_status

[Joachim (joachim-redhat-bugs)]

Created attachment 1299906
File: var_log_messages

[Apport retracing service (apport)]

StacktraceTop:
 g_menu_model_get_n_items (model=0x0) at ../../../../gio/gmenumodel.c:494
 gtk_application_window_update_shell_shows_app_menu (window=0x55b0b07da470, settings=<optimized out>) at ././gtk/gtkapplicationwindow.c:316
 gtk_application_window_real_realize (widget=0x55b0b07da470) at ././gtk/gtkapplicationwindow.c:683
 _g_closure_invoke_va (closure=0x55b0b05af980, return_value=0x0, instance=0x55b0b07da470, args=0x7fff28ea8670, n_params=0, param_types=0x0) at ../../../../gobject/gclosure.c:867
 g_signal_emit_valist (instance=0x55b0b07da470, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7fff28ea8670) at ../../../../gobject/gsignal.c:3300

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Renardo (renardo)]

On my computer the bug manifested itself when I merely connected a USB flash card, without displaying images. I never use Shotwell but Ubuntu 17.10 insists on opening it when I connect a flash card with photos, although my settings for photos are on “open directory” as they always were – but that is a different issue.

Disconnecting, removing, re-inserting and reconnecting the flash card within the same X session made Shotwell start without problems.

By the way I am using XOrg under Ubuntu 17.10, since *putty* has problems with Xwayward (bug 1720905). During the few days when I was using Xwayward the problem did not appear, though I connected the same flash card at least once.

[Frank (frank-redhat-bugs)]

Similar problem has been detected:

Save an file

reporter: libreport-2.9.1
backtrace_rating: 4
cmdline: shotwell /tmp/Foto0456.jpg
crash_function: g_menu_model_get_n_items
executable: /usr/bin/shotwell
journald_cursor: s=7986b23d758a4fc2b6d4ba0dc89e2c7c;i=e898;b=04cb669e3acb4ab197f232b162a6a95e;m=1a415fda7;t=55fab36a7254c;x=d2eeb50c56207950
kernel: 4.13.16-202.fc26.x86_64
package: shotwell-0.26.4-1.fc26
reason: shotwell killed by SIGSEGV
rootdir: /
runlevel: N 5
type: CCpp
uid: 1000

[Saw-bgzlrhat (saw-bgzlrhat)]

Similar problem has been detected:

I cropped a JPG image, then saved it, then was quitting shotwell.
When quitting, for mysterious reasons I was asked to save unsaved changes, to which I agreed.
Then, while quitting, shotwell caught SIGSEGV.

reporter: libreport-2.9.1
backtrace_rating: 4
cmdline: shotwell IMG_7583.JPG
crash_function: g_menu_model_get_n_items
executable: /usr/bin/shotwell
journald_cursor: s=ea36678748d14e7099e099899a277d45;i=13ec4b;b=886baa074a164de8b9d50334d3e14d94;m=294a0b7aa5a;t=563e8d8675ded;x=7ff434b75183cd45
kernel: 4.14.8-200.fc26.x86_64
package: shotwell-0.26.4-1.fc26
reason: shotwell killed by SIGSEGV
rootdir: /
runlevel: 3 5
type: CCpp
uid: 577

[Randy Freeman (rlfreeman724)]

Cropped image and used "send to"

[Brian Neltner (neltnerb)]

Happens to me whenever I make edits to a photo. It keeps asking me to save repeatedly even when the document has already been saved and does so again when I reopen the file (which shows the changes!).

Doesn't actually "crash" on me though if that's different. It just thinks it crashes as far as I can tell, Shotwell itself seems to keep running... maybe a subcomponent that Shotwell itself is properly recovering from?

[corrado venturini (corradoventu)]

