Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1688737

Summary: Remote-viewer core dumped sometimes during live migration
Product: Red Hat Enterprise Linux 8 Reporter: Fangge Jin <fjin>
Component: spice-gtkAssignee: Default Assignee for SPICE Bugs <rh-spice-bugs>
Status: CLOSED ERRATA QA Contact: SPICE QE bug list <spice-qe-bugs>
Severity: high Docs Contact:
Priority: high    
Version: 8.0CC: dblechte, juzhou, knoel, lizhu, rbalakri, rduda, tpelka, tzheng, uril, victortoso, xiaodwan, xuzhang, yafu
Target Milestone: rcKeywords: OtherQA, TestBlocker
Target Release: ---Flags: knoel: mirror+
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-04 04:07:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
domain xml
none
remote-viewer log none

Description Fangge Jin 2019-03-14 10:40:37 UTC
Created attachment 1543982 [details]
domain xml

Description of problem:
Remote-viewer core dumped sometimes during live migration

Version-Release number of selected component:
virt-viewer-7.0-2.el8.x86_64
spice-gtk3-0.35-7.el8.x86_64
spice-server-0.14.0-7.el8.x86_64
spice-glib-0.35-7.el8.x86_64
gtk3-3.22.30-3.el8.x86_64
glib2-2.56.4-1.el8.x86_64
libvirt-5.0.0-6.module+el8+2860+4e0fe96a.x86_64
qemu-kvm-3.1.0-18.module+el8+2834+fa8bb6e2.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Prepare migration env

2. Start a vm with spice graphic on src host

3. Connect to vm by remote-viewer:
$ remote-viewer spice://dhcp-66-71-70.eng.nay.redhat.com/?port=5901\&tls-port=5902 --spice-host-subject="C=IL,L=Raanana,O=Red Hat,CN=dhcp-66-71-70.eng.nay.redhat.com" --spice-ca-file='/etc/pki/qemu/ca-cert.pem' --spice-debug --debug --spice-smartcard 2>&1 >remote-viewer.log

4. Migrate vm to dest host:
# virsh migrate rhel7.6 qemu+ssh://10.66.4.134/system --live --verbose --undefinesource --persistent --p2p

5. Migrate vm back to src host, then repeat for several times, remote-viewer will crash:

(remote-viewer:20039): GSpice-WARNING **: 16:22:09.524: (spice-session.c:2271):spice_session_channel_new: runtime check failed: (s->playback_channel == NULL)

(remote-viewer:20039): GSpice-CRITICAL **: 16:22:09.526: channel_connect: assertion 'c->sock == NULL' failed

(remote-viewer:20039): GSpice-CRITICAL **: 16:22:09.527: channel_connect: assertion 'c->sock == NULL' failed

(remote-viewer:20039): GSpice-CRITICAL **: 16:22:09.527: channel_connect: assertion 'c->sock == NULL' failed
corrupted double-linked list
Aborted (core dumped)


Actual results:
Remote-viewer core dumped during live migration

Expected results:
No core dump

Additional info:
Backtrace:
(gdb) t a a bt

Thread 7 (Thread 0x7f7d7d7fe700 (LWP 28834)):
#0  0x00007f7dcafac2bd in syscall () at /lib64/libc.so.6
#1  0x00007f7dcb894cfe in g_cond_wait_until (cond=cond@entry=0x55f58fd11808, mutex=mutex@entry=0x55f58fd11800, end_time=end_time@entry=89062221533) at gthread-posix.c:1449
#2  0x00007f7dcb8200f1 in g_async_queue_pop_intern_unlocked (queue=0x55f58fd11800, wait=wait@entry=1, end_time=89062221533) at gasyncqueue.c:422
#3  0x00007f7dcb82072c in g_async_queue_timeout_pop_unlocked (queue=<optimized out>, timeout=timeout@entry=500000) at gasyncqueue.c:570
#4  0x00007f7dcb876ae2 in g_thread_pool_wait_for_new_task (pool=<optimized out>) at gthreadpool.c:262
#5  0x00007f7dcb876ae2 in g_thread_pool_thread_proxy (data=<optimized out>) at gthreadpool.c:296
#6  0x00007f7dcb875f9a in g_thread_proxy (data=0x55f58fef1b20) at gthread.c:784
#7  0x00007f7dcb2812de in start_thread () at /lib64/libpthread.so.0
#8  0x00007f7dcafb1a63 in clone () at /lib64/libc.so.6

