Bug 1260350 - [abrt] gimp: gimp_id_table_remove(): gimp-2.8 killed by SIGSEGV
Summary: [abrt] gimp: gimp_id_table_remove(): gimp-2.8 killed by SIGSEGV
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: gimp
Version: 22
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Nils Philippsen
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:866414a78faffd72be38adf7691...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-09-06 06:38 UTC by Brandon Amaro
Modified: 2023-09-14 03:04 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-06-03 11:55:55 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)
File: backtrace (47.80 KB, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: cgroup (284 bytes, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: core_backtrace (4.41 KB, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: dso_list (24.25 KB, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: environ (3.84 KB, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: limits (1.29 KB, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: maps (162.12 KB, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: mountinfo (3.24 KB, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: namespaces (85 bytes, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: open_fds (1.10 KB, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: proc_pid_status (1015 bytes, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
File: var_log_messages (250 bytes, text/plain)
2015-09-06 06:38 UTC, Brandon Amaro 		no flags Details
View All

Description Brandon Amaro 2015-09-06 06:38:08 UTC 
Version-Release number of selected component:
gimp-2.8.14-3.fc22

Additional info:
reporter:       libreport-2.6.2
backtrace_rating: 4
cmdline:        gimp-2.8 /run/user/1000/gvfs/smb-share:server=peeves.local,share=www/fedtrek.com/web/staff/omega13a/15-08-29_photos_A380/P8290180.JPG
crash_function: gimp_id_table_remove
executable:     /usr/bin/gimp-2.8
global_pid:     6018
kernel:         4.1.6-200.fc22.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (6 frames)
 #0 gimp_id_table_remove at gimpidtable.c:231
 #1 gimp_item_finalize at gimpitem.c:343
 #3 g_datalist_clear at gdataset.c:273
 #5 gtk_drag_source_info_destroy at gtkdnd.c:3961
 #6 gtk_drag_anim_timeout at gtkdnd.c:3856
 #13 app_run at app.c:263
Comment 1 Brandon Amaro 2015-09-06 06:38:12 UTC 
Created attachment 1070645 [details]
File: backtrace
Comment 2 Brandon Amaro 2015-09-06 06:38:13 UTC 
Created attachment 1070646 [details]
File: cgroup
Comment 3 Brandon Amaro 2015-09-06 06:38:13 UTC 
Created attachment 1070647 [details]
File: core_backtrace
Comment 4 Brandon Amaro 2015-09-06 06:38:15 UTC 
Created attachment 1070648 [details]
File: dso_list
Comment 5 Brandon Amaro 2015-09-06 06:38:16 UTC 
Created attachment 1070649 [details]
File: environ
Comment 6 Brandon Amaro 2015-09-06 06:38:16 UTC 
Created attachment 1070650 [details]
File: limits
Comment 7 Brandon Amaro 2015-09-06 06:38:21 UTC 
Created attachment 1070651 [details]
File: maps
Comment 8 Brandon Amaro 2015-09-06 06:38:23 UTC 
Created attachment 1070652 [details]
File: mountinfo
Comment 9 Brandon Amaro 2015-09-06 06:38:25 UTC 
Created attachment 1070653 [details]
File: namespaces
Comment 10 Brandon Amaro 2015-09-06 06:38:27 UTC 
Created attachment 1070654 [details]
File: open_fds
Comment 11 Brandon Amaro 2015-09-06 06:38:30 UTC 
Created attachment 1070655 [details]
File: proc_pid_status
Comment 12 Brandon Amaro 2015-09-06 06:38:35 UTC 
Created attachment 1070656 [details]
File: var_log_messages
Comment 13 Nils Philippsen 2015-09-16 12:16:06 UTC 
What did you do when this crash happened? Can you reproduce it?

Note to self:

The id_table pointer in this function call looks very suspicious (2^33, "8 Giga").

Thread 1 (Thread 0x7fa2448c6980 (LWP 6018)):
#0  0x00005644acf04065 in gimp_id_table_remove (id_table=0x200000000, id=152) at gimpidtable.c:231
        __inst = 0x200000000
        __t = 94852996996928
        __r = <optimized out>
        __func__ = "gimp_id_table_remove"

The affected gimp->item_table member is only ever written directly in two places:

app/core/gimp.c:226:  gimp->item_table          = gimp_id_table_new ();

app/core/gimp.c:419:      g_object_unref (gimp->item_table);
app/core/gimp.c:420:      gimp->item_table = NULL;

So it's probably one of these, but it's nigh impossible to debug without being able to reproduce it:

- something overwrites the struct member through bad boundary checking or whatever
- one bit flipped in memory (HW fault)
Comment 14 Red Hat Bugzilla 2023-09-14 03:04:54 UTC 
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days
Note You need to log in before you can comment on or make changes to this bug.