[Pidgin] #8766: pidgin crashes on exit

Pidgin trac at pidgin.im
Tue Mar 24 02:33:09 EDT 2009


#8766: pidgin crashes on exit
--------------------------+-------------------------------------------------
 Reporter:  waschk        |           Owner:  lschiere
     Type:  defect        |          Status:  new     
Component:  unclassified  |         Version:  2.5.5   
 Keywords:                |   Launchpad_bug:          
--------------------------+-------------------------------------------------
 This happens on Mandriva Cooker x86_64 with pidgin 2.5.5 under GNOME. It
 was reported here first:
 https://qa.mandriva.com/show_bug.cgi?id=49003


 This is how the user says the bug is reproducable:

 1) log into gnome 2.26[[BR]]
 2) gnome-terminal[[BR]]
 3) rm -rf .purple[[BR]]
 4) pidgin[[BR]]
 5) close welcome dialog[[BR]]
 6) click task bar icon making pidgin visible[[BR]]
 7) right-click task bar icon and exit[[BR]]
 8) crash hang[[BR]]


 This is the backtrace from the crash:

 {{{
 #0  0x00007f668fc1ca15 in raise (sig=<value optimized out>) at
 ../nptl/sysdeps/unix/sysv/linux/raise.c:64
         pid = <value optimized out>
         selftid = <value optimized out>
 #1  0x00007f668fc1e243 in abort () at abort.c:88
         act = {__sigaction_handler = {sa_handler = 0x7fff9b1d1470,
 sa_sigaction = 0x7fff9b1d1470}, sa_mask = {__val = {140735795762432,
 42949672960, 140735795762496, 140735795781941, 15, 140078476267747, 3,
 140735795762490, 6,
       140078476267751, 2, 140735795762478, 2, 140078476268819, 1,
 140078476267747}}, sa_flags = 3, sa_restorer = 0x7fff9b1d1534}
         sigs = {__val = {32, 0 <repeats 15 times>}}
 #2  0x00007f668fc58388 in __libc_message (do_abort=2, fmt=0x7f668fd1a108
 "*** glibc detected *** %s: %s: 0x%s ***\n") at
 ../sysdeps/unix/sysv/linux/libc_fatal.c:170
         ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area =
 0x7fff9b1d1e90, reg_save_area = 0x7fff9b1d1da0}}
         ap_copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area =
 0x7fff9b1d1e90, reg_save_area = 0x7fff9b1d1da0}}
         fd = 10
         on_2 = <value optimized out>
         list = <value optimized out>
         nlist = <value optimized out>
         cp = <value optimized out>
         written = 6
 #3  0x00007f668fc5d9a8 in malloc_printerr (action=2, str=0x7f668fd1844e
 "free(): invalid pointer", ptr=<value optimized out>) at malloc.c:5994
         buf = "00000000023184b0"
         cp = <value optimized out>
 #4  0x00007f668fc5fc36 in __libc_free (mem=0x7f668fd11ac0) at
 malloc.c:3625
         ar_ptr = (mstate) 0x7f668ff48a00
         p = <value optimized out>
         hook = <value optimized out>
 #5  0x00007f6690229145 in IA__g_strfreev (str_array=0x2318430) at
 gstrfuncs.c:2558
 No locals.
 #6  0x00007f6692d4e2e6 in gst_plugin_ext_dep_free (dep=0x2318400) at
 gstplugin.c:1407
 No locals.
 #7  0x00007f669020658d in IA__g_list_foreach (list=<value optimized out>,
 func=0x7f6692d4e2d0 <gst_plugin_ext_dep_free>, user_data=0x0) at
 glist.c:789
         next = (GList *) 0x0
 #8  0x00007f6692d4ffa1 in gst_plugin_finalize (object=0x2314640) at
 gstplugin.c:140
         registry = <value optimized out>
         g = (GList *) 0x0
         __PRETTY_FUNCTION__ = "gst_plugin_finalize"
 #9  0x00007f66908c2798 in IA__g_object_unref (_object=<value optimized
 out>) at gobject.c:2421
         object = (GObject *) 0x2314640
         old_ref = <value optimized out>
         __PRETTY_FUNCTION__ = "IA__g_object_unref"
 #10 0x00007f6692d59e2d in gst_registry_finalize (object=0x209d070) at