Thread 6 (Thread 0x7f7da7fff700 (LWP 28346)):
#0  0x00007f7dcafa67e1 in poll () at /lib64/libc.so.6
#1  0x00007f7dc719288f in linux_udev_event_thread_main () at /lib64/libusb-1.0.so.0
#2  0x00007f7dcb2812de in start_thread () at /lib64/libpthread.so.0
#3  0x00007f7dcafb1a63 in clone () at /lib64/libc.so.6

Thread 5 (Thread 0x7f7d73fff700 (LWP 28584)):
#0  0x00007f7dcb2877da in pthread_cond_timedwait@@GLIBC_2.3.2 () at /lib64/libpthread.so.0
#1  0x00007f7dbe810303 in pt_TimedWait () at /lib64/libnspr4.so
#2  0x00007f7dbe8107be in PR_WaitCondVar () at /lib64/libnspr4.so
#3  0x00007f7dbe816efd in PR_Sleep () at /lib64/libnspr4.so
#4  0x00007f7dbea8c83b in secmod_HandleWaitForSlotEvent () at /lib64/libnss3.so
#5  0x00007f7dbea8ca5e in SECMOD_WaitForAnyTokenEvent () at /lib64/libnss3.so
#6  0x00007f7dc73a5dab in vcard_emul_event_thread () at /lib64/libcacard.so.0
#7  0x00007f7dbe816568 in _pt_root () at /lib64/libnspr4.so
#8  0x00007f7dcb2812de in start_thread () at /lib64/libpthread.so.0
#9  0x00007f7dcafb1a63 in clone () at /lib64/libc.so.6

Thread 4 (Thread 0x7f7da77fe700 (LWP 28347)):
#0  0x00007f7dcafa67e1 in poll () at /lib64/libc.so.6
#1  0x00007f7dc718bfc5 in handle_events.isra () at /lib64/libusb-1.0.so.0
#2  0x00007f7dc718d19b in libusb_handle_events_timeout_completed () at /lib64/libusb-1.0.so.0
#3  0x00007f7dc718d1f3 in libusb_handle_events () at /lib64/libusb-1.0.so.0
#4  0x00007f7dcc889659 in spice_usb_device_manager_usb_ev_thread (user_data=<optimized out>) at usb-device-manager.c:1143
#5  0x00007f7dcb875f9a in g_thread_proxy (data=0x55f58ff9e370) at gthread.c:784
#6  0x00007f7dcb2812de in start_thread () at /lib64/libpthread.so.0
#7  0x00007f7dcafb1a63 in clone () at /lib64/libc.so.6

Thread 3 (Thread 0x7f7dae24c700 (LWP 28345)):
#0  0x00007f7dcafa67e1 in poll () at /lib64/libc.so.6
#1  0x00007f7dcb84dbd6 in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x55f58fd25c10, timeout=<optimized out>, context=0x55f58fd24d00) at gmain.c:4203
#2  0x00007f7dcb84dbd6 in g_main_context_iterate (context=0x55f58fd24d00, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3897
#3  0x00007f7dcb84df92 in g_main_loop_run (loop=0x55f58fd25670) at gmain.c:4098
#4  0x00007f7dcbe3e8aa in gdbus_shared_thread_func (user_data=0x55f58fd24cd0) at gdbusprivate.c:275
#5  0x00007f7dcb875f9a in g_thread_proxy (data=0x55f58fd0f8f0) at gthread.c:784
#6  0x00007f7dcb2812de in start_thread () at /lib64/libpthread.so.0
#7  0x00007f7dcafb1a63 in clone () at /lib64/libc.so.6

Thread 2 (Thread 0x7f7daea4d700 (LWP 28344)):
#0  0x00007f7dcafa67e1 in poll () at /lib64/libc.so.6
--Type <RET> for more, q to quit, c to continue without paging--
#1  0x00007f7dcb84dbd6 in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x55f58fcecd40, timeout=<optimized out>, context=0x55f58fd12e70) at gmain.c:4203
#2  0x00007f7dcb84dbd6 in g_main_context_iterate (context=context@entry=0x55f58fd12e70, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3897
#3  0x00007f7dcb84dd00 in g_main_context_iteration (context=0x55f58fd12e70, may_block=may_block@entry=1) at gmain.c:3963
#4  0x00007f7dcb84dd51 in glib_worker_main (data=<optimized out>) at gmain.c:5772
#5  0x00007f7dcb875f9a in g_thread_proxy (data=0x55f58fd0f850) at gthread.c:784
#6  0x00007f7dcb2812de in start_thread () at /lib64/libpthread.so.0
#7  0x00007f7dcafb1a63 in clone () at /lib64/libc.so.6

