Bug 1420863 - gnome-terminal abort with long variable assignment
Summary: gnome-terminal abort with long variable assignment
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: gtk3
Version: 24
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Matthias Clasen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-09 16:43 UTC by Zbigniew Jędrzejewski-Szmek
Modified: 2017-02-28 18:27 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-02-28 18:27:20 UTC
Type: Bug


Attachments (Terms of Use)
text to crash gnome-terminal (4.37 KB, text/plain)
2017-02-09 22:16 UTC, Zbigniew Jędrzejewski-Szmek
no flags Details

Description Zbigniew Jędrzejewski-Szmek 2017-02-09 16:43:55 UTC
Description of problem:
gnome-terminal aborts reliably when I execute the following command:

TESTS="test-daemon test-log test-loopback test-engine test-watchdog test-cgroup-mask test-job-type test-env-util test-strbuf test-strv test-path test-path-util test-strxcpyx test-siphash24 test-unit-name test-unit-file test-utf8 test-ellipsize test-util test-mount-util test-cpu-set-util test-hexdecoct test-escape test-alloc-util test-proc-cmdline test-io-util test-glob-util test-xattr-util test-fs-util test-web-util test-stat-util test-fd-util test-string-util test-extract-word test-parse-util test-user-util test-hostname-util test-process-util test-terminal-util test-path-lookup test-barrier test-tmpfiles test-namespace test-date test-sleep test-replace-var test-sched-prio test-calendarspec test-strip-tab-ansi test-cgroup-util test-fstab-util test-prioq test-fileio test-time test-clock test-hashmap test-set test-bitmap test-list test-unaligned test-tables test-device-nodes test-xml test-architecture test-socket-util test-fdset test-conf-files test-conf-parser test-capability test-async test-ratelimit test-condition test-uid-range test-locale-util test-execute test-copy test-cap-list test-sigbus test-verbs test-af-list test-arphrd-list test-dns-domain test-install-root test-rlimit-util test-signal-util test-selinux test-sizeof test-acl-util  test-boot-timestamps test-bus-marshal test-bus-signature test-bus-benchmark test-bus-chat test-bus-cleanup test-bus-server test-bus-match test-bus-kernel test-bus-kernel-bloom test-bus-zero-copy test-bus-introspect test-bus-objects test-bus-error test-bus-creds test-bus-gvariant test-bus-track test-event test-netlink test-local-addresses test-resolve test-dhcp-option test-dhcp-client test-dhcp-server test-ipv4ll test-ndisc-rs test-dhcp6-client test-lldp test-libudev test-id128 test-hash test-journal test-journal-enum test-journal-send test-journal-syslog test-journal-match test-journal-stream test-journal-init test-journal-verify test-journal-interleaving test-journal-flush test-mmap-cache test-catalog test-audit-type test-compress test-compress-benchmark test-keymap-util test-machine-tables test-dns-packet test-resolve-tables test-dnssec test-networkd-conf test-network test-network-tables test-login-tables test-login-shared test-libsystemd-sym test-libudev-sym"
TESTS=test-daemon test-log test-loopback test-engine test-watchdog test-cgroup-mask test-job-type test-env-util test-strbuf test-strv test-path test-path-util test-strxcpyx test-siphash24 test-unit-name test-unit-file test-utf8 test-ellipsize test-util test-mount-util test-cpu-set-util test-hexdecoct test-escape test-alloc-util test-proc-cmdline test-io-util test-glob-util test-xattr-util test-fs-util test-web-util test-stat-util test-fd-util test-string-util test-extract-word test-parse-util test-user-util test-hostname-util test-process-util test-terminal-util test-path-lookup test-barrier test-tmpfiles test-namespace test-date test-sleep test-replace-var test-sched-prio test-calendarspec test-strip-tab-ansi test-cgroup-util test-fstab-util test-prioq test-fileio test-time test-clock test-hashmap test-set test-bitmap test-list test-unaligned test-tables test-device-nodes test-xml test-architecture test-socket-util test-fdset test-conf-files test-conf-parser test-capability test-async test-ratelimit test-condition test-uid-range test-locale-util test-execute test-copy test-cap-list test-sigbus test-verbs test-af-list test-arphrd-list test-dns-domain test-install-root test-rlimit-util test-signal-util test-selinux test-sizeof test-acl-util  test-boot-timestamps test-bus-marshal test-bus-signature test-bus-benchmark test-bus-chat test-bus-cleanup test-bus-server test-bus-match test-bus-kernel test-bus-kernel-bloom test-bus-zero-copy test-bus-introspect test-bus-objects test-bus-error test-bus-creds test-bus-gvariant test-bus-track test-event test-netlink test-local-addresses test-resolve test-dhcp-option test-dhcp-client test-dhcp-server test-ipv4ll test-ndisc-rs test-dhcp6-client test-lldp test-libudev test-id128 test-hash test-journal test-journal-enum test-journal-send test-journal-syslog test-journal-match test-journal-stream test-journal-init test-journal-verify test-journal-interleaving test-journal-flush test-mmap-cache test-catalog test-audit-type test-compress test-compress-benchmark test-keymap-util test-machine-tables test-dns-packet test-resolve-tables test-dnssec test-networkd-conf test-network test-network-tables test-login-tables test-login-shared test-libsystemd-sym test-libudev-sym

