Bug 556874

Summary: [abrt] crash in rhythmbox-0.12.6-6.fc13 [iPhone crashes rhythmbox]
Product: [Fedora] Fedora Reporter: Tom London <selinux>
Component: rhythmboxAssignee: Bastien Nocera <bnocera>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: bnocera, dwmw2
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: abrt_hash:2ead87418d69d4cb2a77eac7f22f7a689399b1c6
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-02-15 15:11:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
script file running "gdb rhythmbox; run; where; thread apply all bt full" none

Description Tom London 2010-01-19 17:09:33 UTC 
abrt 1.0.2 detected a crash.

How to reproduce
-----
1. Started from music-applet
2.
3.

Comment
-----
Updated to newest koji gnome-* packages

Logged in, panel had crashed.  Manually ran gnome-panel, and started rhythmbox from music-appet.

Crashed after a couple of seconds (guessing it was when it was scanning music library for changes....)

Is it useful for me to run in debugger?

Attached file: backtrace
cmdline: rhythmbox
component: rhythmbox
executable: /usr/bin/rhythmbox
kernel: 2.6.33-0.16.rc4.git6.fc13.x86_64
package: rhythmbox-0.12.6-6.fc13
rating: 4
reason: Process was terminated by signal 11 (Segmentation fault)
Comment 1 Tom London 2010-01-19 17:09:34 UTC 
Created attachment 385442 [details]
File: backtrace
Comment 2 Tom London 2010-01-19 17:16:54 UTC 
Created attachment 385446 [details]
script file running "gdb rhythmbox; run; where; thread apply all bt full"

I ran rhythmbox in gdb and captured via "script".

Output attached here.

Segfault happens every time.
Comment 3 Tom London 2010-01-19 18:52:11 UTC 
This crash only seems to happen if gnome-panel is running.

See: https://bugzilla.redhat.com/show_bug.cgi?id=556894

If I wait for gnome-panel to crash, I can then happily start rhythmbox from a terminal window, and then restart gnome-panel.
Comment 4 Tom London 2010-01-19 18:58:50 UTC 
But, I get these:

[1]+  Stopped                 rhythmbox
[tbl@tlondon ~]$ bg
[1]+ rhythmbox &
[tbl@tlondon ~]$ 
[tbl@tlondon ~]$ Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
LIBMTP PANIC: could not inspect object property descriptions!
LIBMTP PANIC: could not inspect object property descriptions!
LIBMTP PANIC: could not inspect object property descriptions!
Comment 5 Tom London 2010-01-21 15:39:31 UTC 
After applying gtk2 patch to fix https://bugzilla.redhat.com/show_bug.cgi?id=556894, I no longer get rhythmbox crash as described above.
Comment 6 Tom London 2010-01-25 19:13:06 UTC 
I got this again.

This time, I noticed that I had my iPhone "plugged in" and mounted before I started rhythmbox.  Rhythmbox crashed each time I tried to start it.

When I unmounted the iPhone, rhythmbox started with no problem.

Here is the segfault I got with the iPhone mounted.

As the messages suggests, is this an issue with libmtp and iPhone?

[Thread 0x7fffe21f5710 (LWP 2526) exited]
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
[New Thread 0x7fffe21f5710 (LWP 2528)]
[New Thread 0x7ffff0193710 (LWP 2529)]
usb_claim_interface(): Device or resource busy
LIBMTP PANIC: Unable to initialize device
LIBMTP PANIC: Trying to get the error stack of a NULL device!
LIBMTP PANIC: Trying to clear the error stack of a NULL device!
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
Device 0 (VID=05ac and PID=1292) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp development team
[Thread 0x7ffff0193710 (LWP 2529) exited]

Program received signal SIGSEGV, Segmentation fault.
LIBMTP_Release_Device (device=0x0) at libmtp.c:1969
1969	  PTPParams *params = (PTPParams *) device->params;
Missing separate debuginfos, use: debuginfo-install krb5-libs-1.7-22.fc13.x86_64
(gdb) where
#0  LIBMTP_Release_Device (device=0x0) at libmtp.c:1969
#1  0x00007fffe2c72b71 in impl_finalize (object=0x18481c0 [RBMtpThread])
    at rb-mtp-thread.c:750
#2  0x0000003c6280decf in IA__g_object_unref (_object=0x18481c0)
    at gobject.c:2482
#3  0x00007fffe2c7177e in rb_mtp_source_dispose (object=
    0x183e000 [RBMtpSource]) at rb-mtp-source.c:344
#4  0x0000003c6280de49 in IA__g_object_unref (_object=0x183e000)
    at gobject.c:2451
#5  0x00007fffe2c70564 in device_open_failed_idle (source=
    0x183e000 [RBMtpSource]) at rb-mtp-source.c:648
#6  0x0000003c6203938e in g_main_dispatch (context=0x6e8c00) at gmain.c:1960
#7  IA__g_main_context_dispatch (context=0x6e8c00) at gmain.c:2513
#8  0x0000003c6203cd78 in g_main_context_iterate (context=0x6e8c00, 
    block=<value optimized out>, dispatch=<value optimized out>, 
    self=<value optimized out>) at gmain.c:2591
#9  0x0000003c6203d1c5 in IA__g_main_loop_run (loop=0x8ee660) at gmain.c:2799
#10 0x0000003ae2349a47 in IA__gtk_main () at gtkmain.c:1219
#11 0x0000000000403aa5 in main (argc=1, argv=0x7fffffffe1c8) at main.c:332
(gdb) set pagination off
(gdb) thread apply all bt full