Thread 1 (Thread 0x7f7dcf55e180 (LWP 28325)):
#0  0x00007f7dcaeec93f in raise () at /lib64/libc.so.6
#1  0x00007f7dcaed6c95 in abort () at /lib64/libc.so.6
#2  0x00007f7dcaf2fd57 in __libc_message () at /lib64/libc.so.6
#3  0x00007f7dcaf3668c in  () at /lib64/libc.so.6
#4  0x00007f7dcaf39a0c in _int_malloc () at /lib64/libc.so.6
#5  0x00007f7dcaf3a685 in _int_realloc () at /lib64/libc.so.6
#6  0x00007f7dcaf3ba1b in realloc () at /lib64/libc.so.6
#7  0x00007f7dcb8534fe in g_realloc (mem=0x55f590095660, n_bytes=64) at gmem.c:164
#8  0x00007f7dcb86fce7 in g_string_maybe_expand (string=0x55f58feac280, len=<optimized out>) at gstring.c:102
#9  0x00007f7dcb87003a in g_string_insert_len (string=0x55f58feac280, pos=<optimized out>, val=0x7ffd13eac030 "DEBUG", len=<optimized out>) at gstring.c:476
#10 0x00007f7dcb85517f in g_log_writer_format_fields (log_level=log_level@entry=G_LOG_LEVEL_DEBUG, fields=fields@entry=0x7ffd13eac200, n_fields=n_fields@entry=4, use_color=0) at gmessages.c:2321
#11 0x00007f7dcb8560e6 in g_log_writer_standard_streams (log_level=log_level@entry=G_LOG_LEVEL_DEBUG, fields=fields@entry=0x7ffd13eac200, n_fields=n_fields@entry=4, user_data=user_data@entry=0x0)
    at gmessages.c:2609
#12 0x00007f7dcb8561e6 in g_log_writer_default (log_level=log_level@entry=G_LOG_LEVEL_DEBUG, fields=fields@entry=0x7ffd13eac200, n_fields=n_fields@entry=4, user_data=user_data@entry=0x0) at gmessages.c:2713
#13 0x00007f7dcb8544e7 in g_log_structured_array (log_level=G_LOG_LEVEL_DEBUG, fields=0x7ffd13eac200, n_fields=4) at gmessages.c:1970
#14 0x00007f7dcb854931 in g_log_default_handler
    (log_domain=log_domain@entry=0x7f7dcc91bca0 "GSpice", log_level=log_level@entry=G_LOG_LEVEL_DEBUG, message=message@entry=0x55f5900e3f70 "spice-channel.c:141 inputs-3:0: spice_channel_constructed", unused_data=unused_data@entry=0x0) at gmessages.c:3158
#15 0x00007f7dcb854b7f in g_logv (log_domain=0x7f7dcc91bca0 "GSpice", log_level=G_LOG_LEVEL_DEBUG, format=<optimized out>, args=args@entry=0x7ffd13eac340) at gmessages.c:1370
#16 0x00007f7dcb854d73 in g_log (log_domain=log_domain@entry=0x7f7dcc91bca0 "GSpice", log_level=log_level@entry=G_LOG_LEVEL_DEBUG, format=format@entry=0x7f7dcc91ec7f "spice-channel.c:141 %s: %s")
    at gmessages.c:1432
#17 0x00007f7dcc86dff2 in spice_channel_constructed (gobject=0x55f58ffb7a60 [SpiceInputsChannel]) at spice-channel.c:141
#18 0x00007f7dcbb2ea3b in g_object_new_internal (class=class@entry=0x55f58ffae0e0, params=params@entry=0x7ffd13eac620, n_params=n_params@entry=3) at gobject.c:1839
#19 0x00007f7dcbb3078e in g_object_new_valist (object_type=<optimized out>, first_property_name=first_property_name@entry=0x7f7dcc91ea0f "spice-session", var_args=var_args@entry=0x7ffd13eac770) at gobject.c:2122
#20 0x00007f7dcbb30aed in g_object_new (object_type=object_type@entry=94513169884288, first_property_name=first_property_name@entry=0x7f7dcc91ea0f "spice-session") at gobject.c:1642
#21 0x00007f7dcc86e259 in spice_channel_new (s=0x55f58fd3f6a0 [SpiceSession], type=3, id=0) at spice-channel.c:2266
#22 0x00007f7dcc87d64b in _channel_new (c=c@entry=0x55f5900e1b50) at channel-main.c:1732
#23 0x00007f7dcb84a1db in g_idle_dispatch (source=0x55f58fed5990, callback=0x7f7dcc87d630 <_channel_new>, user_data=0x55f5900e1b50) at gmain.c:5534
#24 0x00007f7dcb84d89d in g_main_dispatch (context=0x55f58fd0c4c0) at gmain.c:3176
#25 0x00007f7dcb84d89d in g_main_context_dispatch (context=context@entry=0x55f58fd0c4c0) at gmain.c:3829
#26 0x00007f7dcb84dc68 in g_main_context_iterate (context=context@entry=0x55f58fd0c4c0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3902
#27 0x00007f7dcb84dd00 in g_main_context_iteration (context=context@entry=0x55f58fd0c4c0, may_block=may_block@entry=1) at gmain.c:3963
#28 0x00007f7dcbe116d5 in g_application_run (application=0x55f58fd08300 [RemoteViewer], argc=<optimized out>, argv=0x7ffd13eacb28) at gapplication.c:2470
#29 0x000055f58e943e60 in main (argc=7, argv=0x7ffd13eacb28) at remote-viewer-main.c:42