 gstregistry.c:200
         plugin = (GstPlugin *) 0x2314640
         registry = (GstRegistry *) 0x209d070
         plugins = (GList *) 0x233d0e0
         p = (GList *) 0x2316e80
         features = <value optimized out>
         f = <value optimized out>
         __PRETTY_FUNCTION__ = "gst_registry_finalize"
 #11 0x00007f66908c2798 in IA__g_object_unref (_object=<value optimized
 out>) at gobject.c:2421
         object = (GObject *) 0x209d070
         old_ref = <value optimized out>
         __PRETTY_FUNCTION__ = "IA__g_object_unref"
 #12 0x00007f6692d13bb4 in gst_deinit () at gst.c:1344
         clock = (GstClock *) 0x232b7e0
         __PRETTY_FUNCTION__ = "gst_deinit"
 #13 0x0000000000497083 in pidgin_sound_uninit () at gtksound.c:350
 No locals.
 #14 0x00007f6690db890b in purple_sound_uninit () at sound.c:143
 No locals.
 #15 0x00007f6690d8de15 in purple_core_quit () at core.c:235
         ops = <value optimized out>
         core = <value optimized out>
         __PRETTY_FUNCTION__ = "purple_core_quit"
 #16 0x00007f66908c07ad in IA__g_closure_invoke (closure=0x2cae420,
 return_value=0x0, n_param_values=1, param_values=0x2395aa0,
 invocation_hint=0x7fff9b1d2180) at gclosure.c:767
         marshal = (GClosureMarshal) 0x42adb0
 <g_cclosure_marshal_VOID__VOID at plt>
         marshal_data = (gpointer) 0x0
         __PRETTY_FUNCTION__ = "IA__g_closure_invoke"
 #17 0x00007f66908d6328 in signal_emit_unlocked_R (node=0x2099730,
 detail=0, instance=0x2cacc10, emission_return=0x0,
 instance_and_params=0x2395aa0) at gsignal.c:3244
         tmp = <value optimized out>
         handler = (Handler *) 0x2be74a0
         accumulator = (SignalAccumulator *) 0x0
         emission = {next = 0x7fff9b1d2640, instance = 0x2cacc10, ihint =
 {signal_id = 91, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state =
 EMISSION_RUN, chain_type = 4}
         class_closure = (GClosure *) 0x2099690
         handler_list = (Handler *) 0x2be74a0
         return_accu = (GValue *) 0x0
         accu = {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0,
 v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0,
 v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64
 = 0, v_uint64 = 0,
       v_float = 0, v_double = 0, v_pointer = 0x0}}}
         signal_id = 91
         max_sequential_handler_number = 1458
         return_value_altered = 1
 #18 0x00007f66908d7992 in IA__g_signal_emit_valist (instance=0x2cacc10,
 signal_id=<value optimized out>, detail=0, var_args=0x7fff9b1d2360) at
 gsignal.c:2977
         signal_return_type = 4
         param_values = (GValue *) 0x2395ab8
         node = (SignalNode *) 0x2099730
         i = 0
         n_params = 0
         __PRETTY_FUNCTION__ = "IA__g_signal_emit_valist"
 #19 0x00007f66908d7eb3 in IA__g_signal_emit (instance=0x1184,
 signal_id=4484, detail=6) at gsignal.c:3034
         var_args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area =
 0x7fff9b1d2440, reg_save_area = 0x7fff9b1d2380}}
 #20 0x00007f6691f0e77b in IA__gtk_widget_activate (widget=0x2cacc10) at
 gtkwidget.c:4792
         __PRETTY_FUNCTION__ = "IA__gtk_widget_activate"
 #21 0x00007f6691e0e91d in IA__gtk_menu_shell_activate_item
 (menu_shell=0x2430a30, menu_item=0x2cacc10, force_deactivate=<value
 optimized out>) at gtkmenushell.c:1139
         slist = <value optimized out>
         shells = (GSList *) 0x24b3180
         __PRETTY_FUNCTION__ = "IA__gtk_menu_shell_activate_item"
 #22 0x00007f6691e10395 in gtk_menu_shell_button_release (widget=0x2430a30,