Thread 6 (Thread 0x7fffe21f5710 (LWP 2528)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:212
No locals.
#1  0x0000003c634023f2 in g_cond_timed_wait_posix_impl (cond=<value optimized out>, entered_mutex=<value optimized out>, abs_time=<value optimized out>) at gthread-posix.c:242
        result = <value optimized out>
        end_time = {tv_sec = 1264445272, tv_nsec = 650349000}
        timed_out = <value optimized out>
        __PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#2  0x0000003c62014b1f in g_async_queue_pop_intern_unlocked (queue=0x7c0570, try=0, end_time=0x7fffe21f4d90) at gasyncqueue.c:365
        retval = <value optimized out>
        __PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#3  0x0000003c6206394e in g_thread_pool_wait_for_new_task (data=<value optimized out>) at gthreadpool.c:220
        end_time = {tv_sec = 1264445272, tv_usec = 650349}
        task = <value optimized out>
#4  g_thread_pool_thread_proxy (data=<value optimized out>) at gthreadpool.c:254
        task = 0x1851840
        pool = 0x7c0510
#5  0x0000003c620624c4 in g_thread_create_proxy (data=0x1851d30) at gthread.c:635
        thread = 0x1851d30
        __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#6  0x0000003c60c06caa in start_thread (arg=<value optimized out>) at pthread_create.c:297
        __res = <value optimized out>
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140736987092752, 8969218616041230565, 140737488343600, 140736987092752, 0, 3, -8969247472319377179, 8935653275749142757}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#7  0x0000003c608e242d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
No locals.