Version-Release number of selected component (if applicable):
gnome-terminal-3.20.3-1.fc24.x86_64
gnome-shell-3.20.4-3.fc24.x86_64, under wayland

How reproducible:
100%

Steps to Reproduce:
1. paste the line into any gnome-terminal window
2. immediate crash

Looks like some buffer overflow somewhere.

(gdb) bt
#0  0x00007ffff44b9765 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff44bb36a in __GI_abort () at abort.c:89
#2  0x00007ffff0e4b9bf in wl_abort (fmt=<optimized out>) at src/wayland-util.c:398
#3  0x00007ffff0e47c35 in wl_proxy_marshal_array_constructor_versioned (proxy=proxy@entry=0x555555ccaf80, opcode=opcode@entry=2, args=args@entry=0x7fffffffcf70, interface=interface@entry=0x0, version=1) at src/wayland-client.c:646
#4  0x00007ffff0e47c89 in wl_proxy_marshal_array_constructor (proxy=proxy@entry=0x555555ccaf80, opcode=opcode@entry=2, args=args@entry=0x7fffffffcf70, interface=interface@entry=0x0) at src/wayland-client.c:586
#5  0x00007ffff0e47d7c in wl_proxy_marshal (proxy=0x555555ccaf80, opcode=2) at src/wayland-client.c:683
#6  0x00007ffff70da397 in gtk_window_set_title_internal (window=0x5555558944b0 [TerminalWindow], title=<optimized out>, update_titlebar=1) at gtkwindow.c:2325
#10 0x00007ffff54f743f in <emit signal notify:title on instance 0x555555b195d0 [TerminalScreen]> (instance=instance@entry=0x555555b195d0, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3441
    #7  0x00007ffff54dc3e5 in g_closure_invoke (closure=0x555555bfa400, return_value=return_value@entry=0x0, n_param_values=2, param_values=param_values@entry=0x7fffffffd2d0, invocation_hint=invocation_hint@entry=0x7fffffffd250) at gclosure.c:804
    #8  0x00007ffff54ee432 in signal_emit_unlocked_R (node=node@entry=0x5555557e5790, detail=detail@entry=708, instance=instance@entry=0x555555b195d0, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7fffffffd2d0) at gsignal.c:3629
    #9  0x00007ffff54f705f in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7fffffffd4a0) at gsignal.c:3385
#11 0x00007ffff54e0814 in g_object_dispatch_properties_changed (object=0x555555b195d0 [TerminalScreen], n_pspecs=<optimized out>, pspecs=<optimized out>) at gobject.c:1062
#12 0x00007ffff54e00b6 in g_object_notify_queue_thaw (object=object@entry=0x555555b195d0 [TerminalScreen], nqueue=nqueue@entry=0x555555db25b0) at gobject.c:296
#13 0x00007ffff54e2eab in g_object_thaw_notify (object=0x555555b195d0 [TerminalScreen]) at gobject.c:1299
#14 0x00007ffff7ba8fd5 in VteTerminalPrivate::process_incoming() (this=this@entry=0x555555b175b0) at vte.cc:4033
#15 0x00007ffff7ba9d91 in VteTerminalPrivate::time_process_incoming() (this=this@entry=0x555555b175b0) at vte.cc:10670
#16 0x00007ffff7ba9e78 in VteTerminalPrivate::process(bool) (this=this@entry=0x555555b175b0, emit_adj_changed=emit_adj_changed@entry=false) at vte.cc:10694
#17 0x00007ffff7ba9ede in process_timeout(gpointer) (data=<error reading variable: value has been optimized out>) at vte.cc:10736
#18 0x00007ffff5209133 in g_timeout_dispatch (source=0x555555d89100, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4577
#19 0x00007ffff52086ba in g_main_context_dispatch (context=0x5555557e7c90) at gmain.c:3154
#20 0x00007ffff52086ba in g_main_context_dispatch (context=context@entry=0x5555557e7c90) at gmain.c:3769
#21 0x00007ffff5208a70 in g_main_context_iterate (context=context@entry=0x5555557e7c90, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3840
#22 0x00007ffff5208b1c in g_main_context_iteration (context=context@entry=0x5555557e7c90, may_block=may_block@entry=1) at gmain.c:3901
#23 0x00007ffff57cb48d in g_application_run (application=0x7fffdc00e620 [TerminalApp], argc=0, argv=0x0) at gapplication.c:2381
#24 0x0000555555568e4e in main (argc=<optimized out>, argv=<optimized out>) at server.c:180