 event=0x2ca4d20) at gtkmenushell.c:678
         submenu = (GtkWidget *) 0x0
         menu_item = (GtkWidget *) 0x2cacc10
         deactivate = <value optimized out>
 #23 0x00007f6691e008e8 in _gtk_marshal_BOOLEAN__BOXED (closure=0x207d360,
 return_value=0x7fff9b1d2690, n_param_values=<value optimized out>,
 param_values=0x2cbac70, invocation_hint=<value optimized out>,
 marshal_data=0x7f6691e06860)
     at gtkmarshalers.c:84
         data1 = (gpointer) 0x2430a30
         data2 = (gpointer) 0x6
         v_return = <value optimized out>
         __PRETTY_FUNCTION__ = "_gtk_marshal_BOOLEAN__BOXED"
 #24 0x00007f66908c07ad in IA__g_closure_invoke (closure=0x207d360,
 return_value=0x7fff9b1d2690, n_param_values=2, param_values=0x2cbac70,
 invocation_hint=0x7fff9b1d2650) at gclosure.c:767
         marshal = (GClosureMarshal) 0x7f66908becc0
 <g_type_class_meta_marshal>
         marshal_data = (gpointer) 0x160
         __PRETTY_FUNCTION__ = "IA__g_closure_invoke"
 #25 0x00007f66908d5fee in signal_emit_unlocked_R (node=0x207d3d0,
 detail=0, instance=0x2430a30, emission_return=0x7fff9b1d27d0,
 instance_and_params=0x2cbac70) at gsignal.c:3282
         accumulator = (SignalAccumulator *) 0x207d240
         emission = {next = 0x0, instance = 0x2430a30, ihint = {signal_id =
 31, detail = 0, run_type = G_SIGNAL_RUN_LAST}, state = EMISSION_RUN,
 chain_type = 34185328}
         class_closure = (GClosure *) 0x207d360
         handler_list = (Handler *) 0x0
         return_accu = (GValue *) 0x7fff9b1d2690
         accu = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0,
 v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0,
 v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64
 = 0, v_uint64 = 0,
       v_float = 0, v_double = 0, v_pointer = 0x0}}}
         signal_id = 31
         max_sequential_handler_number = 1458
         return_value_altered = 0
 #26 0x00007f66908d781d in IA__g_signal_emit_valist (instance=0x2430a30,
 signal_id=<value optimized out>, detail=0, var_args=0x7fff9b1d2830) at
 gsignal.c:2987
         return_value = {g_type = 20, data = {{v_int = 0, v_uint = 0,
 v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double
 = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0,
 v_int64 = 0,
       v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
         error = <value optimized out>
         signal_return_type = 20
         param_values = (GValue *) 0x2cbac88
         node = (SignalNode *) 0x207d3d0
         i = 1
         n_params = 1
         __PRETTY_FUNCTION__ = "IA__g_signal_emit_valist"
 #27 0x00007f66908d7eb3 in IA__g_signal_emit (instance=0x1184,
 signal_id=4484, detail=6) at gsignal.c:3034
         var_args = {{gp_offset = 32, fp_offset = 48, overflow_arg_area =
 0x7fff9b1d2910, reg_save_area = 0x7fff9b1d2850}}
 #28 0x00007f6691f08dfe in gtk_widget_event_internal (widget=0x2430a30,
 event=0x2ca4d20) at gtkwidget.c:4761
         signal_num = <value optimized out>
         return_val = 0
 #29 0x00007f6691df9183 in IA__gtk_propagate_event (widget=0x2430a30,
 event=0x2ca4d20) at gtkmain.c:2396
         tmp = (GtkWidget *) 0x2430a30
         handled_event = 0
         __PRETTY_FUNCTION__ = "IA__gtk_propagate_event"
 #30 0x00007f6691dfa2b3 in IA__gtk_main_do_event (event=0x2ca4d20) at
 gtkmain.c:1601
         event_widget = (GtkWidget *) 0x2cacc10
         grab_widget = (GtkWidget *) 0x2cacc10
         window_group = (GtkWindowGroup *) 0x23462a0
         rewritten_event = (GdkEvent *) 0x0
         tmp_list = <value optimized out>
         __PRETTY_FUNCTION__ = "IA__gtk_main_do_event"
