Attachment 1452069 Details for Bug 1591972 – File: backtrace

File: backtrace

backtrace (text/plain), 16.46 KB, created by mastaiza on 2018-06-15 22:11:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: mastaiza

Created: 2018-06-15 22:11:54 UTC

Size: 16.46 KB

patch

obsolete

>[New LWP 7282]
>[New LWP 7279]
>[New LWP 7280]
>[New LWP 7278]
>[Thread debugging using libthread_db enabled]
>Using host libthread_db library "/lib64/libthread_db.so.1".
>Core was generated by `/usr/libexec/at-spi-bus-launcher'.
>Program terminated with signal SIGABRT, Aborted.
>#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
>50	  return ret;
>[Current thread is 1 (Thread 0x7f26d0842700 (LWP 7282))]
>
>Thread 1 (Thread 0x7f26d0842700 (LWP 7282)):
>#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
>        set = {__val = {0, 94003803375464, 139804760290048, 139804757942131, 0, 31, 139804339618112, 139804755053101, 8, 16, 0, 16, 0, 31, 16, 139804755052348}}
>        pid = <optimized out>
>        tid = <optimized out>
>        ret = <optimized out>
>#1  0x00007f26d44eb561 in __GI_abort () at abort.c:79
>        save_stage = 1
>        act = {__sigaction_handler = {sa_handler = 0x557ef74eec00, sa_sigaction = 0x557ef74eec00}, sa_mask = {__val = {139804339612480, 139804339618320, 139804757919403, 139804683803152, 140736525937612, 139804683803200, 4294967308, 1, 0, 1, 94003803457136, 139804683803200, 139804748356582, 0, 139804683803232, 139804683803488}}, sa_flags = 4096, sa_restorer = 0x7f26d0841a60}
>        sigs = {__val = {32, 0 <repeats 15 times>}}
>#2  0x00007f26d4543927 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f26d464d579 "%s\n") at ../sysdeps/posix/libc_fatal.c:181
>        ap = {{gp_offset = 24, fp_offset = 21886, overflow_arg_area = 0x7f26d0841b70, reg_save_area = 0x7f26d0841b00}}
>        fd = <optimized out>
>        list = <optimized out>
>        nlist = <optimized out>
>        cp = <optimized out>
>        written = <optimized out>
>#3  0x00007f26d4549e0c in malloc_printerr (str=str@entry=0x7f26d464f1c0 "free(): invalid next size (fast)") at malloc.c:5350
>No locals.
>#4  0x00007f26d454b646 in _int_free (av=0x7f26d4883c40 <main_arena>, p=0x557ef74d7db0, have_lock=<optimized out>) at malloc.c:4213
>        fail = <optimized out>
>        idx = <optimized out>
>        old = <optimized out>
>        old2 = <optimized out>
>        size = 48
>        fb = <optimized out>
>        nextchunk = <optimized out>
>        nextsize = <optimized out>
>        nextinuse = <optimized out>
>        prevsize = <optimized out>
>        bck = <optimized out>
>        fwd = <optimized out>
>        __PRETTY_FUNCTION__ = "_int_free"
>#5  0x00007f26d4c1c4d2 in g_free (mem=0x557ef74d7dc0) at gmem.c:194
>No locals.
>#6  0x00007f26d5207807 in message_to_write_data_free (data=0x557ef750c190) at gdbusprivate.c:896
>No locals.
>#7  0x00007f26d52093d7 in write_message_cb (source_object=<optimized out>, res=<optimized out>, user_data=0x557ef750c190) at gdbusprivate.c:1342
>        data = 0x557ef750c190
>        error = 0x0
>        __func__ = "write_message_cb"
>#8  0x00007f26d51c3d54 in g_task_return_now (task=0x7f26bc004140) at gtask.c:1148
>No locals.
>#9  0x00007f26d51c3d8d in complete_in_idle_cb (task=task@entry=0x7f26bc004140) at gtask.c:1162
>No locals.
>#10 0x00007f26d4c131cb in g_idle_dispatch (source=0x7f26bc00a070, callback=0x7f26d51c3d80 <complete_in_idle_cb>, user_data=0x7f26bc004140) at gmain.c:5535
