Bug 519239

Summary: segfault of at-spi-registryd
Product: [Fedora] Fedora Reporter: Tom London <selinux>
Component: at-spiAssignee: Matthias Clasen <mclasen>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: ahecox, bug.on.kev1864, mcepl, mcepl, mclasen, mtasaka, nicolas.mailhot
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-09-27 21:58:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Tom London 2009-08-25 19:46:49 UTC
Description of problem:
Noticed this in /var/log/messages:
Aug 25 09:52:00 tlondon kernel: at-spi-registry[1729]: segfault at 0 ip (null) sp 00007fff5454e788 error 14 in at-spi-registryd[400000+c000]

Ran gdb on core:

Core was generated by `/usr/libexec/at-spi-registryd'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) where
#0  0x0000000000000000 in ?? ()
#1  0x00007f61dadab90d in _SmcProcessMessage (iceConn=0x1b350d0, 
    clientData=<value optimized out>, opcode=<value optimized out>, length=0, 
    swap=0, replyWait=0x0, replyReadyRet=0x7fff5454e848) at sm_process.c:324
#2  0x00007f61dab9c284 in IceProcessMessages (iceConn=0x1b350d0, 
    replyWait=0x0, replyReadyRet=0x0) at process.c:344
#3  0x0000000000408780 in process_ice_messages (channel=<value optimized out>, 
    condition=<value optimized out>, client_data=0x1b350d0)
    at registry-main.c:163
#4  0x00007f61d79a719e in g_main_dispatch (context=<value optimized out>)
    at gmain.c:1960
#5  IA__g_main_context_dispatch (context=<value optimized out>) at gmain.c:2513
#6  0x00007f61d79aab88 in g_main_context_iterate (context=0x1afeca0, 
    block=<value optimized out>, dispatch=<value optimized out>, 
    self=<value optimized out>) at gmain.c:2591
#7  0x00007f61d79aafd5 in IA__g_main_loop_run (loop=0x1b34470) at gmain.c:2799
#8  0x00007f61da73afd6 in bonobo_main () at bonobo-main.c:311
#9  0x0000000000408d32 in main (argc=1, argv=0x7fff5454eb58)
    at registry-main.c:113
(gdb) bt full
#0  0x0000000000000000 in ?? ()
No symbol table info available.
#1  0x00007f61dadab90d in _SmcProcessMessage (iceConn=0x1b350d0, 
    clientData=<value optimized out>, opcode=<value optimized out>, length=0, 
    swap=0, replyWait=0x0, replyReadyRet=0x7fff5454e848) at sm_process.c:324
No locals.
#2  0x00007f61dab9c284 in IceProcessMessages (iceConn=0x1b350d0, 
    replyWait=0x0, replyReadyRet=0x0) at process.c:344
        header = 0x1b35b80
        replyReady = 0
        useThisReplyWait = 0x0
        retStatus = <value optimized out>
#3  0x0000000000408780 in process_ice_messages (channel=<value optimized out>, 
    condition=<value optimized out>, client_data=0x1b350d0)
    at registry-main.c:163
        status = <value optimized out>
#4  0x00007f61d79a719e in g_main_dispatch (context=<value optimized out>)
    at gmain.c:1960
        dispatch = 0x7f61d79dc400 <g_io_unix_dispatch>
        user_data = can't compute CFA for this frame
(gdb) 

["bt full" cuts off at frame #4.....]



Version-Release number of selected component (if applicable):
at-spi-1.27.91-1.fc12.x86_64

How reproducible:
Don't know.....

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Tom London 2009-08-27 13:42:03 UTC
Seem to be getting these regularly:
[root@tlondon tmp]# file core.* | grep at-spi
core.1672: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/libexec/at-spi-registryd'
core.1709: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/libexec/at-spi-registryd'
core.1729: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/libexec/at-spi-registryd'
core.1736: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/libexec/at-spi-registryd'
core.1755: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/libexec/at-spi-registryd'
[root@tlondon tmp]# 

Would attaching a core file be useful?


