Bug 471410

Summary: segfault in dbus code
Product: [Fedora] Fedora Reporter: Kirill Kolyshkin <kolyshkin>
Component: pidginAssignee: Warren Togami <wtogami>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 9CC: stu, wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-03-24 15:12:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
proposed fix none

Description Kirill Kolyshkin 2008-11-13 15:20:33 UTC 
Description of problem:
Pidgin segfaults.

Version-Release number of selected component (if applicable):
$ rpm -q pidgin libpurple dbus
pidgin-2.5.2-1.fc9.x86_64
libpurple-2.5.2-1.fc9.x86_64
dbus-1.2.4-1.fc9.x86_64

Additional info:
$ gdb pidgin
GNU gdb Fedora (6.8-23.fc9)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
(gdb) r
Starting program: /usr/bin/pidgin 
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffd6683a740 (LWP 6267)]
Detaching after fork from child process 6271.
Detaching after fork from child process 6272.
Detaching after fork from child process 6273.
Detaching after fork from child process 6274.
Detaching after fork from child process 6275.
[New Thread 0x412ea950 (LWP 6277)]
[New Thread 0x41ceb950 (LWP 6278)]
[New Thread 0x426ec950 (LWP 6279)]
[New Thread 0x430ed950 (LWP 6280)]
[Thread 0x430ed950 (LWP 6280) exited]
[Thread 0x426ec950 (LWP 6279) exited]
[Thread 0x41ceb950 (LWP 6278) exited]
[Thread 0x412ea950 (LWP 6277) exited]
[New Thread 0x412ea950 (LWP 6335)]

Program received signal SIGSEGV, Segmentation fault.
_dbus_watch_invalidate (watch=0x0) at dbus-watch.c:147
147	  watch->fd = -1;
Missing separate debuginfos, use: debuginfo-install gtk-nodoka-engine.x86_64 postgresql.x86_64 xmms.x86_64
(gdb) bt full
#0  _dbus_watch_invalidate (watch=0x0) at dbus-watch.c:147
No locals.
#1  0x0000003908023a50 in free_watches (transport=<value optimized out>)
    at dbus-transport-socket.c:82
No locals.
#2  0x0000003908023ab9 in socket_disconnect (transport=<value optimized out>)
    at dbus-transport-socket.c:908
No locals.
#3  0x0000003908021957 in _dbus_transport_disconnect (
    transport=<value optimized out>) at dbus-transport.c:494
No locals.
#4  0x00000039080223c2 in _dbus_transport_queue_messages (
    transport=<value optimized out>) at dbus-transport.c:1137
	status = <value optimized out>
#5  0x000000390800eb06 in _dbus_connection_get_dispatch_status_unlocked (
    connection=<value optimized out>) at dbus-connection.c:3983
No locals.
#6  0x000000390800f19e in dbus_connection_get_dispatch_status (
    connection=<value optimized out>) at dbus-connection.c:4114
	status = <value optimized out>
	__FUNCTION__ = "dbus_connection_get_dispatch_status"
#7  0x00000038ed409743 in message_queue_prepare (source=<value optimized out>, 
    timeout=<value optimized out>) at dbus-gmain.c:82
---Type <return> to continue, or q <return> to quit---
	connection = <value optimized out>
#8  0x00000038e583a4ea in IA__g_main_context_prepare (
    context=<value optimized out>, priority=<value optimized out>)
    at gmain.c:2332
	result = <value optimized out>
	prepare = <value optimized out>
	source_timeout = <value optimized out>
	i = <value optimized out>
	n_ready = <value optimized out>
	current_priority = <value optimized out>
	source = <value optimized out>
#9  0x00000038e583a90a in g_main_context_iterate (
    context=<value optimized out>, block=<value optimized out>, 
    dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2625
	max_priority = <value optimized out>
	timeout = <value optimized out>
	some_ready = <value optimized out>
	nfds = <value optimized out>
	allocated_nfds = <value optimized out>
	fds = <value optimized out>
	__PRETTY_FUNCTION__ = "g_main_context_iterate"
#10 0x00000038e583b13d in IA__g_main_loop_run (loop=<value optimized out>)
    at gmain.c:2853
---Type <return> to continue, or q <return> to quit---
	self = <value optimized out>
	__PRETTY_FUNCTION__ = "IA__g_main_loop_run"
#11 0x00000038ead83db0 in IA__gtk_main () at gtkmain.c:1163
	tmp_list = Could not find the frame base for "IA__gtk_main".
	functions = Could not find the frame base for "IA__gtk_main".
	init = Could not find the frame base for "IA__gtk_main".
	loop = Could not find the frame base for "IA__gtk_main".
#12 0x000000000048424b in main (argc=1, argv=0x7fff6eb87ee8) at gtkmain.c:888
	opt_help = <value optimized out>
	opt_login = 0
	opt_nologin = 0
	opt_version = <value optimized out>
	opt_si = 1
	opt_config_dir_arg = 0x0
	opt_login_arg = 0x0
	opt_session_arg = 0x0
	search_path = <value optimized out>
	accounts = <value optimized out>
	sigset = {__val = {82951, 0 <repeats 15 times>}}
	prev_sig_disp = (void (*)(int)) 0x1
	errmsg = "(\224��8\000\000\000\n\000\000\000\000\000\000\000\000��f�\177\000\000\215�\000�3", '\0' <repeats 27 times>, "\026�\000�3\000\000\000@|�n�\177\000\000P�\000�3\000\000\000\177|�n�\177\000\000\000\000\000\000\000\000\000\000---Type <return> to continue, or q <return> to quit---
\210�\203f�\177\000\000��\000�3\000\000\000\000��f�\177\000\000���f�\177\000\000\230��f�\177\000\000\000еf�\177\000\000\000P\204f�\177\000\000pi\204f�\177\000\000\000\000\000\000\000\000\000\000\n\000\000\000\000\000\000\000\000��f�\177\000\000\000\000\000�p���\000\000��\001jg\000\000\000\000\000\000\000\000\000\b\224��8\000\000\000\b"...
	segfault_message_tmp = <value optimized out>
	error = (GError *) 0x0
	opt = <value optimized out>
	gui_check = <value optimized out>
	debug_enabled = <value optimized out>
	migration_failed = <value optimized out>
	active_accounts = <value optimized out>
	long_options = {{name = 0x4cea82 "config", has_arg = 1, flag = 0x0, 
    val = 99}, {name = 0x4bbeb6 "debug", has_arg = 0, flag = 0x0, val = 100}, {
    name = 0x4bfdb1 "help", has_arg = 0, flag = 0x0, val = 104}, {
    name = 0x4bc16e "login", has_arg = 2, flag = 0x0, val = 108}, {
    name = 0x4ca9d0 "multiple", has_arg = 0, flag = 0x0, val = 109}, {
    name = 0x4ca9d9 "nologin", has_arg = 0, flag = 0x0, val = 110}, {
    name = 0x4ca9e1 "nocrash", has_arg = 0, flag = 0x0, val = 120}, {
    name = 0x4cea78 "session", has_arg = 1, flag = 0x0, val = 115}, {
    name = 0x4c1baa "version", has_arg = 0, flag = 0x0, val = 118}, {
    name = 0x4cea8b "display", has_arg = 1, flag = 0x0, val = 68}, {
    name = 0x4ca9e9 "sync", has_arg = 0, flag = 0x0, val = 83}, {name = 0x0, 
---Type <return> to continue, or q <return> to quit---
    has_arg = 0, flag = 0x0, val = 0}}
(gdb)
Comment 1 Kirill Kolyshkin 2008-11-13 15:32:21 UTC 
Seems like dbus-related, I found a similar report (watch is NULL in _dbus_watch_invalidate()), see the _last_ backtrace in http://article.gmane.org/gmane.comp.freedesktop.dbus/9167 message.


