Bug 908437

Created attachment 694035 [details]
File: maps

Created attachment 694036 [details]
File: var_log_messages

Created attachment 694037 [details]
File: open_fds

Created attachment 694038 [details]
File: environ

Created attachment 694039 [details]
File: dso_list

Created attachment 694040 [details]
File: limits

Created attachment 694041 [details]
File: sosreport.tar.xz

Created attachment 694042 [details]
File: backtrace

Created attachment 694043 [details]
File: build_ids

Created attachment 694044 [details]
File: cgroup

Please describe what you did before the crash happened. Thanks!

Unfortunately, I didn't notice exact cause or reproducer, I'd have filed it otherwise. In general, I was editing photos: mainly using curves and few filters, some of them wavelet-based .scm ones.

Here's what little I can make out of the backtrace (sorry, Intel assembly is not my forte):

This is the function where the segfault happens, it crashes in the "check = ..." line:

--- 8< --- gobject/gtype.c:3697 --- glib2-2.22.5-7.el6 ---
gboolean
g_type_check_instance_is_a (GTypeInstance *type_instance,
                GType          iface_type)
{ 
  TypeNode *node, *iface;
  gboolean check; 

  if (!type_instance || !type_instance->g_class)
    return FALSE;

  node = lookup_type_node_I (type_instance->g_class->g_type);
  iface = lookup_type_node_I (iface_type);
  check = node && node->is_instantiatable && iface && type_node_conforms_to_U (node, iface, TRUE, FALSE); <===== crashes
  
  return check;
}
--- >8 --------------------------------------------------

Variable values:

        node = 0x23a4e0073746e64
        iface = 0x2d0f9c0
        check = 70836928

This is the corresponding assembly instruction...

=> 0x00000036ac626170 <+128>:	testb  $0x40,0xb(%rbx)

...and value of the rbx register:

rbx            0x23a4e0073746e64	160526500569050724

==> rbx holds the node variable which is a TypeNode. Because it uses an offset ("0xb(%rbx)") and picks a bit out of the byte ("$0x40") I'm pretty sure that it's tripping over "node->is_instantiatable" (which is a bit field) here, and I wouldn't be surprised if node is pointing to an invalid location (thus the segfault). The TypeNode type is private to gtype.c/glib2 however and as I have no idea about what it does I'll change the component to glib2 for further assessment.

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Red Hat Enterprise Linux 6 is in the Production 3 Phase. During the Production 3 Phase, Critical impact Security Advisories (RHSAs) and selected Urgent Priority Bug Fix Advisories (RHBAs) may be released as they become available.

The official life cycle policy can be reviewed here:

http://redhat.com/rhel/lifecycle

This issue does not meet the inclusion criteria for the Production 3 Phase and will be marked as CLOSED/WONTFIX. If this remains a critical requirement, please contact Red Hat Customer Support to request a re-evaluation of the issue, citing a clear business justification. Note that a strong business justification will be required for re-evaluation. Red Hat Customer Support can be contacted via the Red Hat Customer Portal at the following URL:

https://access.redhat.com/