Thread 1 (Thread 0x7ffff7fc47e0 (LWP 2520)):
#0  LIBMTP_Release_Device (device=0x0) at libmtp.c:1969
        params = <value optimized out>
        ptp_usb = <value optimized out>
#1  0x00007fffe2c72b71 in impl_finalize (object=0x18481c0 [RBMtpThread]) at rb-mtp-thread.c:750
        task = <value optimized out>
        __FUNCTION__ = "impl_finalize"
#2  0x0000003c6280decf in IA__g_object_unref (_object=0x18481c0) at gobject.c:2482
        object = 0x18481c0 [RBMtpThread]
        old_ref = <value optimized out>
        is_zero = <value optimized out>
        __PRETTY_FUNCTION__ = "IA__g_object_unref"
#3  0x00007fffe2c7177e in rb_mtp_source_dispose (object=0x183e000 [RBMtpSource]) at rb-mtp-source.c:344
        priv = 0x183e180
        entry_type = 0x338ec717bf
        db = 0x183e180
#4  0x0000003c6280de49 in IA__g_object_unref (_object=0x183e000) at gobject.c:2451
        object = 0x183e000 [RBMtpSource]
        old_ref = <value optimized out>
        is_zero = <value optimized out>
        __PRETTY_FUNCTION__ = "IA__g_object_unref"
#5  0x00007fffe2c70564 in device_open_failed_idle (source=0x183e000 [RBMtpSource]) at rb-mtp-source.c:648
No locals.
#6  0x0000003c6203938e in g_main_dispatch (context=0x6e8c00) at gmain.c:1960
        dispatch = 0x3c62037550 <g_idle_dispatch>
        was_in_call = 0
        user_data = 0x183e000
        callback = 0x7fffe2c70540 <device_open_failed_idle>
        cb_funcs = 0x3c622e4cb0
        cb_data = <value optimized out>
        current_source_link = {data = 0x7fffdc0010e0, next = 0x0}
        source = 0x7fffdc0010e0
        current = 0x73fc80
        i = <value optimized out>
#7  IA__g_main_context_dispatch (context=0x6e8c00) at gmain.c:2513
No locals.
#8  0x0000003c6203cd78 in g_main_context_iterate (context=0x6e8c00, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591
        max_priority = 200
        timeout = 0
        some_ready = 1
        nfds = 12
        allocated_nfds = <value optimized out>
        fds = <value optimized out>
        __PRETTY_FUNCTION__ = "g_main_context_iterate"
#9  0x0000003c6203d1c5 in IA__g_main_loop_run (loop=0x8ee660) at gmain.c:2799
        self = 0x60d060
        __PRETTY_FUNCTION__ = "IA__g_main_loop_run"
#10 0x0000003ae2349a47 in IA__gtk_main () at gtkmain.c:1219
        tmp_list = <value optimized out>
        functions = 0x0
        init = <value optimized out>
        loop = 0x8ee660
#11 0x0000000000403aa5 in main (argc=1, argv=0x7fffffffe1c8) at main.c:332
        _save = 0x992f70
        session_bus = <value optimized out>
        error = 0x0
        rb_shell = 0x719270 [RBShell]
        activated = 0
        accel_map_file = 0x74b890 "/home/tbl/.gnome2/accels/rhythmbox"
        desktop_file_path = <value optimized out>
        context = <value optimized out>
        options = {{long_name = 0x405465 "debug", short_name = 100 'd', flags = 0, arg = G_OPTION_ARG_NONE, arg_data = 0x607770, description = 0x40546b "Enable debug output", arg_description = 0x0}, {long_name = 0x40547f "debug-match", short_name = 68 'D', flags = 0, arg = G_OPTION_ARG_STRING, arg_data = 0x607778, description = 0x405648 "Enable debug output matching a specified string", arg_description = 0x0}, {long_name = 0x40548b "no-update", short_name = 0 '\000', flags = 0, arg = G_OPTION_ARG_NONE, arg_data = 0x60779c, description = 0x405678 "Do not update the library with file changes", arg_description = 0x0}, {long_name = 0x405495 "no-registration", short_name = 110 'n', flags = 0, arg = G_OPTION_ARG_NONE, arg_data = 0x607780, description = 0x4054a5 "Do not register the shell", arg_description = 0x0}, {long_name = 0x4054bf "dry-run", short_name = 0 '\000', flags = 0, arg = G_OPTION_ARG_NONE, arg_data = 0x607798, description = 0x4056a8 "Don't save any data permanently (implies --no-registration)", arg_description = 0x0}, {long_name = 0x4054c7 "rhythmdb-file", short_name = 0 '\000', flags = 0, arg = G_OPTION_ARG_STRING, arg_data = 0x607790, description = 0x4054d5 "Path for database file to use", arg_description = 0x0}, {long_name = 0x4054f3 "playlists-file", short_name = 0 '\000', flags = 0, arg = G_OPTION_ARG_STRING, arg_data = 0x607788, description = 0x4056e8 "Path for playlists file to use", arg_description = 0x0}, {long_name = 0x405354 "quit", short_name = 113 'q', flags = 0, arg = G_OPTION_ARG_NONE, arg_data = 0x607784, description = 0x405502 "Quit Rhythmbox", arg_description = 0x0}, {long_name = 0x40526e "", short_name = 0 '\000', flags = 0, arg = G_OPTION_ARG_STRING_ARRAY, arg_data = 0x6077a0, description = 0x0, arg_description = 0x405511 "[URI...]"}, {long_name = 0x0, short_name = 0 '\000', flags = 0, arg = G_OPTION_ARG_NONE, arg_data = 0x0, description = 0x0, arg_description = 0x0}}
        __FUNCTION__ = "main"
(gdb) where
#0  LIBMTP_Release_Device (device=0x0) at libmtp.c:1969
#1  0x00007fffe2c72b71 in impl_finalize (object=0x18481c0 [RBMtpThread]) at rb-mtp-thread.c:750
#2  0x0000003c6280decf in IA__g_object_unref (_object=0x18481c0) at gobject.c:2482
#3  0x00007fffe2c7177e in rb_mtp_source_dispose (object=0x183e000 [RBMtpSource]) at rb-mtp-source.c:344
#4  0x0000003c6280de49 in IA__g_object_unref (_object=0x183e000) at gobject.c:2451
#5  0x00007fffe2c70564 in device_open_failed_idle (source=0x183e000 [RBMtpSource]) at rb-mtp-source.c:648
#6  0x0000003c6203938e in g_main_dispatch (context=0x6e8c00) at gmain.c:1960
#7  IA__g_main_context_dispatch (context=0x6e8c00) at gmain.c:2513
#8  0x0000003c6203cd78 in g_main_context_iterate (context=0x6e8c00, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591
#9  0x0000003c6203d1c5 in IA__g_main_loop_run (loop=0x8ee660) at gmain.c:2799
#10 0x0000003ae2349a47 in IA__gtk_main () at gtkmain.c:1219
#11 0x0000000000403aa5 in main (argc=1, argv=0x7fffffffe1c8) at main.c:332
(gdb) quit
A debugging session is active.

	Inferior 1 [process 2520] will be killed.

Quit anyway? (y or n) y
Comment 7 Bastien Nocera 2010-02-15 15:11:58 UTC 

*** This bug has been marked as a duplicate of bug 563195 ***
Comment 8 Tom London 2010-02-15 16:03:39 UTC 
Believe the build of rhythmbox-0.12.6-8.fc13 failed.

Is this fixed in rawhide?
Comment 9 Bastien Nocera 2010-02-15 17:03:42 UTC 
rhythmbox-0.12.6-8.fc13 is built now, thanks for spotting this.