(gdb) bt full
#0  0x00007ffff44b9765 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
        resultvar = 0
        pid = 9938
        selftid = 9938
#1  0x00007ffff44bb36a in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {140737332190190, 1, 0, 93824994801915, 140737488342320, 30064771074, 0, 0, 0, 21474836480, 140737293376868, 140737488342472, 12103457169668740864, 140737293396608, 93825000975856, 0}}, sa_flags = 0, sa_restorer = 0x1}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007ffff0e4b9bf in wl_abort (fmt=<optimized out>) at src/wayland-util.c:398
Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: 
#3  0x00007ffff0e47c35 in wl_proxy_marshal_array_constructor_versioned (proxy=proxy@entry=0x555555ccaf80, opcode=opcode@entry=2, args=args@entry=0x7fffffffcf70, interface=interface@entry=0x0, version=1) at src/wayland-client.c:646
        closure = 0x555555daadf0
        new_proxy = 0x0
        message = 0x7ffff6d599f0 <xdg_surface_requests+48>
#4  0x00007ffff0e47c89 in wl_proxy_marshal_array_constructor (proxy=proxy@entry=0x555555ccaf80, opcode=opcode@entry=2, args=args@entry=0x7fffffffcf70, interface=interface@entry=0x0) at src/wayland-client.c:586
#5  0x00007ffff0e47d7c in wl_proxy_marshal (proxy=0x555555ccaf80, opcode=2) at src/wayland-client.c:683
        args = {{i = 1440867648, u = 1440867648, f = 1440867648, s = 0x555555e1e540 "zbyszek@bupkis: TESTS=\"test-daemon test-log test-loopback test-engine test-watchdog test-cgroup-mask test-job-type test-env-util test-strbuf test-strv test-path test-path-util test-strxcpyx test-sipha"..., o = 0x555555e1e540, n = 1440867648, a = 0x555555e1e540, h = 1440867648}, {i = 4512, u = 4512, f = 4512, s = 0x11a0 <error: Cannot access memory at address 0x11a0>, o = 0x11a0, n = 4512, a = 0x11a0, h = 4512}, {i = 1, u = 1, f = 1, s = 0x1 <error: Cannot access memory at address 0x1>, o = 0x1, n = 1, a = 0x1, h = 1}, {i = -11568, u = 4294955728, f = -11568, s = 0x7fffffffd2d0 "\320>\235UUU", o = 0x7fffffffd2d0, n = 4294955728, a = 0x7fffffffd2d0, h = -11568}, {i = -11696, u = 4294955600, f = -11696, s = 0x7fffffffd250 "\001", o = 0x7fffffffd250, n = 4294955600, a = 0x7fffffffd250, h = -11696}, {i = -196066603, u = 4098900693, f = -196066603, s = 0x7ffff45042d5 <_int_malloc+341> "L\211\340L\211\347L\215mXH\301\350\006H\301\357\tL\211\341H\211D$@\203\300\060H\211|$P\211D$L\203\307[D\211\340\301\350\004\211|$`H\215\274$\200", o = 0x7ffff45042d5 <_int_malloc+341>, n = 4098900693, a = 0x7ffff45042d5 <_int_malloc+341>, h = -196066603}, {i = 99, u = 99, f = 99, s = 0x63 <error: Cannot access memory at address 0x63>, o = 0x63, n = 99, a = 0x63, h = 99}, {i = -12256, u = 4294955040, f = -12256, s = 0x7fffffffd020 "c", o = 0x7fffffffd020, n = 4294955040, a = 0x7fffffffd020, h = -12256}, {i = 4494, u = 4494, f = 4494, s = 0x118e <error: Cannot access memory at address 0x118e>, o = 0x118e, n = 4494, a = 0x118e, h = 4494}, {i = -12257, u = 4294955039, f = -12257, s = 0x7fffffffd01f "\247c", o = 0x7fffffffd01f, n = 4294955039, a = 0x7fffffffd01f, h = -12257}, {i = 99, u = 99, f = 99, s = 0x63 <error: Cannot access memory at address 0x63>, o = 0x63, n = 99, a = 0x63, h = 99}, {i = -12224, u = 4294955072, f = -12224, s = 