 #31 0x00007f6691a7ca9c in gdk_event_dispatch (source=<value optimized
 out>, callback=<value optimized out>, user_data=<value optimized out>) at
 gdkevents-x11.c:2364
         display = <value optimized out>
         event = <value optimized out>
 #32 0x00007f6690208d61 in IA__g_main_context_dispatch (context=0x2079e80)
 at gmain.c:1814
 No locals.
 #33 0x00007f669020c410 in g_main_context_iterate (context=0x2079e80,
 block=1, dispatch=1, self=<value optimized out>) at gmain.c:2448
         max_priority = 2147483647
         timeout = 2110
         some_ready = 1
         nfds = 5
         allocated_nfds = <value optimized out>
         fds = (GPollFD *) 0x265b600
         __PRETTY_FUNCTION__ = "g_main_context_iterate"
 #34 0x00007f669020c8dd in IA__g_main_loop_run (loop=0x2c92a10) at
 gmain.c:2656
         self = (GThread *) 0x203b010
         __PRETTY_FUNCTION__ = "IA__g_main_loop_run"
 #35 0x00007f6691dfa6b7 in IA__gtk_main () at gtkmain.c:1205
         tmp_list = (GList *) 0x0
         functions = (GList *) 0x0
         init = (GtkInitFunction *) 0x205fe20
         loop = <value optimized out>
 #36 0x0000000000479543 in main (argc=1, argv=0x7fff9b1d4f68) at
 gtkmain.c:881
         opt_help = <value optimized out>
         opt_login = 0
         opt_nologin = 0
         opt_version = <value optimized out>
         opt_si = 1
         opt_config_dir_arg = 0x0
         opt_login_arg = 0x0
         opt_session_arg = 0x0
         accounts = <value optimized out>
         sigset = {__val = {82951, 0 <repeats 15 times>}}
         prev_sig_disp = (void (*)(int)) 0
         errmsg =
 "�L\035\233�\177\000\000\000\000\000\000\000\000\000\000�`\032\223f\177\000\000\"]�\222f\177\000\000\000�\032\223f\177\000\000\000�\032\223f\177\000\000��\032\223f\177\000\000\000\000\000\000\000\000\000\000`k�\217f\177\000\000\000\000\000\000\000\000\000\000��\032\223f\177\000\000\000\000`\\:6��\000\000\226��%��\"\000\000\000#\000\000\000&\000\000\000(\000\000\000)\000\000\000\000\000\000\000*\000\000\000,\000\000\000�L\035\233�\177\000\0000M\035\233�\177\000\000\030\000\000\000\000\000\000\000��\034\220f\177\000\000\000\000\000\000\000\000\000\000��\032\223f\177\000\000�T�\222f\177\000\000\000\000\000\000\000\000\000\000"...
         error = (GError *) 0x0
         opt = <value optimized out>
         gui_check = <value optimized out>
         debug_enabled = <value optimized out>
         migration_failed = <value optimized out>
         active_accounts = <value optimized out>
         long_options = {{name = 0x4bd122 "config", has_arg = 1, flag =
 0x0, val = 99}, {name = 0x4aa4b6 "debug", has_arg = 0, flag = 0x0, val =
 100}, {name = 0x4ae352 "help", has_arg = 0, flag = 0x0, val = 104}, {
     name = 0x4aa781 "login", has_arg = 2, flag = 0x0, val = 108}, {name =
 0x4b908a "multiple", has_arg = 0, flag = 0x0, val = 109}, {name = 0x4b9093
 "nologin", has_arg = 0, flag = 0x0, val = 110}, {name = 0x4b909b
 "nocrash",
     has_arg = 0, flag = 0x0, val = 120}, {name = 0x4bd118 "session",
 has_arg = 1, flag = 0x0, val = 115}, {name = 0x4b0172 "version", has_arg =
 0, flag = 0x0, val = 118}, {name = 0x4bd12b "display", has_arg = 1, flag =
 0x0, val = 68}, {
     name = 0x4b90a3 "sync", has_arg = 0, flag = 0x0, val = 83}, {name =
 0x0, has_arg = 0, flag = 0x0, val = 0}}
 }}}


 Looks to me like an invalid free in the GStreamer code.

-- 
Ticket URL: <http://developer.pidgin.im/ticket/8766>
Pidgin <http://pidgin.im>
Pidgin


More information about the Tracker mailing list