Core was generated by `/usr/libexec/at-spi-registryd'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007fcf14ada90d in _SmcProcessMessage (iceConn=0x15b20d0, 
    clientData=<value optimized out>, opcode=<value optimized out>, length=0, 
    swap=0, replyWait=0x0, replyReadyRet=0x7fffa1e2a158) at sm_process.c:324
#2  0x00007fcf148cb284 in IceProcessMessages (iceConn=0x15b20d0, 
    replyWait=0x0, replyReadyRet=0x0) at process.c:344
#3  0x0000000000408780 in process_ice_messages (channel=<value optimized out>, 
    condition=<value optimized out>, client_data=0x15b20d0)
    at registry-main.c:163
#4  0x00007fcf116d619e in g_main_dispatch (context=<value optimized out>)
    at gmain.c:1960
#5  IA__g_main_context_dispatch (context=<value optimized out>) at gmain.c:2513
#6  0x00007fcf116d9b88 in g_main_context_iterate (context=0x157bca0, 
    block=<value optimized out>, dispatch=<value optimized out>, 
    self=<value optimized out>) at gmain.c:2591
#7  0x00007fcf116d9fd5 in IA__g_main_loop_run (loop=0x15b1470) at gmain.c:2799
#8  0x00007fcf14469fd6 in bonobo_main () at bonobo-main.c:311
#9  0x0000000000408d32 in main (argc=1, argv=0x7fffa1e2a468)
    at registry-main.c:113
(gdb) bt full
#0  0x0000000000000000 in ?? ()
No symbol table info available.
#1  0x00007fcf14ada90d in _SmcProcessMessage (iceConn=0x15b20d0, 
    clientData=<value optimized out>, opcode=<value optimized out>, length=0, 
    swap=0, replyWait=0x0, replyReadyRet=0x7fffa1e2a158) at sm_process.c:324
No locals.
#2  0x00007fcf148cb284 in IceProcessMessages (iceConn=0x15b20d0, 
    replyWait=0x0, replyReadyRet=0x0) at process.c:344
        header = 0x15b2b80
        replyReady = 0
        useThisReplyWait = 0x0
        retStatus = <value optimized out>
#3  0x0000000000408780 in process_ice_messages (channel=<value optimized out>, 
    condition=<value optimized out>, client_data=0x15b20d0)
    at registry-main.c:163
        status = <value optimized out>
#4  0x00007fcf116d619e in g_main_dispatch (context=<value optimized out>)
    at gmain.c:1960
        dispatch = 0x7fcf1170b400 <g_io_unix_dispatch>
        user_data = can't compute CFA for this frame
(gdb) quit
[root@tlondon tmp]#

Comment 2 Tom London 2009-08-29 18:31:20 UTC
BTW, I notice this in my latest boot:

Aug 29 10:22:18 tlondon kernel: at-spi-registry[1691]: segfault at 0 ip (null) sp 00007fff682ebda8 error 14 in at-spi-registryd[400000+c000]

but "ps algx | grep spi" shows:

[root@tlondon ~]# ps algx | grep spi
0   500  1663  1575  20   0 113048  5428 poll_s S    ?          0:23 /usr/libexec/at-spi-registryd
0     0  2335  1944  20   0  89080   868 pipe_w S+   pts/0      0:00 grep spi
[root@tlondon ~]# 

I seem to have 2 entries for "at-spi" showing in System->Preferences->Startup Applications.

Both say "AT SPI Registry Wrapper".  One points at "/usr/libexec/at-spi-registryd" (the active one); the other (not active/selected) points at "/usr/lib64/gnome-session/helpers/at-spi-registryd-wrapper".

[Could this be a hangover from my "constantly updated rawhide system?]

I'll experiment by selecting "/usr/lib64/gnome-session/helpers/at-spi-registryd-wrapper" and deselecting "/usr/libexec/at-spi-registryd".

Comment 3 Andrew Hecox 2009-09-01 12:45:58 UTC
same here:

Program terminated with signal 11, Segmentation fault.
#0  0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x007772aa in _SmcProcessMessage (iceConn=0x98e2fe0, clientData=0x98e2720, 
    opcode=18, length=0, swap=0, replyWait=0x0, replyReadyRet=0xbff1bb88)
    at sm_process.c:324
#2  0x002d4ccf in IceProcessMessages (iceConn=0x98e2fe0, replyWait=0x0, 
    replyReadyRet=0x0) at process.c:343
#3  0x0804f5b3 in process_ice_messages (channel=0x98e2680, condition=G_IO_IN, 
    client_data=0x98e2fe0) at registry-main.c:163
#4  0x00a526bc in g_io_unix_dispatch (source=0x98e26d8, 
    callback=0x804f590 <process_ice_messages>, user_data=0x98e2fe0)
    at giounix.c:162
#5  0x00a1b0a8 in g_main_dispatch (context=<value optimized out>)
    at gmain.c:1960
#6  IA__g_main_context_dispatch (context=<value optimized out>) at gmain.c:2513
#7  0x00a1e9d8 in g_main_context_iterate (context=0x98b9b00, 
    block=<value optimized out>, dispatch=1, self=0x98b3580) at gmain.c:2591
#8  0x00a1ee4f in IA__g_main_loop_run (loop=0x98e2770) at gmain.c:2799
#9  0x03dd2a04 in bonobo_main () at bonobo-main.c:311
#10 0x0804fb77 in main (argc=1, argv=0xbff1be84) at registry-main.c:113
(gdb) frame
#0  0x00000000 in ?? ()

I have a core file available if it's helpful.

Comment 4 Tom London 2009-09-01 13:48:32 UTC
koji has gdb that fixes CFA issue.

