Gdk.keyval_name() crashes with free(): invalid pointer: 0x00007f4d337de806

Bug #732484 reported by Martin Pitt
58
This bug affects 7 people
Affects Status Importance Assigned to Milestone
gtk+2.0 (Ubuntu)
Fix Released
Medium
Unassigned
language-selector (Ubuntu)
Fix Released
Medium
Martin Pitt

Bug Description

Binary package hint: language-selector

Reproducer:

 - Open gnome-language-selector
 - press Escape

ProblemType: Crash
DistroRelease: Ubuntu 11.04
Package: language-selector-gnome 0.25
ProcVersionSignature: Ubuntu 2.6.38-6.34-generic 2.6.38-rc7
Uname: Linux 2.6.38-6-generic x86_64
Architecture: amd64
AssertionMessage: *** glibc detected *** /usr/bin/python: free(): invalid pointer: 0x00007f4d337de806 ***
Date: Thu Mar 10 11:05:19 2011
EcryptfsInUse: Yes
ExecutablePath: /usr/bin/gnome-language-selector
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Alpha amd64 (20110302)
InterpreterPath: /usr/bin/python2.7
PackageArchitecture: all
ProcCmdline: /usr/bin/python /usr/bin/gnome-language-selector
ProcEnviron:
 SHELL=/bin/bash
 PATH=(custom, user)
 LANG=de_DE.UTF-8
 LANGUAGE=de_DE:de:en
Signal: 6
SourcePackage: language-selector
StacktraceTop:
 raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
 abort () at abort.c:92
 __libc_message (do_abort=2, fmt=0x7f4d38edd470 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
 malloc_printerr (av=<value optimized out>, p=0x7f4d337de7f6) at malloc.c:6283
 _int_free (av=<value optimized out>, p=0x7f4d337de7f6) at malloc.c:4795
Title: gnome-language-selector assert failure: *** glibc detected *** /usr/bin/python: free(): invalid pointer: 0x00007f4d337de806 ***
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm admin dialout lpadmin sambashare

Revision history for this message
Martin Pitt (pitti) wrote :
Changed in language-selector (Ubuntu):
importance: Undecided → High
status: New → Confirmed
assignee: nobody → Martin Pitt (pitti)
Revision history for this message
Apport retracing service (apport) wrote :

StacktraceTop:
 raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
 abort () at abort.c:92
 __libc_message (do_abort=2, fmt=0x7f4d38edd470 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
 malloc_printerr (av=<value optimized out>, p=0x7f4d337de7f6) at malloc.c:6283
 _int_free (av=<value optimized out>, p=0x7f4d337de7f6) at malloc.c:4795

Revision history for this message
Apport retracing service (apport) wrote : Stacktrace.txt
Revision history for this message
Apport retracing service (apport) wrote : ThreadStacktrace.txt
Changed in language-selector (Ubuntu):
importance: High → Medium
tags: removed: need-amd64-retrace
Martin Pitt (pitti)
visibility: private → public
Changed in language-selector (Ubuntu):
status: Confirmed → Triaged
Martin Pitt (pitti)
description: updated
Revision history for this message
Martin Pitt (pitti) wrote : Re: gnome-language-selector assert failure: *** glibc detected *** /usr/bin/python: free(): invalid pointer: 0x00007f4d337de806 ***

I tracked this down to:

    @honorBlockedSignals
    def on_window_main_key_press_event(self, widget, event):
        keyname = Gdk.keyval_name(event.keyval)

The crash happens on Gdk.keyval_name(). This doesn't happen when running against GTK3, so at some point this got fixed in GTK:

$ python -c 'from gi.repository import Gdk; print Gdk.keyval_name(65307)'
Escape

$ python -c "import gi; gi.require_version('Gdk', '2.0'); from gi.repository import Gdk; print Gdk.keyval_name(65307)"
*** glibc detected *** python: free(): invalid pointer: 0x00007f0347b21806 ***

Changed in gtk+2.0 (Ubuntu):
importance: Undecided → Medium
status: New → Triaged
Revision history for this message
Martin Pitt (pitti) wrote :

I'm keeping the language-selector task open because I noticed another bug unrelated to the crash: the "add/remove" dialog isn't transient, it's just a normal window.

summary: - gnome-language-selector assert failure: *** glibc detected ***
- /usr/bin/python: free(): invalid pointer: 0x00007f4d337de806 ***
+ Gdk.keyval_name() crashes with free(): invalid pointer:
+ 0x00007f4d337de806
Changed in gtk+2.0 (Ubuntu):
status: Triaged → In Progress
Revision history for this message
Martin Pitt (pitti) wrote :

I fixed the crash in trunk: http://git.gnome.org/browse/gtk+/commit/?h=gtk-2-24

This now uncovers the next crash, but that's better "defined":

Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/LanguageSelector/gtk/GtkLanguageSelector.py", line 70, in wrapper
    res = f(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/LanguageSelector/gtk/GtkLanguageSelector.py", line 1095, in on_window_main_key_press_event
    if (event.get_state() & Gdk.EventMask.CONTROL_MASK):
AttributeError: type object 'GdkEventMask' has no attribute 'CONTROL_MASK'

(this also doesn't happen with GTK3).

Changed in gtk+2.0 (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Martin Pitt (pitti) wrote :

The CONTROL_MASK crash is an actual bug in language-selector, fixed in bzr.

Changed in language-selector (Ubuntu):
status: Triaged → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package language-selector - 0.26

---------------
language-selector (0.26) natty; urgency=low

  * LanguageSelector/gtk/GtkLanguageSelector.py: Fix CONTROL_MASK constant.
    This brings back Ctrl+W to close the window. (LP: #732484)
 -- Martin Pitt <email address hidden> Thu, 10 Mar 2011 15:28:57 +0100

Changed in language-selector (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gtk+2.0 - 2.24.1-1ubuntu3

---------------
gtk+2.0 (2.24.1-1ubuntu3) natty; urgency=low

  * Add 000git_GI-gdk_keyval_name.patch: Fix gdk_keyval_name() and
    gdk_keyval_from_name() annotations. (LP: #732484)
 -- Martin Pitt <email address hidden> Thu, 10 Mar 2011 15:56:10 +0100

Changed in gtk+2.0 (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.