exiting without saving after many modifications on a .jpg

corrado@corrado-HP-p4-cc-0620:~$ inxi -Fx
System: Host: corrado-HP-p4-cc-0620 Kernel: 4.15.0-23-generic x86_64 bits: 64 compiler: gcc v: 7.3.0
           Desktop: Gnome 3.28.2 Distro: Ubuntu 18.10 (Cosmic Cuttlefish)
Machine: Type: Laptop System: Hewlett-Packard product: HP 250 G3 Notebook PC v: 0991100000000000000600087
           serial: <root required>
           Mobo: Hewlett-Packard model: 2211 v: 86.49 serial: <root required> UEFI: Insyde v: F.36
           date: 12/18/2014
Battery: ID-1: BAT1 charge: 22.2 Wh condition: 22.2/22.2 Wh (100%) model: 13-42 OA03031 status: Full
CPU: Topology: Dual Core model: Intel Core i5-4210U bits: 64 type: MT MCP arch: Haswell rev: 1
           L2 cache: 3072 KiB
           flags: lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx bogomips: 19156
           Speed: 798 MHz min/max: 800/2700 MHz Core speeds (MHz): 1: 798 2: 798 3: 798 4: 799
Graphics: Card-1: Intel Haswell-ULT Integrated Graphics driver: i915 v: kernel bus ID: 00:02.0
           Display: x11 server: X.Org 1.19.6 driver: i915 resolution: 1366x768~60Hz
           OpenGL: renderer: Mesa DRI Intel Haswell Mobile v: 4.5 Mesa 18.1.2 direct render: Yes
Audio: Card-1: Intel Haswell-ULT HD Audio driver: snd_hda_intel v: kernel bus ID: 00:03.0
           Card-2: Intel 8 Series HD Audio driver: snd_hda_intel v: kernel bus ID: 00:1b.0
           Sound Server: ALSA v: k4.15.0-23-generic
Network: Card-1: Realtek RTL8101/2/6E PCI Express Fast/Gigabit Ethernet driver: r8169 v: 2.3LK-NAPI
           port: 3000 bus ID: 08:00.0
           IF: enp8s0 state: down mac: 5c:b9:01:06:ba:ce
           Card-2: Ralink RT3290 Wireless 802.11n 1T/1R PCIe driver: rt2800pci v: 2.3.0 bus ID: 09:00.0
           IF: wlo1 state: up mac: ac:d1:b8:82:03:5d
Drives: HDD Total Size: 465.76 GiB used: 70.82 GiB (15.2%)
           ID-1: /dev/sda vendor: Seagate model: ST500LT012-1DG142 size: 465.76 GiB
Partition: ID-1: / size: 31.25 GiB used: 6.09 GiB (19.5%) fs: ext4 dev: /dev/sda4
           ID-2: swap-1 size: 4.00 GiB used: 0 KiB (0.0%) fs: swap dev: /dev/sda2
Sensors: System Temperatures: cpu: 42.0 C mobo: 42.0 C
           Fan Speeds (RPM): N/A
Info: Processes: 241 Uptime: 4h 38m Memory: 3.79 GiB used: 1.96 GiB (51.9%) Init: systemd runlevel: 5
           Compilers: gcc: N/A Shell: bash v: 4.4.19 inxi: 3.0.13
corrado@corrado-HP-p4-cc-0620:~$

[Jens Georg (yg-jensge)]

https://gitlab.gnome.org/GNOME/shotwell/commit/77514d6960f563e1cb79f8510e123ee49461d24d

[Sebastien Bacher (seb128)]

Thanks Jens!

[Sebastien Bacher (seb128)]

I've uploaded the fix to disco and cosmic now, I'm going to do bionic a bit later while updating to 0.28.4

[Launchpad Janitor (janitor)]

This bug was fixed in the package shotwell - 0.30.1-0ubuntu4

---------------
shotwell (0.30.1-0ubuntu4) disco; urgency=medium

  * debian/patches/git_notification_segfault.patch:
    - direct: Fix crash when dismissing modifications (lp: #1723181)

 -- Sebastien Bacher <email address hidden> Wed, 07 Nov 2018 15:39:16 +0100

[Timo Aaltonen (tjaalton)]

Hello Jan, or anyone else affected,

Accepted shotwell into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shotwell/0.30.1-0ubuntu3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Jan, or anyone else affected,

Accepted shotwell into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shotwell/0.28.4-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Sebastien Bacher (seb128)]

Is there someone who was able to trigger the issue/having an hidpi screen to test the fix?

[Sebastien Bacher (seb128)]

Using 0.30.1-0ubuntu3 on cosmic it works without visible issue/regression, the error tracker still see reports though, it might improve thing/fix some cases but there is still an issue. Setting as verification-cosmic-done on the basis that it's not a regression and might still improve things even if it's not perfect

[Sebastien Bacher (seb128)]

0.28.4-0ubuntu1 is in the same case

[Launchpad Janitor (janitor)]

This bug was fixed in the package shotwell - 0.30.1-0ubuntu3

---------------
shotwell (0.30.1-0ubuntu3) cosmic; urgency=medium

  * debian/patches/git_notification_segfault.patch:
    - direct: Fix crash when dismissing modifications (lp: #1723181)

 -- Sebastien Bacher <email address hidden> Wed, 07 Nov 2018 15:39:16 +0100

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for shotwell has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package shotwell - 0.28.4-0ubuntu1

---------------
shotwell (0.28.4-0ubuntu1) bionic; urgency=medium

  * New bugfix update (lp: #1802895)
    - Fix "Out of memory" issues when scrolling through large collections
      (lp: #1606491)
  * debian/patches/git_notifications_segfault.patch:
    - direct: Fix crash when dismissing modifications (lp: #1723181)

 -- Sebastien Bacher <email address hidden> Mon, 12 Nov 2018 11:43:31 +0100