This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 492296 - amsn (and maybe other tcl/tk apps) does not start when imsettings-applet is running
amsn (and maybe other tcl/tk apps) does not start when imsettings-applet is r...
Status: CLOSED DUPLICATE of bug 485595
Product: Fedora
Classification: Fedora
Component: amsn (Show other bugs)
10
All Linux
low Severity medium
: ---
: ---
Assigned To: Sander Hoentjen
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-26 07:20 EDT by Fernando Herrera
Modified: 2009-03-26 15:09 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-03-26 15:09:43 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Patch fixing the double free of error variable (428 bytes, patch)
2009-03-26 15:01 EDT, Fernando Herrera
no flags Details | Diff

  None (edit)
Description Fernando Herrera 2009-03-26 07:20:28 EDT
Description of problem:

When imsettings-applet is running (under LANG=es_ES.UTF-8, with US keyboard) amsn hangs at start.


Steps to Reproduce:
[fer@gintonic ~]$ imsettings-applet &
[1] 32407
[fer@gintonic ~]$ Acceleration key: disabled
XSETTINGS manager support is enabled, but another XSETTINGS manager instance is already running.

[fer@gintonic ~]$ gdb --args wish /usr/bin/amsn
GNU gdb Fedora (6.8-29.fc10)
[...]
(gdb) r
Starting program: /usr/bin/wish /usr/bin/amsn
[...]
(imsettings-applet:32407): libimsettings-xim-WARNING **: Child sequence won't be matched.: <Multi_key> <apostrophe> <comma> <C>	

(imsettings-applet:32407): libimsettings-xim-WARNING **: Child sequence won't be matched.: <Multi_key> <apostrophe> <cedilla> <C>	: "Ḉ" U1E08 # LATIN CAPITAL LETTER C WITH CEDILLA AND ACUTE


(imsettings-applet:32407): libimsettings-xim-WARNING **: : <dead_acute> <ccedilla>          	: "ḉ"   U1E09 # LATIN SMALL LETTER C WITH CEDILLA AND ACUTE

*** glibc detected *** imsettings-applet: free(): invalid pointer: 0x0860b600 ***

[HANG FOREVER HERE... pressing Control+C]


Program received signal SIGINT, Interrupt.
0x003f1416 in __kernel_vsyscall ()
(gdb) bt
#0  0x003f1416 in __kernel_vsyscall ()
#1  0x008f039d in ___newselect_nocancel () from /lib/libc.so.6
#2  0x00553295 in ?? () from /usr/lib/libxcb.so.1
#3  0x0055493f in xcb_wait_for_event () from /usr/lib/libxcb.so.1
#4  0x0048b8a1 in ?? () from /usr/lib/libX11.so.6
#5  0x0048bc10 in ?? () from /usr/lib/libX11.so.6
#6  0x0048c3d7 in _XReadEvents () from /usr/lib/libX11.so.6
#7  0x0046a353 in XIfEvent () from /usr/lib/libX11.so.6
#8  0x004b93ca in ?? () from /usr/lib/libX11.so.6
#9  0x004b84c4 in ?? () from /usr/lib/libX11.so.6
#10 0x004b8887 in _XimRead () from /usr/lib/libX11.so.6
#11 0x004a7aa8 in ?? () from /usr/lib/libX11.so.6
#12 0x004a8865 in _XimProtoOpenIM () from /usr/lib/libX11.so.6
#13 0x004ae41d in _XimOpenIM () from /usr/lib/libX11.so.6
#14 0x004923da in XOpenIM () from /usr/lib/libX11.so.6
#15 0x007ca851 in TkpOpenDisplay () from /usr/lib/libtk8.5.so
#16 0x00730804 in ?? () from /usr/lib/libtk8.5.so
#17 0x00730f65 in TkCreateMainWindow () from /usr/lib/libtk8.5.so
#18 0x0073b9fc in ?? () from /usr/lib/libtk8.5.so
#19 0x0073bce2 in TkCreateFrame () from /usr/lib/libtk8.5.so
#20 0x0072eb1f in ?? () from /usr/lib/libtk8.5.so
#21 0x0804878f in Tcl_AppInit ()
#22 0x0071f724 in Tk_MainEx () from /usr/lib/libtk8.5.so
#23 0x0804884b in main ()

  
Actual results:

amsn does not start

Expected results:

When imsettings-applet is killed, amsn can be started normally


Additional info:
Comment 1 Sander Hoentjen 2009-03-26 14:29:53 EDT
I cannot reproduce the crash on current rawhide, so testing is a bit hard for me.
Can you reproduce the crash with just running `wish` instead of `wish /usr/bin/amsn`?
Comment 2 Fernando Herrera 2009-03-26 14:43:30 EDT
It is not a crash, just imsettings-applet getting a double free and wish hanging (not crashing, the backtrace was generated after interrupting wish process).