Some more info about components/versions:

$ rpm -q dbus dbus-glib dbus-python
dbus-1.2.4-1.fc9.x86_64
dbus-glib-0.74-8.fc9.x86_64
dbus-python-0.83.0-2.fc9.x86_64
Comment 2 Kirill Kolyshkin 2008-11-13 15:34:46 UTC 
In the same mail thread which I mentioned in comment #1 (http://thread.gmane.org/gmane.comp.freedesktop.dbus/9167), Simon McVittie gives a solution:

> You need to tell dbus-glib to initialize libdbus' thread locks, which
> you can do via:
> 
> from dbus.mainloop.glib import threads_init
> threads_init()
> 
> Otherwise, libdbus will have no thread locking, and will concurrently
> modify data in multiple threads. Don't let it do that.

Perhaps pidgin doesn't do it?
Comment 3 Kirill Kolyshkin 2008-11-13 15:57:26 UTC 
Created attachment 323466 [details]
proposed fix

I _guess_ that the following patch fixes this problem. I am testing that right now, but since this is race which happens randomly it can take quite a lot of time.
Comment 4 Kirill Kolyshkin 2008-11-13 16:28:45 UTC 
The only missing piece here is an upstream bug reference.
So here it is: http://developer.pidgin.im/ticket/7538

Now this is what is called The Ideal Bug Report(TM). Vote for me! :)
Comment 5 Kirill Kolyshkin 2008-11-14 13:24:48 UTC 
Tested for a few hours, works good -- no crashes.
Comment 6 Warren Togami 2009-03-24 15:12:50 UTC 
Fixed in pidgin-2.5.4