crash at startup after showing offline messages from a large group chat

[gaborigloi]

I'm in a large group chat with 50 participants, and I've enabled showing unread messages. Sometimes when I start Pidgin and there are some new messages from that conversation, Pidgin shows those offline messages and then crashes. I disabled all plugins in Tools->Plug-ins.

Part of the backtrace is:

(16:32:38) http: Got main header with code 200
(16:32:38) http: Got header: Last-Modified: Thu, 19 Dec 2013 22:33:13 GMT
(16:32:38) http: Got header: Content-Type: image/png
(16:32:38) http: Got header: Timing-Allow-Origin: *
(16:32:38) http: Got header: Access-Control-Allow-Origin: *
(16:32:38) http: Got header: Expires: Sat, 14 Nov 2015 01:10:08 GMT
(16:32:38) http: Got header: Cache-Control: max-age=1209600, no-transform
(16:32:38) http: Got header: Date: Thu, 05 Nov 2015 16:33:20 GMT
(16:32:38) http: Got header: Connection: keep-alive
(16:32:38) http: Got header: Content-Length: 3092
(16:32:38) http: Got headers end
(16:32:38) http: Got response headers: Last-Modified: Thu, 19 Dec 2013 22:33:13 GMT
Content-Type: image/png
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Expires: Sat, 14 Nov 2015 01:10:08 GMT
Cache-Control: max-age=1209600, no-transform
Date: Thu, 05 Nov 2015 16:33:20 GMT
Connection: keep-alive
Content-Length: 3092
(16:32:38) http: releasing a socket: 0x555556574970
(16:32:38) http: Request 0x5555568e4c10 performed successfully.
[New Thread 0x7fffcffff700 (LWP 8244)]
[New Thread 0x7fffcf7fe700 (LWP 8245)]

Program received signal SIGABRT, Aborted.
0x00007ffff4953107 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#0  0x00007ffff4953107 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff49544e8 in __GI_abort () at abort.c:89
#2  0x00007ffff4991204 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7ffff4a83fe0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff49969de in malloc_printerr (action=1, str=0x7ffff4a8009e "free(): invalid pointer", ptr=<optimized out>) at malloc.c:4996
#4  0x00007ffff49976e6 in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840
#5  0x00007fffecd6b493 in fb_cb_image (img=<optimized out>, error=<optimized out>) at facebook.c:448
#6  0x00007fffecd6a33c in fb_data_image_cb (con=<optimized out>, res=0x5555565eaea0, data=0x5555567fed00) at data.c:540
#7  0x00007fffecd73c7b in purple_http_connection_terminate (hc=0x5555568e4c10) at ../../http.c:1695

[jgeboski]

Thanks for the trace! What version of the plugin are you running?

[gaborigloi]

The latest git version.

[gaborigloi]

6a0a79182ebc

[gaborigloi]

It seems that Pidgin crashes only when the offline group messages contain images. Pidgin never crashed at start-up when the unread messages from the group chat contained no images.

[jgeboski]

I am unable to recreate this. Was there a certain type of image that was causing it? Do you have any other third party plugins?

[gaborigloi]

It crashes for almost all images, JPEG and GIF alike. I use Debian Jessie and Pidgin 2.10.11. This report seems to be similar: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=544099#17 SkypeWeb and "Media Emblems" are the only third-party plugins I use, I'll remove them and see if the problem still persists.

[jgeboski]

Could you please try the latest release? There is a patch in there that may resolve this issue.

[gaborigloi]

Thanks, I've now installed that release :), I'll let you know if there is a crash again.

[jgeboski]

Any update on this issue?

[gaborigloi]

A crash happened again when there were some offline/unread messages with images from that group chat. Interestingly, it seems that Pidgin can show offline messages with images from individual people. Here is part of the trace:

(16:32:03) http: Generated request headers:
GET /hphotos-xfa1/t39.1997-6/p128x128/851568_652574598098020_44145696_n.png HTTP/1.1
Host: scontent.xx.fbcdn.net
Connection: Keep-Alive
Accept: */*
Accept-Encoding: gzip, deflate

(16:32:03) http: Generated request headers:
GET /hphotos-xfa1/t39.1997-6/p128x128/851568_652574598098020_44145696_n.png HTTP/1.1
Host: scontent.xx.fbcdn.net
Connection: Keep-Alive
Accept: */*
Accept-Encoding: gzip, deflate

(16:32:03) http: Generated request headers:
GET /hphotos-xfa1/t39.1997-6/p128x128/851568_652574598098020_44145696_n.png HTTP/1.1
Host: scontent.xx.fbcdn.net
Connection: Keep-Alive
Accept: */*
Accept-Encoding: gzip, deflate

(16:32:03) http: Generated request headers:
GET /hphotos-xfa1/t39.1997-6/p128x128/851568_652574598098020_44145696_n.png HTTP/1.1
Host: scontent.xx.fbcdn.net
Connection: Keep-Alive
Accept: */*
Accept-Encoding: gzip, deflate