0x7fffffffd040 "\200\356\377\377\377\377\377\377p\356\377\377\377\377\377\377\216\021", o = 0x7fffffffd040, n = 4294955072, a = 0x7fffffffd040, h = -12224}, {i = 4494, u = 4494, f = 4494, s = 0x118e <error: Cannot access memory at address 0x118e>, o = 0x118e, n = 4494, a = 0x118e, h = 4494}, {i = 12257, u = 12257, f = 12257, s = 0xffff800000002fe1 <error: Cannot access memory at address 0xffff800000002fe1>, o = 0xffff800000002fe1, n = 12257, a = 0xffff800000002fe1, h = 12257}, {i = 70, u = 70, f = 70, s = 0x46 <error: Cannot access memory at address 0x46>, o = 0x46, n = 70, a = 0x46, h = 70}, {i = 282, u = 282, f = 282, s = 0x760000011a <error: Cannot access memory at address 0x760000011a>, o = 0x760000011a, n = 282, a = 0x760000011a, h = 282}, {i = 8, u = 8, f = 8, s = 0x8 <error: Cannot access memory at address 0x8>, o = 0x8, n = 8, a = 0x8, h = 8}, {i = 1, u = 1, f = 1, s = 0x1 <error: Cannot access memory at address 0x1>, o = 0x1, n = 1, a = 0x1, h = 1}, {i = 99, u = 99, f = 99, s = 0x6f00000063 <error: Cannot access memory at address 0x6f00000063>, o = 0x6f00000063, n = 99, a = 0x6f00000063, h = 99}, {i = 0, u = 0, f = 0, s = 0x0, o = 0x0, n = 0, a = 0x0, h = 0}}
Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: 
#6  0x00007ffff70da397 in gtk_window_set_title_internal (window=0x5555558944b0 [TerminalWindow], title=<optimized out>, update_titlebar=1) at gtkwindow.c:2325
        priv = 0x555555894270
        widget = 0x5555558944b0 [TerminalWindow]
        new_title = 0x555555e1d3a0 "zbyszek@bupkis: TESTS=\"test-daemon test-log test-loopback test-engine test-watchdog test-cgroup-mask test-job-type test-env-util test-strbuf test-strv test-path test-path-util test-strxcpyx test-sipha"...
        __func__ = "gtk_window_set_title_internal"
#10 0x00007ffff54f743f in <emit signal notify:title on instance 0x555555b195d0 [TerminalScreen]> (instance=instance@entry=0x555555b195d0, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3441
Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: 
#11 0x00007ffff54e0814 in g_object_dispatch_properties_changed (object=0x555555b195d0 [TerminalScreen], n_pspecs=<optimized out>, pspecs=<optimized out>) at gobject.c:1062
        i = <optimized out>
#12 0x00007ffff54e00b6 in g_object_notify_queue_thaw (object=object@entry=0x555555b195d0 [TerminalScreen], nqueue=nqueue@entry=0x555555db25b0) at gobject.c:296
        pspecs_mem = {0x555555aef090 [GParamString], 0x5555558461b0 [GParamBoolean], 0x555555aef360 [GParamString], 0x555555aef120 [GParamString], 0x555555aef3f0 [GParamString], 0x14, 0x18b5, 0x39, 0x555555b195e0, 0x0, 0x0, 0x7ffff51ecc48, 0x555555b195d0 [TerminalScreen], 0x555555b195d0 [TerminalScreen], 0x555555b195d0 [TerminalScreen], 0x555555b195e0}
        pspecs = 0x7fffffffd5b0
        free_me = 0x0
        slist = <optimized out>
        n_pspecs = 5
        __func__ = "g_object_notify_queue_thaw"
#13 0x00007ffff54e2eab in g_object_thaw_notify (object=0x555555b195d0 [TerminalScreen]) at gobject.c:1299
        nqueue = 0x555555db25b0
        __func__ = "g_object_thaw_notify"
#14 0x00007ffff7ba8fd5 in VteTerminalPrivate::process_incoming() (this=this@entry=0x555555b175b0) at vte.cc:4033
        saved_cursor = <optimized out>
