compiz crashed with SIGSEGV in g_type_check_instance_is_a() from g_object_unref() from _g_file_attribute_value_clear() from ... from query_info_async_cb() [libgvfsdbus.so]

[Le Gluon Du Net]

[IMPACT]

Invalid reference counting could cause compiz/unity to crash, although the usage of slice allocator under normal circumstances workarounds that.

[TESTCASE]

1. Open a terminal (Ctrl+Alt+T)
2. Run: `MALLOC_CHECK_=3 G_SLICE=always-malloc unity --replace`
Expected: Unity/Compiz restarts and is usable.
Observed: Unity/Compiz crashes.

[Regression Potential]

* compiz crashes shortly after start
* trash icon is not usable

ORIGINAL DESCRIPTION:
Hello,

Daniel Angel, in bug 750386, asked us to test this command line:

env MALLOC_CHECK_=3 G_SLICE=always-malloc unity --replace

wich makes Unity/compiz crashed.

ProblemType: Crash
DistroRelease: Ubuntu 12.10
Package: compiz-core 1:0.9.8.4-0ubuntu1
ProcVersionSignature: Ubuntu 3.5.0-16.25-generic 3.5.4
Uname: Linux 3.5.0-16-generic i686
NonfreeKernelModules: wl
.tmp.unity.support.test.0:

ApportVersion: 2.6.1-0ubuntu1
Architecture: i386
CheckboxSubmission: 089e3c944ec0c0ba294fba3f2fda5dbe
CheckboxSystem: e2a9e28435948e86843155dc45ba128e
CompizPlugins: [core,composite,opengl,compiztoolbox,decor,vpswitch,snap,mousepoll,resize,place,move,wall,grid,regex,imgpng,session,gnomecompat,animation,fade,workarounds,scale,expo,ezoom]
CompositorRunning: compiz
Date: Thu Oct 4 12:12:08 2012
DistUpgraded: 2012-08-27 16:56:34,598 DEBUG enabling apt cron job
DistroCodename: quantal
DistroVariant: ubuntu
ExecutablePath: /usr/bin/compiz
GraphicsCard:
 Advanced Micro Devices [AMD] nee ATI RV630 [Mobility Radeon HD 2600 XT] [1002:9583] (prog-if 00 [VGA controller])
   Subsystem: Apple Inc. Device [106b:0083]
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha i386 (20120222)
MachineType: Apple Inc. iMac7,1
ProcCmdline: compiz --replace
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.5.0-16-generic root=UUID=147fe03f-9d3d-456c-a928-248ec8a163cf ro quiet splash vt.handoff=7
SegvAnalysis:
 Segfault happened at: 0xb6fecfc7 <g_type_check_instance_is_a+87>: testb $0x4,0xe(%ecx)
 PC (0xb6fecfc7) ok
 source "$0x4" ok
 destination "0xe(%ecx)" (0x03a7fe26) not located in a known VMA region (needed writable region)!
SegvReason: writing unknown VMA
Signal: 11
SourcePackage: compiz
StacktraceTop:
 g_type_check_instance_is_a () from /usr/lib/i386-linux-gnu/libgobject-2.0.so.0
 g_object_unref () from /usr/lib/i386-linux-gnu/libgobject-2.0.so.0
 ?? () from /usr/lib/i386-linux-gnu/libgio-2.0.so.0
 ?? () from /usr/lib/i386-linux-gnu/libgio-2.0.so.0
 g_object_unref () from /usr/lib/i386-linux-gnu/libgobject-2.0.so.0
Title: compiz crashed with SIGSEGV in g_type_check_instance_is_a()
UpgradeStatus: Upgraded to quantal on 2012-08-27 (37 days ago)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
XsessionErrors:
 gnome-session[3419]: WARNING: Application 'compiz.desktop' killed by signal 9
 gnome-session[3419]: WARNING: App 'compiz.desktop' respawning too quickly
 gnome-session[3419]: CRITICAL: We failed, but the fail whale is dead. Sorry....
 gnome-session[3419]: WARNING: App 'compiz.desktop' respawning too quickly
dmi.bios.date: 03/05/08
dmi.bios.vendor: Apple Inc.
dmi.bios.version: IM71.88Z.007A.B03.0803051705
dmi.board.asset.tag: Base Board Asset Tag
dmi.board.name: Mac-F4238CC8
dmi.board.vendor: Apple Inc.
dmi.board.version: PVT
dmi.chassis.asset.tag: Asset Tag#
dmi.chassis.type: 13
dmi.chassis.vendor: Apple Inc.
dmi.chassis.version: Mac-F4238CC8
dmi.modalias: dmi:bvnAppleInc.:bvrIM71.88Z.007A.B03.0803051705:bd03/05/08:svnAppleInc.:pniMac7,1:pvr1.0:rvnAppleInc.:rnMac-F4238CC8:rvrPVT:cvnAppleInc.:ct13:cvrMac-F4238CC8:
dmi.product.name: iMac7,1
dmi.product.version: 1.0
dmi.sys.vendor: Apple Inc.
version.compiz: compiz 1:0.9.8.4-0ubuntu1
version.libdrm2: libdrm2 2.4.39-0ubuntu1
version.libgl1-mesa-dri: libgl1-mesa-dri 9.0~git20120917.7cfd42ce-0ubuntu3
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 9.0~git20120917.7cfd42ce-0ubuntu3
version.xserver-xorg-core: xserver-xorg-core 2:1.13.0-0ubuntu5
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.7.3-0ubuntu1
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.99.99~git20120913.8637f772-0ubuntu1
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.20.9-0ubuntu2
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.2-0ubuntu2