>        again = <optimized out>
>#11 0x00007f26d4c168ad in g_main_dispatch (context=0x7f26c4009fb0) at gmain.c:3177
>        dispatch = 0x7f26d4c131b0 <g_idle_dispatch>
>        prev_source = 0x0
>        was_in_call = 0
>        user_data = 0x7f26bc004140
>        callback = 0x7f26d51c3d80 <complete_in_idle_cb>
>        cb_funcs = 0x7f26d4ee0280 <g_source_callback_funcs>
>        cb_data = 0x557ef750cd20
>        need_destroy = <optimized out>
>        source = 0x7f26bc00a070
>        current = 0x7f26c40028a0
>        i = 0
>        current = <optimized out>
>        i = <optimized out>
>        __func__ = "g_main_dispatch"
>        source = <optimized out>
>        _g_boolean_var_ = <optimized out>
>        was_in_call = <optimized out>
>        user_data = <optimized out>
>        callback = <optimized out>
>        cb_funcs = <optimized out>
>        cb_data = <optimized out>
>        need_destroy = <optimized out>
>        dispatch = <optimized out>
>        prev_source = <optimized out>
>        _g_boolean_var_ = <optimized out>
>#12 g_main_context_dispatch (context=context@entry=0x7f26c4009fb0) at gmain.c:3830
>No locals.
>#13 0x00007f26d4c16c78 in g_main_context_iterate (context=0x7f26c4009fb0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3903
>        max_priority = 0
>        timeout = 0
>        some_ready = 1
>        nfds = <optimized out>
>        allocated_nfds = 3
>        fds = 0x7f26c400bc70
>#14 0x00007f26d4c16fa2 in g_main_loop_run (loop=0x7f26c400a0f0) at gmain.c:4099
>        self = <optimized out>
>        __func__ = "g_main_loop_run"
>#15 0x00007f26d52076ba in gdbus_shared_thread_func (user_data=0x7f26c4009f80) at gdbusprivate.c:275
>        data = 0x7f26c4009f80
>#16 0x00007f26d4c3ef2a in g_thread_proxy (data=0x557ef74eead0) at gthread.c:784
>        thread = 0x557ef74eead0
>        __func__ = "g_thread_proxy"
>#17 0x00007f26d3a30594 in start_thread (arg=<optimized out>) at pthread_create.c:463
>        pd = <optimized out>
>        now = <optimized out>
>        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139804683806464, 4796691408823780593, 139804700588510, 139804700588511, 139804700588640, 139804700588640, -4837740781091683087, -4837743228970466063}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
>        not_first_call = <optimized out>
>#18 0x00007f26d45c400f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
>No locals.
>
>Thread 2 (Thread 0x7f26d2252700 (LWP 7279)):
>#0  0x00007f26d45b9589 in __GI___poll (fds=0x557ef74eedd0, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
>        resultvar = 18446744073709551100
>        sc_cancel_oldtype = 0
>        sc_ret = <optimized out>
>#1  0x00007f26d4c16be6 in g_main_context_poll (priority=<optimized out>, n_fds=1, fds=0x557ef74eedd0, timeout=<optimized out>, context=0x557ef74edad0) at gmain.c:4204
>        ret = <optimized out>
>        errsv = <optimized out>
>        poll_func = 0x7f26d4c26520 <g_poll>
>        poll_func = <optimized out>
>        ret = <optimized out>
>        errsv = <optimized out>
>#2  g_main_context_iterate (context=context@entry=0x557ef74edad0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3898
>        max_priority = 2147483647
>        timeout = -1
>        some_ready = <optimized out>
>        nfds = 1
>        allocated_nfds = 1
>        fds = 0x557ef74eedd0
>#3  0x00007f26d4c16d10 in g_main_context_iteration (context=0x557ef74edad0, may_block=may_block@entry=1) at gmain.c:3964