(16:32:03) http: Got main header with code 200
(16:32:03) http: Got header: Last-Modified: Mon, 25 Nov 2013 17:55:36 GMT
(16:32:03) http: Got header: Content-Type: image/png
(16:32:03) http: Got header: Timing-Allow-Origin: *
(16:32:03) http: Got header: Access-Control-Allow-Origin: *
(16:32:03) http: Got header: Expires: Fri, 01 Jan 2016 19:44:37 GMT
(16:32:03) http: Got header: Cache-Control: max-age=1209600, no-transform
(16:32:03) http: Got header: Date: Fri, 25 Dec 2015 15:34:57 GMT
(16:32:03) http: Got header: Connection: keep-alive
(16:32:03) http: Got header: Content-Length: 18523
(16:32:03) http: Got headers end
(16:32:03) http: Got main header with code 200
(16:32:03) http: Got header: Last-Modified: Mon, 25 Nov 2013 17:55:36 GMT
(16:32:03) http: Got header: Content-Type: image/png
(16:32:03) http: Got header: Timing-Allow-Origin: *
(16:32:03) http: Got header: Access-Control-Allow-Origin: *
(16:32:03) http: Got header: Expires: Fri, 01 Jan 2016 19:44:37 GMT
(16:32:03) http: Got header: Cache-Control: max-age=1209600, no-transform
(16:32:03) http: Got header: Date: Fri, 25 Dec 2015 15:34:57 GMT
(16:32:03) http: Got header: Connection: keep-alive
(16:32:03) http: Got header: Content-Length: 18523
(16:32:03) http: Got headers end
(16:32:03) http: Got main header with code 200
(16:32:03) http: Got header: Last-Modified: Mon, 25 Nov 2013 17:55:36 GMT
(16:32:03) http: Got header: Content-Type: image/png
(16:32:03) http: Got header: Timing-Allow-Origin: *
(16:32:03) http: Got header: Access-Control-Allow-Origin: *
(16:32:03) http: Got header: Expires: Fri, 01 Jan 2016 19:44:37 GMT
(16:32:03) http: Got header: Cache-Control: max-age=1209600, no-transform
(16:32:03) http: Got header: Date: Fri, 25 Dec 2015 15:34:57 GMT
(16:32:03) http: Got header: Connection: keep-alive
(16:32:03) http: Got header: Content-Length: 18523
(16:32:03) http: Got headers end
(16:32:03) http: Got main header with code 200
(16:32:03) http: Got header: Last-Modified: Mon, 25 Nov 2013 17:55:36 GMT
(16:32:03) http: Got header: Content-Type: image/png
(16:32:03) http: Got header: Timing-Allow-Origin: *
(16:32:03) http: Got header: Access-Control-Allow-Origin: *
(16:32:03) http: Got header: Expires: Fri, 01 Jan 2016 19:44:37 GMT
(16:32:03) http: Got header: Cache-Control: max-age=1209600, no-transform
(16:32:03) http: Got header: Date: Fri, 25 Dec 2015 15:34:57 GMT
(16:32:03) http: Got header: Connection: keep-alive
(16:32:03) http: Got header: Content-Length: 18523
(16:32:03) http: Got headers end
(16:32:03) http: Got response headers: Last-Modified: Mon, 25 Nov 2013 17:55:36 GMT
Content-Type: image/png
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Expires: Fri, 01 Jan 2016 19:44:37 GMT
Cache-Control: max-age=1209600, no-transform
Date: Fri, 25 Dec 2015 15:34:57 GMT
Connection: keep-alive
Content-Length: 18523
(16:32:03) http: releasing a socket: 0x555556411c90
(16:32:03) http: Request 0x555556643300 performed successfully.
[New Thread 0x7fffcffff700 (LWP 5358)]
[New Thread 0x7fffcf7fe700 (LWP 5359)]
[Thread 0x7fffcffff700 (LWP 5358) exited]
[Thread 0x7fffd50f3700 (LWP 5357) exited]
[Thread 0x7fffd797d700 (LWP 5355) exited]

Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0x636341203a726564) at malloc.c:2929
#0  __GI___libc_free (mem=0x636341203a726564) at malloc.c:2929
#1  0x00007fffecf6d723 in fb_cb_image (img=<optimized out>, error=<optimized out>) at facebook.c:448
#2  0x00007fffecf6c5fd in fb_data_image_cb (con=0x555556643300, res=0x555555e74250, data=0x5555568e6a20) at data.c:547
#3  0x00007fffecf760db in purple_http_connection_terminate (hc=0x555556643300) at ../../http.c:1688
#4  0x00007fffecf78408 in _purple_http_recv_loopbody (hc=hc@entry=0x555556643300, fd=<optimized out>) at ../../http.c:1260
#5  0x00007fffecf788e0 in _purple_http_recv (_hc=0x555556643300, fd=<optimized out>, cond=cond@entry=PURPLE_INPUT_READ) at ../../http.c:1271
#6  0x00005555555c930e in pidgin_io_invoke (source=<optimized out>, condition=<optimized out>, data=0x555556955650) at /tmp/buildd/pidgin-2.10.11/./pidgin/gtkeventloop.c:73

[jgeboski]

I am still unable to recreate this. It looks like it is happening with stickers? Only stickers? Could you send me a debugging log?

[gaborigloi]

It seems to crash with all types of images. I've emailed the debug logs to you.

[jgeboski]

I have tried several times to recreate this over the last week, without any luck. I have even tried to recreate it on Debian Jessie, again, without luck. Would you be able to send me a valgrind report?

[gaborigloi]

I'll send you a valgrind report when the crash happens again.

[jgeboski]

Thanks!

[dequis]

0 __GI___libc_free (mem=0x636341203a726564) at malloc.c:2929

It says der: Acc

[jgeboski]

Closing in favor of #200 where @dequis has provided a lot of useful information.