Here is complete "bt full":

Core was generated by `/usr/libexec/at-spi-registryd'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) set pagination off
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007f1c16eba90d in _SmcProcessMessage (iceConn=0x19a50d0, clientData=<value optimized out>, opcode=<value optimized out>, length=0, swap=0, replyWait=0x0, replyReadyRet=0x7fffd7425ea8) at sm_process.c:324
#2  0x00007f1c16cab184 in IceProcessMessages (iceConn=0x19a50d0, replyWait=0x0, replyReadyRet=0x0) at process.c:343
#3  0x0000000000408780 in process_ice_messages (channel=<value optimized out>, condition=<value optimized out>, client_data=0x19a50d0) at registry-main.c:163
#4  0x00007f1c13ab619e in g_main_dispatch (context=<value optimized out>) at gmain.c:1960
#5  IA__g_main_context_dispatch (context=<value optimized out>) at gmain.c:2513
#6  0x00007f1c13ab9b88 in g_main_context_iterate (context=0x196eca0, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591
#7  0x00007f1c13ab9fd5 in IA__g_main_loop_run (loop=0x19a4470) at gmain.c:2799
#8  0x00007f1c16849fd6 in bonobo_main () at bonobo-main.c:311
#9  0x0000000000408d32 in main (argc=1, argv=0x7fffd74261b8) at registry-main.c:113
(gdb) bt full
#0  0x0000000000000000 in ?? ()
No symbol table info available.
#1  0x00007f1c16eba90d in _SmcProcessMessage (iceConn=0x19a50d0, clientData=<value optimized out>, opcode=<value optimized out>, length=0, swap=0, replyWait=0x0, replyReadyRet=0x7fffd7425ea8) at sm_process.c:324
No locals.
#2  0x00007f1c16cab184 in IceProcessMessages (iceConn=0x19a50d0, replyWait=0x0, replyReadyRet=0x0) at process.c:343
        header = 0x19a5b80
        replyReady = 0
        useThisReplyWait = 0x0
        retStatus = <value optimized out>
#3  0x0000000000408780 in process_ice_messages (channel=<value optimized out>, condition=<value optimized out>, client_data=0x19a50d0) at registry-main.c:163
        status = <value optimized out>
#4  0x00007f1c13ab619e in g_main_dispatch (context=<value optimized out>) at gmain.c:1960
        dispatch = 0x7f1c13aeb400 <g_io_unix_dispatch>
        user_data = 0x19a50d0
        callback = 0x408770 <process_ice_messages>
        cb_funcs = 0x7f1c13d61950
        cb_data = 0x19a4420
        current_source_link = {data = 0x19a4490, next = 0x0}
        source = 0x19a4490
        current = 0x1966300
        i = 0
#5  IA__g_main_context_dispatch (context=<value optimized out>) at gmain.c:2513
No locals.
#6  0x00007f1c13ab9b88 in g_main_context_iterate (context=0x196eca0, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591
        max_priority = 2147483647
        timeout = 180
        some_ready = 1
        nfds = 52
        allocated_nfds = 330065344
        fds = <value optimized out>
        __PRETTY_FUNCTION__ = "g_main_context_iterate"
#7  0x00007f1c13ab9fd5 in IA__g_main_loop_run (loop=0x19a4470) at gmain.c:2799
        self = 0x19662c0
        __PRETTY_FUNCTION__ = "IA__g_main_loop_run"
#8  0x00007f1c16849fd6 in bonobo_main () at bonobo-main.c:311
        loop = <value optimized out>
#9  0x0000000000408d32 in main (argc=1, argv=0x7fffd74261b8) at registry-main.c:113
        desktop_autostart_id = 0x7a <Address 0x7a out of bounds>
        display_name = <value optimized out>
        registry = <value optimized out>
(gdb) quit

Anything more that would be helpful?

Comment 5 Matthias Clasen 2009-09-01 18:00:03 UTC
I've reopened http://bugzilla.gnome.org/show_bug.cgi?id=578334 for this issue

Comment 6 Matthias Clasen 2009-09-02 14:26:14 UTC
*** Bug 520623 has been marked as a duplicate of this bug. ***

Comment 7 Matthias Clasen 2009-09-11 03:47:14 UTC
*** Bug 521495 has been marked as a duplicate of this bug. ***

Comment 8 Matthias Clasen 2009-09-12 02:47:52 UTC
*** Bug 522771 has been marked as a duplicate of this bug. ***

Comment 9 Matthias Clasen 2009-09-14 04:45:07 UTC
*** Bug 522707 has been marked as a duplicate of this bug. ***

Comment 10 Matthias Clasen 2009-09-24 21:42:06 UTC
*** Bug 524420 has been marked as a duplicate of this bug. ***

Comment 11 Matthias Clasen 2009-09-27 02:18:39 UTC
*** Bug 525845 has been marked as a duplicate of this bug. ***

Comment 12 Matthias Clasen 2009-09-27 21:58:10 UTC
Should be fixed in at-spi-1.28.0-2.fc12