Here is the trace of imsettings-applet with abort on doublefree:
[fer@gintonic UPnP-Inspector.svn]$ export MALLOC_CHECK_=2
[fer@gintonic UPnP-Inspector.svn]$ gdb imsettings-applet 
GNU gdb Fedora (6.8-29.fc10)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
(gdb) r
Starting program: /usr/bin/imsettings-applet 
[Thread debugging using libthread_db enabled]
[New Thread 0xb7fdc720 (LWP 22240)]
Acceleration key: disabled
XSETTINGS manager support is enabled, but another XSETTINGS manager instance is already running.

(imsettings-applet:22240): libimsettings-xim-WARNING **: Child sequence won't be matched.: <Multi_key> <apostrophe> <comma> <C>	

(imsettings-applet:22240): libimsettings-xim-WARNING **: Child sequence won't be matched.: <Multi_key> <apostrophe> <cedilla> <C>	: "Ḉ" U1E08 # LATIN CAPITAL LETTER C WITH CEDILLA AND ACUTE


(imsettings-applet:22240): libimsettings-xim-WARNING **: \x90a\xb8: <dead_acute> <ccedilla>          	: "ḉ"   U1E09 # LATIN SMALL LETTER C WITH CEDILLA AND ACUTE


Program received signal SIGABRT, Aborted.
0x00396416 in __kernel_vsyscall ()
(gdb) bt
#0  0x00396416 in __kernel_vsyscall ()
#1  0x00a40460 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0x00a41e28 in abort () at abort.c:88
#3  0x00a843d3 in malloc_printerr (action=2, str=0xb55d28 "free(): invalid pointer", ptr=0x810d7a0) at malloc.c:5999
#4  0x00a862f5 in __libc_free (mem=0x810d7a0) at malloc.c:3589
#5  0x0018a8c6 in IA__g_free (mem=0x810d7a0) at gmem.c:190
#6  0x001720b9 in IA__g_error_free (error=0x80e1660) at gerror.c:125
#7  0x00934828 in compose_parse (compose=0x80de4c0) at compose.c:571
#8  0x00936d96 in xim_loopback_real_xim_open (proto=0x8073890, locale=0x80e2740, data=0x80d3820) at loopback.c:346
#9  0x009e43b6 in gxim_marshal_BOOLEAN__BOXED (closure=0x80de418, return_value=0xbfffe988, n_param_values=2, param_values=0x80e2648, 
    invocation_hint=0x0, marshal_data=0x936bc0) at gximmarshal.c:161
#10 0x005781fb in IA__g_closure_invoke (closure=0x80de418, return_value=0xbfffe988, n_param_values=2, param_values=0x80e2648, 
    invocation_hint=0x0) at gclosure.c:767
#11 0x009cba12 in g_xim_protocol_closure_emit_signal (closure=0x80df740, proto=0x8073890) at gximprotocol.c:3537
#12 0x009dbe8e in g_xim_protocol10_closure_XIM_OPEN (closure=0x80df740, proto=0x8073890, stream=0x80bb850, error=0xbfffebe8, user_data=0x0)
    at gximprotocol10.c:262
#13 0x009cbcea in g_xim_protocol_closure_marshal_BOOLEAN__OBJECT_OBJECT_POINTER (closure=0x80df740, return_value=0xbfffeb38, 
    n_param_values=3, param_values=0x80e24c0, invocation_hint=0x0, marshal_data=0x0) at gximprotocol.c:244
#14 0x005781fb in IA__g_closure_invoke (closure=0x80df740, return_value=0xbfffeb38, n_param_values=3, param_values=0x80e24c0, 
    invocation_hint=0x0) at gclosure.c:767
#15 0x009d4079 in g_xim_protocol_translate (proto=0x8073890, data=0x80e24a0, length=20, error=0xbfffebe8) at gximprotocol.c:669
#16 0x009d4596 in g_xim_protocol_process_event (proto=0x8073890, event=0x80720f0, error=0xbfffebe8) at gximprotocol.c:513
#17 0x009e061e in g_xim_srv_tmpl_real_client_event (core=0x80d3820, event=0x80720f0) at gximsrvtmpl.c:684
#18 0x009e43b6 in gxim_marshal_BOOLEAN__BOXED (closure=0x80c39f0, return_value=0xbfffedc0, n_param_values=2, param_values=0x80d6d18, 
