! Please note that this is a snapshot of our old Bugzilla server, which is read only since May 29, 2020. Please go to gitlab.xfce.org for our new server !
segfault in XfceRc stuff
Status:
RESOLVED: FIXED
Product:
Libxfce4util
Component:
General

Comments

Description Brian J. Tarricone (not reading bugmail) 2007-02-01 05:59:43 CET
Hey Benny...  I have a new segfault in the xfce menu plugin and xfdesktop, in the menu code, while reading an rc file.  It looks like it doesn't happen on startup, but after it's been running for a while.  Any chance there's a problem with the changes you made to XfceRc to remove the memchunk stuff?  Or did it just trigger a latent xfdesktop bug?

bt:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 807546032 (LWP 21234)]
0x0ee01128 in ?? () from /usr/lib/libglib-2.0.so.0
(gdb) bt
#0  0x0ee01128 in ?? () from /usr/lib/libglib-2.0.so.0
#1  0x0ee010b8 in ?? () from /usr/lib/libglib-2.0.so.0
#2  0x0ee01ce8 in g_slice_alloc () from /usr/lib/libglib-2.0.so.0
#3  0x0ee01e3c in g_slice_alloc0 () from /usr/lib/libglib-2.0.so.0
#4  0x0f66e548 in _xfce_rc_simple_new (shared=0x0, 
    filename=0x10158ee8 "/home/brian/.cache/xfce4/desktop/menu-cache--home-brian-.config-xfce4-desktop-menu.xml.rc", readonly=0) at xfce-rc-simple.c:603
#5  0x0f66c988 in _xfce_rc_config_new (type=XFCE_RESOURCE_CACHE, 
    resource=0x7f9dbe78 "xfce4/desktop/menu-cache--home-brian-.config-xfce4-desktop-menu.xml.rc", readonly=0) at xfce-rc-config.c:154
#6  0x0f66b328 in IA__xfce_rc_config_open (type=XFCE_RESOURCE_CACHE, 
    resource=0x7f9dbe78 "xfce4/desktop/menu-cache--home-brian-.config-xfce4-desktop-menu.xml.rc", readonly=0) at xfce-rc.c:139
#7  0x0ec9e304 in desktop_menu_cache_flush (cache_file_suffix=0xee68c08 "")
    at desktop-menu-cache.c:379
#8  0x0ec9d298 in _generate_menu (desktop_menu=0x10062b10, force=1)
    at desktop-menu.c:140
#9  0x0ec9d664 in _menu_check_update (data=0x10062b10) at desktop-menu.c:184
#10 0x0ede737c in ?? () from /usr/lib/libglib-2.0.so.0
#11 0x0ede6cbc in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#12 0x0edea6dc in ?? () from /usr/lib/libglib-2.0.so.0
#13 0x0edeab4c in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#14 0x0f81267c in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#15 0x10004188 in main (argc=7, argv=0x7f9dd314) at desktop-menu-plugin.c:1082
(gdb) up
#1  0x0ee010b8 in ?? () from /usr/lib/libglib-2.0.so.0
(gdb) 
#2  0x0ee01ce8 in g_slice_alloc () from /usr/lib/libglib-2.0.so.0
(gdb) 
#3  0x0ee01e3c in g_slice_alloc0 () from /usr/lib/libglib-2.0.so.0
(gdb) 
#4  0x0f66e548 in _xfce_rc_simple_new (shared=0x0, 
    filename=0x10158ee8 "/home/brian/.cache/xfce4/desktop/menu-cache--home-brian-.config-xfce4-desktop-menu.xml.rc", readonly=0) at xfce-rc-simple.c:603
603       simple = _xfce_slice_new0 (XfceRcSimple);
(gdb) info args
shared = (XfceRcSimple *) 0x0
filename = (
    const gchar *) 0x10158ee8 "/home/brian/.cache/xfce4/desktop/menu-cache--home-brian-.config-xfce4-desktop-menu.xml.rc"
readonly = 0
(gdb) info locals
simple = (XfceRcSimple *) 0xf68b3c0
(gdb)
Comment 1 Benedikt Meurer editbugs 2007-02-04 11:51:01 CET
If g_slice_alloc() crashes, this usually means that someone called g_slice_free() with invalid memory. Try running with G_SLICE=always-malloc and malloc debug on.
Comment 2 Brian J. Tarricone (not reading bugmail) 2007-02-06 09:28:18 CET
Setting G_SLICE=always-malloc causes xfdesktop not to crash.  Ditto when adding MALLOC_CHECK_=2.
Comment 3 Benedikt Meurer editbugs 2007-02-06 15:55:05 CET
Did you set both G_SLICE=always-malloc and MALLOC_CHECK_=2? If so, that's going to be fun to track. One thing you could do however: Open the same folder in Thunar and reload several times. If it doesn't crash Thunar, it's probably not XfceRc that's buggy.
Comment 4 Brian J. Tarricone (not reading bugmail) 2007-02-06 20:30:32 CET
I tried it both ways... though shouldn't MALLOC_CHECK_=2 make it *easier* to debug, not harder?  At least, that's been my experience...