Comment 1 Fangge Jin 2019-03-14 10:41:19 UTC
virt-viewer version is: virt-viewer-7.0-3.el8.x86_64

Comment 2 Fangge Jin 2019-03-14 10:41:49 UTC
Created attachment 1543983 [details]
remote-viewer log

Comment 3 Victor Toso 2019-03-14 11:24:30 UTC
- How easy is for you to reproduce? I think I saw this before but wasn't easy to reproduce at the time.
- Also, logs from comment #2 does not have the critical messages from comment #0

Comment 4 Fangge Jin 2019-03-14 11:38:26 UTC
(In reply to Victor Toso from comment #3)
> - How easy is for you to reproduce? I think I saw this before but wasn't
> easy to reproduce at the time.
It can be reproduced 100% only if I repeating migration for 2 rounds.

> - Also, logs from comment #2 does not have the critical messages from
> comment #0

The critical messages are printed on screen.

Comment 5 Victor Toso 2019-05-23 10:43:45 UTC
I've just rebased spice-gtk, spice, spice-protocol for RHEL 8.1 plus some extra patches in virt-viewer too.
Could you please check if this is still reproducible?

Comment 6 Fangge Jin 2019-05-28 07:08:40 UTC
(In reply to Victor Toso from comment #5)
> I've just rebased spice-gtk, spice, spice-protocol for RHEL 8.1 plus some
> extra patches in virt-viewer too.
> Could you please check if this is still reproducible?

I'm busy with RHEL7.7 testing for now and don't have RHEL8 test env, I will check this when we start to test RHEL8.1

Comment 7 Fangge Jin 2019-08-08 06:12:47 UTC
Tried on RHEL8.1, remote-viewer still crashed during live migration, while the backtrace seems different.

Versions:
virt-viewer-7.0-5.el8.x86_64
spice-gtk3-0.37-1.el8.x86_64
spice-glib-0.37-1.el8.x86_64
spice-server-0.14.2-1.el8.x86_64
gtk3-3.22.30-3.el8.x86_64

Backtrace:
(gdb) t a a bt

Thread 7 (Thread 0x7f215f4cf700 (LWP 11217)):
#0  0x00007f217bc74211 in poll () at /lib64/libc.so.6
#1  0x00007f217c51b9b6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f217c51bae0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007f217c51bb31 in glib_worker_main () at /lib64/libglib-2.0.so.0
#4  0x00007f217c543d9a in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007f217bf4e2de in start_thread () at /lib64/libpthread.so.0
#6  0x00007f217bc7f133 in clone () at /lib64/libc.so.6