[Apport retracing service (apport)]

StacktraceTop:
 g_type_check_instance_is_a (type_instance=type_instance@entry=0xa963320, iface_type=iface_type@entry=80) at /build/buildd/glib2.0-2.34.0/./gobject/gtype.c:3964
 g_object_unref (_object=0xa963320) at /build/buildd/glib2.0-2.34.0/./gobject/gobject.c:2915
 _g_file_attribute_value_clear (attr=0xa81206c) at /build/buildd/glib2.0-2.34.0/./gio/gfileattribute.c:252
 g_file_info_finalize (object=0xac5dab0) at /build/buildd/glib2.0-2.34.0/./gio/gfileinfo.c:325
 g_object_unref (_object=0xac5dab0) at /build/buildd/glib2.0-2.34.0/./gobject/gobject.c:3023

[Daniel van Vugt (vanvugt)]

Confirmed. I was getting this exact stacktrace myself yesterday. The crash goes away if you disable the unityshell plugin.

Also "libgvfsdbus.so" suggests it's something to do with the Unity launcher or file lens.

[Daniel van Vugt (vanvugt)]

The only async glib call I can find that might explain this is:
unity-shared/IconLoader.cpp: g_io_scheduler_job_send_to_mainloop_async (job, LoadIconComplete, task, nullptr);

[Daniel van Vugt (vanvugt)]

Sorry, there are more async queries that might cause this bug...

launcher/TrashLauncherIcon.cpp: g_spawn_command_line_async("xdg-open trash://", &error);
launcher/TrashLauncherIcon.cpp: g_file_query_info_async(location,
UnityCore/DBusIndicators.cpp: g_spawn_command_line_async(cmd.c_str(), &error);
UnityCore/FilesystemLenses.cpp: g_file_enumerate_children_async(directory_,
UnityCore/FilesystemLenses.cpp: g_file_enumerator_next_files_async (in_enumerator, 64, G_PRIORITY_DEFAULT,
UnityCore/FilesystemLenses.cpp: g_file_load_contents_async(file,
unity-shared/IconLoader.cpp: g_io_scheduler_job_send_to_mainloop_async (job, LoadIconComplete, task, nullptr);

[Daniel van Vugt (vanvugt)]

Fix committed into lp:unity at revision 2821, scheduled for release in Unity 7.0
Fix committed into lp:unity/6.0 at revision 2772, scheduled for release in Unity 6.10

[Chris Halse Rogers (raof)]

Hello Le, or anyone else affected,

Accepted unity into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/unity/6.10.0-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Timo Jyrinki (timo-jyrinki)]

Does not crash anymore.

[Chris Halse Rogers (raof)]

Hello Le, or anyone else affected,

Accepted unity into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/unity/6.10.0-0ubuntu2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Timo Jyrinki (timo-jyrinki)]

No crash with 6.10.0-0ubuntu2 either

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 6.10.0-0ubuntu2

---------------
unity (6.10.0-0ubuntu2) quantal-proposed; urgency=low

  * Cherry-picked from upstream:
    - [SRU Regression] Launcher icon corruption while rearranging
      (LP: #1071813)