>        retval = <optimized out>
>#4  0x00007f26d4c16d61 in glib_worker_main (data=<optimized out>) at gmain.c:5773
>No locals.
>#5  0x00007f26d4c3ef2a in g_thread_proxy (data=0x557ef74ee000) at gthread.c:784
>        thread = 0x557ef74ee000
>        __func__ = "g_thread_proxy"
>#6  0x00007f26d3a30594 in start_thread (arg=<optimized out>) at pthread_create.c:463
>        pd = <optimized out>
>        now = <optimized out>
>        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139804711134976, 4796691408823780593, 140736525782686, 140736525782687, 140736525782816, 140736525782816, -4837744345914538767, -4837743228970466063}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
>        not_first_call = <optimized out>
>#7  0x00007f26d45c400f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
>No locals.
>
>Thread 3 (Thread 0x7f26d1844700 (LWP 7280)):
>#0  0x00007f26d45b9589 in __GI___poll (fds=0x557ef74e15e0, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
>        resultvar = 18446744073709551100
>        sc_cancel_oldtype = 0
>        sc_ret = <optimized out>
>#1  0x00007f26d4c16be6 in g_main_context_poll (priority=<optimized out>, n_fds=1, fds=0x557ef74e15e0, timeout=<optimized out>, context=0x557ef74e16c0) at gmain.c:4204
>        ret = <optimized out>
>        errsv = <optimized out>
>        poll_func = 0x7f26d4c26520 <g_poll>
>        poll_func = <optimized out>
>        ret = <optimized out>
>        errsv = <optimized out>
>#2  g_main_context_iterate (context=context@entry=0x557ef74e16c0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3898
>        max_priority = 2147483647
>        timeout = -1
>        some_ready = <optimized out>
>        nfds = 1
>        allocated_nfds = 1
>        fds = 0x557ef74e15e0
>#3  0x00007f26d4c16d10 in g_main_context_iteration (context=context@entry=0x557ef74e16c0, may_block=may_block@entry=1) at gmain.c:3964
>        retval = <optimized out>
>#4  0x00007f26d184ce4d in dconf_gdbus_worker_thread (user_data=0x557ef74e16c0) at ../gdbus/dconf-gdbus-thread.c:82
>        context = 0x557ef74e16c0
>#5  0x00007f26d4c3ef2a in g_thread_proxy (data=0x557ef74ee320) at gthread.c:784
>        thread = 0x557ef74ee320
>        __func__ = "g_thread_proxy"
>#6  0x00007f26d3a30594 in start_thread (arg=<optimized out>) at pthread_create.c:463
>        pd = <optimized out>
>        now = <optimized out>
>        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139804700591872, 4796691408823780593, 140736525782174, 140736525782175, 140736525782304, 140736525782304, -4837738580994685711, -4837743228970466063}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
>        not_first_call = <optimized out>
>#7  0x00007f26d45c400f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
>No locals.
>
>Thread 4 (Thread 0x7f26d56c3880 (LWP 7278)):
>#0  0x00007f26d45b9589 in __GI___poll (fds=0x557ef74e7180, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
>        resultvar = 18446744073709551100
>        sc_cancel_oldtype = 0
>        sc_ret = <optimized out>
>#1  0x00007f26d4c16be6 in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x557ef74e7180, timeout=<optimized out>, context=0x557ef74fc430) at gmain.c:4204
>        ret = <optimized out>
>        errsv = <optimized out>
>        poll_func = 0x7f26d4c26520 <g_poll>
>        poll_func = <optimized out>
>        ret = <optimized out>
>        errsv = <optimized out>