Thread 6 (Thread 0x7f215cc00700 (LWP 11234)):
#0  0x00007f217bc74211 in poll () at /lib64/libc.so.6
#1  0x00007f2177c1efc5 in handle_events.isra () at /lib64/libusb-1.0.so.0
#2  0x00007f2177c2019b in libusb_handle_events_timeout_completed () at /lib64/libusb-1.0.so.0
#3  0x00007f2177c201f3 in libusb_handle_events () at /lib64/libusb-1.0.so.0
#4  0x00007f217d560039 in spice_usb_device_manager_usb_ev_thread () at /lib64/libspice-client-glib-2.0.so.8
#5  0x00007f217c543d9a in g_thread_proxy () at /lib64/libglib-2.0.so.0
#6  0x00007f217bf4e2de in start_thread () at /lib64/libpthread.so.0
#7  0x00007f217bc7f133 in clone () at /lib64/libc.so.6

Thread 5 (Thread 0x7f212f7fe700 (LWP 11265)):
#0  0x00007f217bc7999d in syscall () at /lib64/libc.so.6
#1  0x00007f217c562b2e in g_cond_wait_until () at /lib64/libglib-2.0.so.0
#2  0x00007f217c4ee031 in g_async_queue_pop_intern_unlocked () at /lib64/libglib-2.0.so.0
#3  0x00007f217c4ee620 in g_async_queue_timeout_pop () at /lib64/libglib-2.0.so.0
#4  0x00007f217c544841 in g_thread_pool_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007f217c543d9a in g_thread_proxy () at /lib64/libglib-2.0.so.0
#6  0x00007f217bf4e2de in start_thread () at /lib64/libpthread.so.0
#7  0x00007f217bc7f133 in clone () at /lib64/libc.so.6

Thread 4 (Thread 0x7f215ecce700 (LWP 11218)):
#0  0x00007f217bc74211 in poll () at /lib64/libc.so.6
#1  0x00007f217c51b9b6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f217c51bd72 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#3  0x00007f217cb113ba in gdbus_shared_thread_func () at /lib64/libgio-2.0.so.0
#4  0x00007f217c543d9a in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007f217bf4e2de in start_thread () at /lib64/libpthread.so.0
#6  0x00007f217bc7f133 in clone () at /lib64/libc.so.6

Thread 3 (Thread 0x7f215d401700 (LWP 11233)):
#0  0x00007f217bc74211 in poll () at /lib64/libc.so.6
#1  0x00007f2177c2588f in linux_udev_event_thread_main () at /lib64/libusb-1.0.so.0
#2  0x00007f217bf4e2de in start_thread () at /lib64/libpthread.so.0
#3  0x00007f217bc7f133 in clone () at /lib64/libc.so.6

Thread 2 (Thread 0x7f215e2be700 (LWP 11220)):
#0  0x00007f217bc74211 in poll () at /lib64/libc.so.6
#1  0x00007f217c51b9b6 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#2  0x00007f217c51bae0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007f215e2c7e0d in dconf_gdbus_worker_thread () at /usr/lib64/gio/modules/libdconfsettings.so
#4  0x00007f217c543d9a in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007f217bf4e2de in start_thread () at /lib64/libpthread.so.0
#6  0x00007f217bc7f133 in clone () at /lib64/libc.so.6