        saved_cursor_visible = <optimized out>
        saved_cursor_style = <optimized out>
        bbox_topleft = <optimized out>
        bbox_bottomright = <optimized out>
        wbuf = 0x555555de5720
        c = <optimized out>
        wcount = 6325
        start = <optimized out>
        leftovers = <optimized out>
        modified = <optimized out>
        bottom = <optimized out>
        again = 0
        invalidated_text = <optimized out>
        in_scroll_region = <optimized out>
        chunk = <optimized out>
        next_chunk = <optimized out>
        achunk = <optimized out>
        previous_screen = <optimized out>
        top_row = <optimized out>
        bottom_row = 23
        __PRETTY_FUNCTION__ = "void VteTerminalPrivate::process_incoming()"
#15 0x00007ffff7ba9d91 in VteTerminalPrivate::time_process_incoming() (this=this@entry=0x555555b175b0) at vte.cc:10670
        elapsed = <optimized out>
        target = <optimized out>
#16 0x00007ffff7ba9e78 in VteTerminalPrivate::process(bool) (this=this@entry=0x555555b175b0, emit_adj_changed=emit_adj_changed@entry=false) at vte.cc:10694
        is_active = <optimized out>
#17 0x00007ffff7ba9ede in process_timeout(gpointer) (data=<error reading variable: value has been optimized out>) at vte.cc:10736
        that = 0x555555b175b0
        active = <optimized out>
        l = <optimized out>
        next = 0x0
        again = <optimized out>
#18 0x00007ffff5209133 in g_timeout_dispatch (source=0x555555d89100, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4577
        timeout_source = 0x555555d89100
        again = <optimized out>
#19 0x00007ffff52086ba in g_main_context_dispatch (context=0x5555557e7c90) at gmain.c:3154
        dispatch = 0x7ffff5209120 <g_timeout_dispatch>
        prev_source = 0x0
        was_in_call = 0
        user_data = 0x0
        callback = 0x7ffff7ba9ea0 <process_timeout(gpointer)>
        cb_funcs = 0x7ffff54cc280 <g_source_callback_funcs>
        cb_data = 0x555555db2270
        need_destroy = <optimized out>
        source = 0x555555d89100
        current = 0x5555558214b0
        i = 0
#20 0x00007ffff52086ba in g_main_context_dispatch (context=context@entry=0x5555557e7c90) at gmain.c:3769
#21 0x00007ffff5208a70 in g_main_context_iterate (context=context@entry=0x5555557e7c90, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3840
        max_priority = 2147483647
        timeout = 2
        some_ready = 1
        nfds = 4
        allocated_nfds = 4
        fds = <optimized out>
#22 0x00007ffff5208b1c in g_main_context_iteration (context=context@entry=0x5555557e7c90, may_block=may_block@entry=1) at gmain.c:3901
        retval = <optimized out>
#23 0x00007ffff57cb48d in g_application_run (application=0x7fffdc00e620 [TerminalApp], argc=0, argv=0x0) at gapplication.c:2381
        arguments = 0x55555584b440
        status = 0
        context = 0x5555557e7c90
        acquired_context = <optimized out>
        __func__ = "g_application_run"
#24 0x0000555555568e4e in main (argc=<optimized out>, argv=<optimized out>) at server.c:180
        app = 0x7fffdc00e620 [TerminalApp]
        home_dir = <optimized out>
        charset = 0x5555557c82b0 "UTF-8"
        error = 0x0