>#2  g_main_context_iterate (context=0x557ef74fc430, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3898
>        max_priority = 2147483647
>        timeout = -1
>        some_ready = <optimized out>
>        nfds = 2
>        allocated_nfds = 2
>        fds = 0x557ef74e7180
>#3  0x00007f26d4c16fa2 in g_main_loop_run (loop=0x557ef74f58a0) at gmain.c:4099
>        self = <optimized out>
>        __func__ = "g_main_loop_run"
>#4  0x0000557ef68d2298 in main (argc=<optimized out>, argv=0x7fffc6a053a8) at ../bus/at-spi-bus-launcher.c:795
>        loop = <optimized out>
>        session_bus = <optimized out>
>        name_owner_id = <optimized out>
>        a11y_set = <optimized out>
>        screen_reader_set = <optimized out>
>        i = <optimized out>
>        __func__ = "main"
>From                To                  Syms Read   Shared Object Library
>0x00007f26d516c4b0  0x00007f26d52540d2  Yes         /lib64/libgio-2.0.so.0
>0x00007f26d4eec7a0  0x00007f26d4f1d660  Yes         /lib64/libgobject-2.0.so.0
>0x00007f26d4be50d0  0x00007f26d4c6034e  Yes         /lib64/libglib-2.0.so.0
>0x00007f26d48a6f50  0x00007f26d492f9a6  Yes         /lib64/libX11.so.6
>0x00007f26d44eb340  0x00007f26d463225f  Yes         /lib64/libc.so.6
>0x00007f26d42c2810  0x00007f26d42c729a  Yes         /lib64/libffi.so.6
>0x00007f26d40be140  0x00007f26d40bf066  Yes         /lib64/libgmodule-2.0.so.0
>0x00007f26d3eb9ee0  0x00007f26d3ebabbe  Yes         /lib64/libdl.so.2
>0x00007f26d3c49660  0x00007f26d3c99b86  Yes         /lib64/libpcre.so.1
>0x00007f26d3a2ebe0  0x00007f26d3a3c801  Yes         /lib64/libpthread.so.0
>0x00007f26d3814420  0x00007f26d38215f7  Yes         /lib64/libz.so.1
>0x00007f26d35efdf0  0x00007f26d360793f  Yes         /lib64/libselinux.so.1
>0x00007f26d33d5840  0x00007f26d33e160e  Yes         /lib64/libresolv.so.2
>0x00007f26d3184ee0  0x00007f26d31bc25e  No          /lib64/libmount.so.1
>0x00007f26d2f62ad0  0x00007f26d2f73705  No          /lib64/libgcc_s.so.1
>0x00007f26d2d42a40  0x00007f26d2d55699  Yes         /lib64/libxcb.so.1
>0x00007f26d54d8f60  0x00007f26d54f5910  Yes         /lib64/ld-linux-x86-64.so.2
>0x00007f26d2ab9160  0x00007f26d2b13cb3  Yes         /lib64/libpcre2-8.so.0
>0x00007f26d28706f0  0x00007f26d28a127e  No          /lib64/libblkid.so.1
>0x00007f26d2660740  0x00007f26d2664171  No          /lib64/libuuid.so.1
>0x00007f26d2459210  0x00007f26d245c47c  Yes         /lib64/librt.so.1
>0x00007f26d2253e70  0x00007f26d2254b5e  Yes         /lib64/libXau.so.6
>0x00007f26d1848ce0  0x00007f26d184de12  Yes         /usr/lib64/gio/modules/libdconfsettings.so
>$1 = 0x7f26d56b4000 ""
>$2 = 0x0
>rax            0x0	0
>rbx            0x6	6
>rcx            0x7f26d4500f2b	139804747501355
>rdx            0x0	0
>rsi            0x7f26d0841810	139804683802640
>rdi            0x2	2
>rbp            0x7f26d0841b60	0x7f26d0841b60
>rsp            0x7f26d0841810	0x7f26d0841810
>r8             0x0	0
>r9             0x7f26d0841810	139804683802640
>r10            0x8	8
>r11            0x246	582
>r12            0x1000	4096
>r13            0x7f26d0841a80	139804683803264
>r14            0x10	16
>r15            0x7f26d56b4000	139804766060544
>rip            0x7f26d4500f2b	0x7f26d4500f2b <__GI_raise+267>
>eflags         0x246	[ PF ZF IF ]
>cs             0x33	51
>ss             0x2b	43
>ds             0x0	0
>es             0x0	0
>fs             0x0	0
>gs             0x0	0
>Dump of assembler code for function __GI_raise:
>   0x00007f26d4500e20 <+0>:	push   %rbx
>   0x00007f26d4500e21 <+1>:	mov    $0xffffffffffffffff,%r8
>   0x00007f26d4500e28 <+8>:	mov    %edi,%ebx
>   0x00007f26d4500e2a <+10>:	mov    $0x8,%r10d
>   0x00007f26d4500e30 <+16>:	xor    %edi,%edi
>   0x00007f26d4500e32 <+18>:	sub    $0x110,%rsp
>   0x00007f26d4500e39 <+25>:	mov    %fs:0x28,%rax
>   0x00007f26d4500e42 <+34>:	mov    %rax,0x108(%rsp)
>   0x00007f26d4500e4a <+42>:	xor    %eax,%eax
>   0x00007f26d4500e4c <+44>:	mov    %rsp,%r9
>   0x00007f26d4500e4f <+47>:	movabs $0xfffffffe7fffffff,%rax
>   0x00007f26d4500e59 <+57>:	mov    %r8,0x88(%rsp)
>   0x00007f26d4500e61 <+65>:	mov    %rax,0x80(%rsp)
>   0x00007f26d4500e69 <+73>:	mov    %r9,%rdx
>   0x00007f26d4500e6c <+76>:	lea    0x80(%rsp),%rsi
>   0x00007f26d4500e74 <+84>:	mov    $0xe,%eax
>   0x00007f26d4500e79 <+89>:	mov    %r8,0x90(%rsp)
>   0x00007f26d4500e81 <+97>:	mov    %r8,0x98(%rsp)
>   0x00007f26d4500e89 <+105>:	mov    %r8,0xa0(%rsp)
>   0x00007f26d4500e91 <+113>:	mov    %r8,0xa8(%rsp)
>   0x00007f26d4500e99 <+121>:	mov    %r8,0xb0(%rsp)
>   0x00007f26d4500ea1 <+129>:	mov    %r8,0xb8(%rsp)
>   0x00007f26d4500ea9 <+137>:	mov    %r8,0xc0(%rsp)
>   0x00007f26d4500eb1 <+145>:	mov    %r8,0xc8(%rsp)
>   0x00007f26d4500eb9 <+153>:	mov    %r8,0xd0(%rsp)
>   0x00007f26d4500ec1 <+161>:	mov    %r8,0xd8(%rsp)
>   0x00007f26d4500ec9 <+169>:	mov    %r8,0xe0(%rsp)
>   0x00007f26d4500ed1 <+177>:	mov    %r8,0xe8(%rsp)
>   0x00007f26d4500ed9 <+185>:	mov    %r8,0xf0(%rsp)
>   0x00007f26d4500ee1 <+193>:	mov    %r8,0xf8(%rsp)
>   0x00007f26d4500ee9 <+201>:	syscall 
>   0x00007f26d4500eeb <+203>:	mov    $0x27,%ecx
>   0x00007f26d4500ef0 <+208>:	mov    %ecx,%eax
>   0x00007f26d4500ef2 <+210>:	syscall 
>   0x00007f26d4500ef4 <+212>:	mov    %rax,%rdi
>   0x00007f26d4500ef7 <+215>:	mov    $0xba,%eax
>   0x00007f26d4500efc <+220>:	syscall 
>   0x00007f26d4500efe <+222>:	mov    %eax,%esi
>   0x00007f26d4500f00 <+224>:	mov    %ebx,%edx
>   0x00007f26d4500f02 <+226>:	mov    $0xea,%eax
>   0x00007f26d4500f07 <+231>:	syscall 
>   0x00007f26d4500f09 <+233>:	cmp    $0xfffffffffffff000,%rax
>   0x00007f26d4500f0f <+239>:	ja     0x7f26d4500f50 <__GI_raise+304>
>   0x00007f26d4500f11 <+241>:	mov    %eax,%r8d
>   0x00007f26d4500f14 <+244>:	mov    $0x8,%r10d
>   0x00007f26d4500f1a <+250>:	xor    %edx,%edx
>   0x00007f26d4500f1c <+252>:	mov    %r9,%rsi
>   0x00007f26d4500f1f <+255>:	mov    $0x2,%edi
>   0x00007f26d4500f24 <+260>:	mov    $0xe,%eax
>   0x00007f26d4500f29 <+265>:	syscall 
>=> 0x00007f26d4500f2b <+267>:	mov    0x108(%rsp),%rcx
>   0x00007f26d4500f33 <+275>:	xor    %fs:0x28,%rcx
>   0x00007f26d4500f3c <+284>:	mov    %r8d,%eax
>   0x00007f26d4500f3f <+287>:	jne    0x7f26d4500f5e <__GI_raise+318>
>   0x00007f26d4500f41 <+289>:	add    $0x110,%rsp
>   0x00007f26d4500f48 <+296>:	pop    %rbx
>   0x00007f26d4500f49 <+297>:	retq   
>   0x00007f26d4500f4a <+298>:	nopw   0x0(%rax,%rax,1)
>   0x00007f26d4500f50 <+304>:	mov    0x381f49(%rip),%rdx        # 0x7f26d4882ea0
>   0x00007f26d4500f57 <+311>:	neg    %eax
>   0x00007f26d4500f59 <+313>:	mov    %eax,%fs:(%rdx)
>   0x00007f26d4500f5c <+316>:	jmp    0x7f26d4500f14 <__GI_raise+244>
>   0x00007f26d4500f5e <+318>:	callq  0x7f26d45d5480 <__stack_chk_fail>
>End of assembler dump.
>== EXPLOITABLE ==

Actions: View

Attachments on bug 1591972: 1452069 | 1452070 | 1452071 | 1452072 | 1452073 | 1452074 | 1452075 | 1452076 | 1452077 | 1452078 | 1452079