Thread 1 (Thread 0x7f2180221cc0 (LWP 11211)):
--Type <RET> for more, q to quit, c to continue without paging--
#0  0x00007f217bbba8df in raise () at /lib64/libc.so.6
#1  0x00007f217bba4cf5 in abort () at /lib64/libc.so.6
#2  0x00007f217bbfdc17 in __libc_message () at /lib64/libc.so.6
#3  0x00007f217bc0453c in .annobin_top_check.start () at /lib64/libc.so.6
#4  0x00007f217bc07664 in _int_malloc () at /lib64/libc.so.6
#5  0x00007f217bc081be in _int_realloc () at /lib64/libc.so.6
#6  0x00007f217bc094ab in realloc () at /lib64/libc.so.6
#7  0x00007f217c52128e in g_realloc () at /lib64/libglib-2.0.so.0
#8  0x00007f217c7f679a in g_closure_add_invalidate_notifier () at /lib64/libgobject-2.0.so.0
#9  0x000055eb5e6cff34 in virt_viewer_signal_connect_object
    (instance=instance@entry=0x55eb5f4084b0, detailed_signal=detailed_signal@entry=0x55eb5e6ee6f0 "notify::monitors", c_handler=c_handler@entry=0x55eb5e6e4ab0 <virt_viewer_session_spice_display_monitors>, gobject=gobject@entry=0x55eb5f2bc0d0, connect_flags=connect_flags@entry=(unknown: 0)) at virt-viewer-util.c:237
#10 0x000055eb5e6e386d in virt_viewer_session_spice_channel_new (s=0x55eb5f510370, channel=0x55eb5f4084b0, session=0x55eb5f2bc0d0) at virt-viewer-session-spice.c:997
#11 0x00007f217c7f73bd in g_closure_invoke () at /lib64/libgobject-2.0.so.0
#12 0x00007f217c80a945 in signal_emit_unlocked_R () at /lib64/libgobject-2.0.so.0
#13 0x00007f217c813a06 in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0
#14 0x00007f217c814043 in g_signal_emit () at /lib64/libgobject-2.0.so.0
#15 0x00007f217d5424e9 in spice_channel_constructed () at /lib64/libspice-client-glib-2.0.so.8
#16 0x00007f217c7fd203 in g_object_new_internal () at /lib64/libgobject-2.0.so.0
#17 0x00007f217c7fef4e in g_object_new_valist () at /lib64/libgobject-2.0.so.0
#18 0x00007f217c7ff2ad in g_object_new () at /lib64/libgobject-2.0.so.0
#19 0x00007f217d542719 in spice_channel_new () at /lib64/libspice-client-glib-2.0.so.8
#20 0x00007f217d552dab in _channel_new () at /lib64/libspice-client-glib-2.0.so.8
#21 0x00007f217c517fbb in g_idle_dispatch () at /lib64/libglib-2.0.so.0
#22 0x00007f217c51b67d in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#23 0x00007f217c51ba48 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#24 0x00007f217c51bae0 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#25 0x00007f217cae402d in g_application_run () at /lib64/libgio-2.0.so.0
#26 0x000055eb5e6ccec0 in main (argc=7, argv=0x7fff9bbdbde8) at remote-viewer-main.c:42
(gdb)

Comment 8 Fangge Jin 2019-08-30 09:51:30 UTC
This bug blocks the spice migration test, could you fix it as soon as possible?

Comment 9 Victor Toso 2019-08-30 12:40:11 UTC
> #0  0x00007f217bbba8df in raise () at /lib64/libc.so.6
> #1  0x00007f217bba4cf5 in abort () at /lib64/libc.so.6
> #2  0x00007f217bbfdc17 in __libc_message () at /lib64/libc.so.6
> #3  0x00007f217bc0453c in .annobin_top_check.start () at /lib64/libc.so.6
> #4  0x00007f217bc07664 in _int_malloc () at /lib64/libc.so.6
> #5  0x00007f217bc081be in _int_realloc () at /lib64/libc.so.6
> #6  0x00007f217bc094ab in realloc () at /lib64/libc.so.6
> #7  0x00007f217c52128e in g_realloc () at /lib64/libglib-2.0.so.0
> #8  0x00007f217c7f679a in g_closure_add_invalidate_notifier () at /lib64/libgobject-2.0.so.0
> #9  0x000055eb5e6cff34 in virt_viewer_signal_connect_object

Quite similar to bug 1746239 so that one might be a DUP of this one. I'm looking at it...

Comment 10 Victor Toso 2019-09-04 12:51:13 UTC
So, I was able to report bug 1695618 and was a bit focused on fixing that as I reproduced.
In several migration tests I've been doing, didn't see this nor the bug 1746239 - The reason might that I'm using Fedora instead of RHEL 8 client.

Either way, those errors don't seem specific to Spice but something around the system. Could you please run with valgrind and attach the report after the crash?

Comment 12 yafu 2019-09-24 04:15:22 UTC
Hi Victor,

There is rr traces in https://bugzilla.redhat.com/show_bug.cgi?id=1746239#c12. Do you still need the report with valgrind?

Comment 13 Victor Toso 2019-09-24 08:00:09 UTC
Hi Yafu, thanks for the ping.

I'm unable to ping the machine with rr traces at this time.

Comment 14 Victor Toso 2019-12-16 14:45:39 UTC
Similar to Bug 1746239, not yet reproducer + fix. Moving.

Comment 31 errata-xmlrpc 2020-11-04 04:07:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (spice-gtk bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:4817