    invocation_hint=0xbfffedac, marshal_data=0x9e05a0) at gximmarshal.c:161
#19 0x00576959 in g_type_class_meta_marshal (closure=0x80c39f0, return_value=0xbfffedc0, n_param_values=2, param_values=0x80d6d18, 
    invocation_hint=0xbfffedac, marshal_data=0x60) at gclosure.c:878
#20 0x005781fb in IA__g_closure_invoke (closure=0x80c39f0, return_value=0xbfffedc0, n_param_values=2, param_values=0x80d6d18, 
    invocation_hint=0xbfffedac) at gclosure.c:767
#21 0x0058e2fd in signal_emit_unlocked_R (node=0x80c3aa8, detail=0, instance=0x80d3820, emission_return=0xbfffeef8, 
    instance_and_params=0x80d6d18) at gsignal.c:3282
#22 0x0058fbeb in IA__g_signal_emit_valist (instance=0x80d3820, signal_id=165, detail=0, var_args=0xbfffef50 "h���\2301\a\bx���\"�W")
    at gsignal.c:2987
#23 0x005901e6 in IA__g_signal_emit (instance=0x80d3820, signal_id=165, detail=0) at gsignal.c:3034
#24 0x009c0055 in g_xim_core_dispatch_events (gdk_xevent=0xbffff1e8, event=0x8072190, data=0x80d3820) at gximcore.c:188
#25 0x008dd469 in gdk_event_apply_filters () at gdkevents-x11.c:349
---Type <return> to continue, or q <return> to quit---
#26 gdk_event_translate (display=0x806d0b8, event=0x8072190, xevent=0xbffff1e8, return_exposes=0) at gdkevents-x11.c:988
#27 0x008deeb3 in _gdk_events_queue (display=0x806d0b8) at gdkevents-x11.c:2299
#28 0x008df2df in gdk_event_dispatch (source=0x8074118, callback=0, user_data=0x0) at gdkevents-x11.c:2359
#29 0x00182238 in g_main_dispatch () at gmain.c:2144
#30 IA__g_main_context_dispatch (context=0x8074f48) at gmain.c:2697
#31 0x001858e3 in g_main_context_iterate (context=0x8074f48, block=1, dispatch=1, self=0x8080c48) at gmain.c:2778
#32 0x00185e02 in IA__g_main_loop_run (loop=0x80d35e0) at gmain.c:2986
#33 0x06c97959 in IA__gtk_main () at gtkmain.c:1200
#34 0x0804ecbe in main (argc=Cannot access memory at address 0x2e3
Comment 3 Fernando Herrera 2009-03-26 14:51:29 EDT
maybe this? (not tested):
--- compose.c.orig	2009-03-26 19:49:06.000000000 +0100
+++ compose.c	2009-03-26 19:49:41.000000000 +0100
@@ -590,6 +590,7 @@
 				if (error) {
 					g_warning("%s: %s", error->message, seq);
 					sequence_free(s);
+					g_error_free(error);
 					goto fail;
 				}
 				node = s;
@@ -625,6 +626,7 @@
 			g_ptr_array_free(seqarray, TRUE);
 		}
 		g_free(tmp);
+		error = NULL;
 	}
 
 	return TRUE;
Comment 4 Fernando Herrera 2009-03-26 15:00:47 EDT
yeah, just rebuild the RPM with the above patch and now wish and amsn work fine (however I still get a lot of output from imsettings-applet, so there is still something that is not correctly parsed (but at least now it doesn't trash the application).

Attaching the patch.
Comment 5 Fernando Herrera 2009-03-26 15:01:48 EDT
Created attachment 336870 [details]
Patch fixing the double free of error variable
Comment 6 Fernando Herrera 2009-03-26 15:09:43 EDT
ok, looking at trunk, it seems it has been fixed there (clearing the error instead of freeing+setting to NULL):

http://code.google.com/p/imsettings/source/diff?spec=svn257&r=257&format=side&path=/trunk/backends/xim/compose.c

I also find this bug is a dup of #485595 and a new update for this package has been pushed :)

*** This bug has been marked as a duplicate of bug 485595 ***

Note You need to log in before you can comment on or make changes to this bug.