Comment 1 Egmont Koblinger 2017-02-09 18:55:52 UTC
Which one of those two huge paragraphs to paste? They differ in a pair of quotes. The first is a variable assignment. The second tries to launch the command "test-log" with a short TESTS environment variable and tons of parameters.

I cannot reproduce the crash on Ubuntu, X11.

Maybe wayland doesn't like overlong window titles? Or does it have something to do with some Red Hat patch? Dunno.

Comment 2 Zbigniew Jędrzejewski-Szmek 2017-02-09 19:20:04 UTC
It's one whole thing, with two lines. Those programs don't get executed, because this also crashes gnome-terminal when I run it in some other directory. I wasn't pasting it, but just going back in history. Might be some interaction with zsh which is trying to set the window title.

In the traceback I pasted, gtk_window_set_title_internal is called with a reaaally long name. I assume that this could be reproduced by calling the title setting escapes directly.

> Maybe wayland doesn't like overlong window titles? Or does it have something to do with some Red Hat patch? Dunno.

Patches for gnome-terminal are at https://apps.fedoraproject.org/packages/gnome-terminal/sources/patches/.

Comment 3 Egmont Koblinger 2017-02-09 20:21:11 UTC
> It's one whole thing, with two lines.

Which one of the two crashes gnome-terminal? (I guess either one does.)

> I assume that this could be reproduced by calling the title setting escapes directly.

That's what I tried, no crash for me.

> Might be some interaction with zsh which is trying to set the window title.

Could you disable this zsh feature (e.g. start bash) and manually set a long title:

  echo -ne '\e]0;reaaally long name\a'; sleep 10

Does it make gnome-terminal crash? If so, what's approximately the number of characters where it starts crashing?

Could you please try it with vanilla gnome-terminal, or Red Hat package rebuilt without the transparency+notification patch?

Independently of the previous: could you, by any chance, test the behavior under X11 instead of Wayland?

Thanks!

Comment 4 Egmont Koblinger 2017-02-09 20:22:17 UTC
(Obviously I meant the command by actually replacing that string with an extremely long title.)

Comment 5 Zbigniew Jędrzejewski-Szmek 2017-02-09 22:15:44 UTC
(In reply to Egmont Koblinger from comment #3)
> > It's one whole thing, with two lines.
> 
> Which one of the two crashes gnome-terminal? (I guess either one does.)
zsh supported multi-line history entries. So when I go back in history using up arrow, and press enter, both lines are visible and would be executed after I press enter. It seems that both are required.

> > I assume that this could be reproduced by calling the title setting escapes directly.
> 
> That's what I tried, no crash for me.
Yes, I now tried that too, and no... oh, wait, now I got it ;)
I'll describe the steps below.

I don't know if this is relevant, but it might be: zsh uses the "bracketed terminal paste mode", while bash does not.
 
> > Might be some interaction with zsh which is trying to set the window title.
> 
> Could you disable this zsh feature (e.g. start bash) and manually set a long
> title:
> 
>   echo -ne '\e]0;reaaally long name\a'; sleep 10
> 
> Does it make gnome-terminal crash?
Nope, even for very long titles, titles with a newline, etc.

> Could you please try it with vanilla gnome-terminal, or Red Hat package
> rebuilt without the transparency+notification patch?
>
> Independently of the previous: could you, by any chance, test the behavior
> under X11 instead of Wayland?
I'll try that next.

OK, new recipe:
1. start gnome-terminal
2. cat attached file, select whole text with mouse
3. paste the text into gnome-terminal running zsh
   (the text is selected because of bracketed paste mode, but not yet executed)
4. press enter

Comment 6 Zbigniew Jędrzejewski-Szmek 2017-02-09 22:16:40 UTC
Created attachment 1248912 [details]
text to crash gnome-terminal

Comment 7 Zbigniew Jędrzejewski-Szmek 2017-02-09 22:22:28 UTC
Yeah, under Xorg there's no crash. Seems to be wayland related.

Comment 8 Egmont Koblinger 2017-02-09 22:24:45 UTC
No crash for me (not a surprise given your most recent comment).

Probably Wayland (or rather, GTK+'s Wayland backend?) doesn't like extremely long window titles??

Comment 9 Zbigniew Jędrzejewski-Szmek 2017-02-09 22:27:36 UTC
I'll retry later on F25 and rawhide.

Comment 10 Egmont Koblinger 2017-02-09 22:29:08 UTC
Cool, thanks.

Given that I don't have Wayland, I'm afraid I won't be able to help any further... we'll see.

Comment 11 Zbigniew Jędrzejewski-Szmek 2017-02-10 00:16:42 UTC
No crash on F25. This appears to be F24 only.

Comment 12 Matthias Clasen 2017-02-17 15:13:27 UTC
tjere was a fix at some point for overlong window titles unde wayland.

Comment 13 Debarshi Ray 2017-02-28 18:27:20 UTC
Given that (a) Wayland isn't default in Fedora 24 and (b) it is fixed in F25, I am inclined to mark is as CLOSED CURRENTRELEASE.


Note You need to log in before you can comment on or make changes to this bug.