Crash when ofono is respawning fast
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
urfkill (Ubuntu) |
Fix Released
|
High
|
Alfonso Sanchez-Beato |
Bug Description
To reproduce:
RTM image #159, Krillin.
# stop ofono
# start ofono OFONO_RIL_
This makes ofono crash and respawn as the number of SIM slots is not specified, and 1 is used for that number instead of 2.
Backtrace is:
#0 set_online_cb (source_
at urf-device-
#1 0xb6ee9970 in g_simple_
at /build/
#2 0xb6f32b7e in reply_cb (connection=
at /build/
#3 0xb6ee9970 in g_simple_
at /build/
#4 0xb6f2a74e in g_dbus_
user_
#5 0xb6ee9970 in g_simple_
at /build/
#6 0xb6ee99b6 in complete_in_idle_cb (data=<optimized out>)
at /build/
#7 0xb6dafe78 in g_main_dispatch (context=0x39eb8)
at /build/
#8 g_main_
at /build/
#9 0xb6db00fc in g_main_
dispatch=
at /build/
#10 0xb6db0398 in g_main_loop_run (loop=0x39ff8) at /build/
#11 0x000140dc in main (argc=1, argv=0xbefff504) at urf-main.c:276
Changed in urfkill (Ubuntu): | |
status: | New → In Progress |
importance: | Undecided → High |
assignee: | nobody → Alfonso Sanchez-Beato (alfonsosanchezbeato) |
Changed in urfkill (Ubuntu): | |
status: | In Progress → Fix Released |
It looks like two nested calls to urf-device- ofono.c: set_soft( ) provokes this. The second call to set_soft() is made before the callback for the first call has been invoked. Apparently this provokes that the callback for the second one is invoked after the call to the object's dispose().
I think that the fact that we are using the same GCancellable object in both calls makes that the call to g_object_unref() for the DBus proxy in dispose() does not cancel the second callback, so it gets called in the end, but the modem object has already been destroyed.