unity (6.10.0-0ubuntu1) quantal-proposed; urgency=low

  [ Timo Jyrinki ]
  * New upstream release.
    - Gap between the dash gradient and the panel one (LP: #1062375)
    - [regression] Dash closes if the onscreen keyboard is outside of
      Dash' geometry (LP: #1058705)
    - Dash - Category expander arrow is in expanded mode no matter if
      category is actually expanded (LP: #1053047)
    - Unity panel does not show the kate menus in the correct order
      (LP: #1062283)
    - compiz crashed with SIGSEGV in g_type_check_instance_is_a() from
      g_object_unref() from _g_file_attribute_value_clear() from ... from
      query_info_async_cb() [libgvfsdbus.so] (LP: #1061510)
    - dash's music album previews: can't drag the scrollbar (LP: #1056995)
    - Small chunks of the panel shadow appear individually (and very dark)
      (LP: #1057528)
    - compiz crashed with SIGSEGV on Unity "Unmount" (LP: #1055812)
    - [regression] Dash - 'More suggestions' icons in App Lens are too
      large (LP: #1052513)
    - BamfLauncherIcon: ensure the icon and name values when the running
      state changes (LP: #772986)
    - Changes the swapping order of the detail mode. Now the currently
      active window gets moved to the end, instead of getting swapped
      with the last used window (LP: #1061229)
    - Fixes GetRegion tex coord maths (LP: #1058391)
    - Fixed fade-in behavior of Unity's showdesktop function (LP: #1063249)
    - Added <feature>showdesktop</feature> to unityshell.xml.in, because
      the feature showdesktop is provided by unityshell. (LP: #1006429)
      (LP: #1006434) (LP: #1063171)
    - Make HudLauncherIcon::ubus_manager_ "un-static" (LP: #1048274)
    - Fix reference counting problem which leads to memory leaks and a
      crash in MT grab handles (LP: #1046201)
    - Ensure categories with non-personal results can show up before empty
      categories with personal results (LP: #1067327)
    - fix a backup error (LP: #1066646)

  [ Łukasz 'sil2100' Zemczak ]
  * Cherry-picked from upstream:
    - Reverted the switch from boost to std which was part of the fix for
      LP: #1046201. The crash is still fixed without this change, so it was
      actually unneeded
 -- Lukasz 'sil2100' Zemczak <email address hidden> Tue, 30 Oct 2012 18:00:00 +0100

[Clint Byrum (clint-fewbar)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 6.10.0-0ubuntu3

---------------
unity (6.10.0-0ubuntu3) raring; urgency=low

  * Upload to raring

unity (6.10.0-0ubuntu2) quantal-proposed; urgency=low

  * Cherry-picked from upstream:
    - [SRU Regression] Launcher icon corruption while rearranging
      (LP: #1071813)

unity (6.10.0-0ubuntu1) quantal-proposed; urgency=low

  [ Timo Jyrinki ]
  * New upstream release.
    - Gap between the dash gradient and the panel one (LP: #1062375)
    - [regression] Dash closes if the onscreen keyboard is outside of
      Dash' geometry (LP: #1058705)
    - Dash - Category expander arrow is in expanded mode no matter if
      category is actually expanded (LP: #1053047)
    - Unity panel does not show the kate menus in the correct order
      (LP: #1062283)
    - compiz crashed with SIGSEGV in g_type_check_instance_is_a() from
      g_object_unref() from _g_file_attribute_value_clear() from ... from
      query_info_async_cb() [libgvfsdbus.so] (LP: #1061510)
    - dash's music album previews: can't drag the scrollbar (LP: #1056995)
    - Small chunks of the panel shadow appear individually (and very dark)
      (LP: #1057528)
    - compiz crashed with SIGSEGV on Unity "Unmount" (LP: #1055812)
    - [regression] Dash - 'More suggestions' icons in App Lens are too
      large (LP: #1052513)
    - BamfLauncherIcon: ensure the icon and name values when the running
      state changes (LP: #772986)
    - Changes the swapping order of the detail mode. Now the currently
      active window gets moved to the end, instead of getting swapped
      with the last used window (LP: #1061229)
    - Fixes GetRegion tex coord maths (LP: #1058391)
    - Fixed fade-in behavior of Unity's showdesktop function (LP: #1063249)
    - Added <feature>showdesktop</feature> to unityshell.xml.in, because
      the feature showdesktop is provided by unityshell. (LP: #1006429)
      (LP: #1006434) (LP: #1063171)
    - Make HudLauncherIcon::ubus_manager_ "un-static" (LP: #1048274)
    - Fix reference counting problem which leads to memory leaks and a
      crash in MT grab handles (LP: #1046201)
    - Ensure categories with non-personal results can show up before empty
      categories with personal results (LP: #1067327)
    - fix a backup error (LP: #1066646)

  [ Łukasz 'sil2100' Zemczak ]
  * Cherry-picked from upstream:
    - Reverted the switch from boost to std which was part of the fix for
      LP: #1046201. The crash is still fixed without this change, so it was
      actually unneeded
 -- Didier Roche <email address hidden> Fri, 09 Nov 2012 08:06:47 +0100

[Stephen M. Webb (bregma)]

Fix Released in Unity Unity 7.0.0 "R series".