Bug 1145782

Summary: [abrt] gnome-software: gs_shell_back_button_cb(): gnome-software killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Ryan Lerch <rlerch>
Component: gnome-softwareAssignee: Richard Hughes <rhughes>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: 2xj82, fedor.butikov, Hapoofesgeli, james, jfrieben, kalevlember, kdubrick, manawadalla, mclasen, panospolychronis, rhughes, zach
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/40fc0b654abab17473ee78c93f8589bf729d744b
Whiteboard: abrt_hash:8fb2434fd6f917d75fc7f9ed79643e38b33a7110
Fixed In Version: gnome-software-3.14.3-1.fc21 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-09 08:27:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description Ryan Lerch 2014-09-23 18:17:48 UTC 
Description of problem:
Used GNOME software to open a 3rd Party RPM saved on my system. It was taking a while to come up (just the spinner was on the screen), so i kept it open and just installed the RPM with yum.

When i went back to Software the RPM had loaded and was ready to install. I Clicked the "Back" button in the GNOME Software interface, and it crashed.


Version-Release number of selected component:
gnome-software-3.13.92-2.fc21

Additional info:
reporter:       libreport-2.2.3
backtrace_rating: 4
cmdline:        /usr/bin/gnome-software --gapplication-service
crash_function: gs_shell_back_button_cb
executable:     /usr/bin/gnome-software
kernel:         3.16.1-301.fc21.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 gs_shell_back_button_cb at gs-shell.c:271
 #1 _g_closure_invoke_va at gclosure.c:831
 #4 gtk_button_do_release at gtkbutton.c:1892
 #5 gtk_real_button_released at gtkbutton.c:2010
 #10 ffi_call_unix64 at ../src/x86/unix64.S:76
 #11 ffi_call at ../src/x86/ffi64.c:525
 #12 g_cclosure_marshal_generic_va at gclosure.c:1541
 #13 _g_closure_invoke_va at gclosure.c:831
 #16 gtk_gesture_multi_press_end at gtkgesturemultipress.c:273
 #17 g_cclosure_marshal_VOID__BOXEDv at gmarshal.c:1160
Comment 1 Ryan Lerch 2014-09-23 18:17:50 UTC 
Created attachment 940527 [details]
File: backtrace
Comment 2 Ryan Lerch 2014-09-23 18:17:52 UTC 
Created attachment 940528 [details]
File: cgroup
Comment 3 Ryan Lerch 2014-09-23 18:17:53 UTC 
Created attachment 940529 [details]
File: core_backtrace
Comment 4 Ryan Lerch 2014-09-23 18:17:55 UTC 
Created attachment 940530 [details]
File: dso_list
Comment 5 Ryan Lerch 2014-09-23 18:17:56 UTC 
Created attachment 940531 [details]
File: environ
Comment 6 Ryan Lerch 2014-09-23 18:17:57 UTC 
Created attachment 940532 [details]
File: exploitable
Comment 7 Ryan Lerch 2014-09-23 18:17:58 UTC 
Created attachment 940533 [details]
File: limits
Comment 8 Ryan Lerch 2014-09-23 18:18:00 UTC 
Created attachment 940534 [details]
File: maps
Comment 9 Ryan Lerch 2014-09-23 18:18:01 UTC 
Created attachment 940535 [details]
File: open_fds
Comment 10 Ryan Lerch 2014-09-23 18:18:02 UTC 
Created attachment 940536 [details]
File: proc_pid_status
Comment 11 Ryan Lerch 2014-09-23 18:18:03 UTC 
Created attachment 940537 [details]
File: var_log_messages
Comment 12 Matthias Clasen 2014-12-10 20:28:51 UTC 
How did you use gnome-software to open an rpm ?
Comment 13 Ryan Lerch 2014-12-10 20:43:43 UTC 
Downloaded the RPM with Firefox, then chose "open with software installer" option.

Right clicking the RPM in nautilus works too
Comment 14 Matthias Clasen 2014-12-10 20:56:36 UTC 
i haven't been able to reproduce the crash, but I guess I can see how the initial state could be wrong, leading to the back button being visible despite the back_entry_stack being empty.

1) The button is set as visible in the gnome-software.ui file

2) gs_shell_change_mode does:

  widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "button_back"));
  gtk_widget_set_visible (widget, !g_queue_is_empty (priv->back_entry_stack));

and 

3) and the clicked handler for the button assumes the queue is not empty:

  entry = g_queue_pop_head (priv->back_entry_stack);
  gs_shell_change_mode (shell, entry->mode, entry->app, entry->category, FALSE);

So, we may have found a user here (Ryan), who managed to click the back button before gs_shell_change_mode has run.

One fix would be to not make the back button visible initially. Another would be to silently exit from the clicked handler when the queue is empty.
Comment 15 Kalev Lember 2015-01-05 21:01:28 UTC 
I eyeballed the code, trying to find a path where we show the window but don't run gs_shell_change_mode(), but I've failed to find one. My attempts to reproduce the crash have failed as well.

I did catch two other bugs in this area while poking around though, https://git.gnome.org/browse/gnome-software/commit/?id=1a06f3b49e3052ee42fd9c3db04fa8ee636fbb91 and https://git.gnome.org/browse/gnome-software/commit/?id=c09169032a2de46e8d8fc0bd5c6a21e7bfd8ee61 -- might be possible that one of those somehow fixes the crash / stack underflow as well.

> One fix would be to not make the back button visible initially. Another
> would be to silently exit from the clicked handler when the queue is empty.

Other buttons in gnome-software.ui are set up in the same way, initially visible in the ui file and then hidden / shown in gs_shell_change_mode() as needed. If we have a code path that doesn't run gs_shell_change_mode(), we'll probably have other buttons with wrong visiblity as well, not just the back button.

To fix the crash, I think the best way for now would be to return from the clicked handler and log a warning -- hopefully this will help catch the root cause of this in the future.
Comment 16 Kalev Lember 2015-01-05 21:20:56 UTC 
I've pushed https://git.gnome.org/browse/gnome-software/commit/?id=facb84ebc865cb81a8711253f806f5c87c5421f7 to that effect.
Comment 17 Kalev Lember 2015-02-27 14:44:21 UTC 
*** Bug 1174497 has been marked as a duplicate of this bug. ***
Comment 18 Fedora Update System 2015-02-27 14:52:28 UTC 
gnome-software-3.14.3-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/gnome-software-3.14.3-1.fc21
Comment 19 Fedora Update System 2015-02-28 10:24:50 UTC 
Package gnome-software-3.14.3-1.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing gnome-software-3.14.3-1.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-2843/gnome-software-3.14.3-1.fc21
then log in and leave karma (feedback).
Comment 20 Fedora Update System 2015-03-09 08:27:37 UTC 
gnome-software-3.14.3-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.