I'll check Thunar when I get home, but I'm pretty sure I haven't had problems with it.
Comment 5 Nick Schermer editbugs 2007-02-09 11:31:31 CET
This memory problem is in libxfce4util. It happens when xfce-rc.c:171 _xfce_slice_free (XfceRc, rc); is called.

GSlice: MemChecker: attempt to release block with invalid size: 0x80a4e48 size=112 invalid-size=80

This because the XfceRc send to the function is not really and XfceRc, but and XfceRcConfig (see xfce_rc_config_open), so the sizes don't match == crash.

The problem is, when you change the line to _xfce_slice_free (XfceRcConfig, rc);, glib (from trunk) refuses to compile, because the sizes don't match. Even when you try something like:

XfceRcConfig *config = XFCE_RC_CONFIG (rc);
_xfce_slice_free (XfceRcConfig, config);

the compilation fails with: xfce-rc.c:172: error: invalid application of 'sizeof' to incomplete type 'XfceRcConfig'.

So Benny, this one is all yours ^_^.
Comment 6 Brian J. Tarricone (not reading bugmail) 2007-02-09 22:44:27 CET
Created attachment 987 
fix-rc-slice-crash.diff

This appears to fix the problem for me, though I haven't let it run for all that long.  I added a 'free_rc()' member to the XfceRc vtable, and implemented them separately for the simple and config rc types.
Comment 7 Benedikt Meurer editbugs 2007-02-12 18:03:39 CET
Created attachment 992 
Fix

I'd rather suggest to use this fix (simpler).
Comment 8 Brian J. Tarricone (not reading bugmail) 2007-02-12 18:19:37 CET
Fine by me; it's your code ^_^
Comment 9 Nick Schermer editbugs 2007-02-12 18:27:07 CET
LOL, that's just lazy ^_^ (but the best way to fix it).
Comment 10 Benedikt Meurer editbugs 2007-02-12 18:35:23 CET
Fixed with revision 24960.

2007-02-12      Benedikt Meurer <benny@xfce.org>

        * libxfce4util/xfce-rc-config.c, libxfce4util/xfce-rc.c,
          libxfce4util/xfce-rc-simple.c: Fix invalid g_slice_free1() in
          XfceRc code. Bug #2854.

Bug #2854

Reported by:
Brian J. Tarricone (not reading bugmail)
Reported on: 2007-02-01
Last modified on: 2009-07-15

People

Assignee:
Benedikt Meurer
CC List:
1 user

Version

Attachments

fix-rc-slice-crash.diff (3.23 KB, patch)
2007-02-09 22:44 CET , Brian J. Tarricone (not reading bugmail)
no flags
Fix (1011 bytes, patch)
2007-02-12 18:03 CET , Benedikt Meurer
no flags

Additional information