compiz assert failure: *** Error in `compiz': free(): invalid next size (fast): 0x0000000003f5de50 ***

[Aneesh Neelam]

Freeze when using Unity. And Compiz crashed.

ProblemType: Crash
DistroRelease: Ubuntu 13.10
Package: unity 7.0.2+13.10.20130705.1-0ubuntu3
ProcVersionSignature: Ubuntu 3.10.0-4.13-generic 3.10.1
Uname: Linux 3.10.0-4-generic x86_64
ApportVersion: 2.11-0ubuntu1
Architecture: amd64
AssertionMessage: *** Error in `compiz': free(): invalid next size (fast): 0x0000000003f5de50 ***
CrashCounter: 1
Date: Tue Jul 23 22:53:56 2013
ExecutablePath: /usr/bin/compiz
ExecutableTimestamp: 1366264808
InstallationDate: Installed on 2013-01-22 (182 days ago)
InstallationMedia: This
MarkForUpload: True
ProcCmdline: compiz
ProcCwd: /home/aneesh
Signal: 6
SourcePackage: unity
StacktraceTop:
 __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f42a9235860 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199
 malloc_printerr (ptr=0x3f5de50, str=0x7f42a9235a00 "free(): invalid next size (fast)", action=3) at malloc.c:4902
 _int_free (av=<optimized out>, p=0x3f5de40, have_lock=0) at malloc.c:3758
 ?? () from /usr/lib/x86_64-linux-gnu/libpango-1.0.so.0
 ?? () from /usr/lib/x86_64-linux-gnu/libpango-1.0.so.0
Title: compiz assert failure: *** Error in `compiz': free(): invalid next size (fast): 0x0000000003f5de50 ***
UpgradeStatus: Upgraded to saucy on 2013-07-04 (19 days ago)
UserGroups: adm autopilot cdrom dialout dip lpadmin plugdev sambashare sudo vboxusers

[Apport retracing service (apport)]

StacktraceTop:
 __GI___open_catalog (cat_name=0x7f42a9235a00 " && exponent >= (-307) - (15 + 1)", nlspath=<optimized out>, env_var=0x7ffff8fe882f "compiz", catalog=0x30692a8) at open_catalog.c:109
 malloc_printerr (ptr=<optimized out>, str=0x7f42a92325eb "malloc: top chunk is corrupt", action=-1457300992) at malloc.c:4899
 top_check () at hooks.c:223
 g_private_get (key=key@entry=0x7f42a7ca3b40 <private_thread_memory>) at /build/buildd/glib2.0-2.37.3/./glib/gthread-posix.c:1016
 thread_memory_from_self () at /build/buildd/glib2.0-2.37.3/./glib/gslice.c:513

[Stephen M. Webb (bregma)]

This looks like a double delete in the Dash somewhere, probably due to recent refactoring.