elementary / wingpanel

Stylish top panel that holds indicators and spawns an application launcher
https://elementary.io
GNU General Public License v3.0
137 stars 44 forks source link

Memory corruption #373

Open kirelagin opened 3 years ago

kirelagin commented 3 years ago

What Happened

Due to nixos/nixpkgs#101527 I occasionally have to kill wingpanel to have it pick up newly installed apps. It restarted fine, but when I tried to actually open the applications list, it crashed.

There is realloc(): invalid next size in the journal and when I tried to start it manually in the terminal right after that, I got free(): invalid next size (fast), so there is some sort of memory corruption going on.

And gnome-session does not attempt to restart it any longer.

Expected Behavior

There are two problems here:

  1. The underlying crash. It is not the first this happens to me, I would say it actually happens quite often, but it is only now that I actually looked into it.
  2. The fact that gnome-session gives up trying to restart it. wingpanel does not crash immediately when it starts, it only crashes when I try to actually open the application list, so the fact that gnome-session only tries once may be some sort of misconfiguration in the desktop file.

Steps to Reproduce

  1. (Maybe?) Install some new .desktop files
  2. Kill wingpanel with SIGTERM
  3. Wait for it to restart and try to open the application list

After it crashed like this for the first time gnome-session gave up trying to restart it immediately, so I launched it form the terminal myself an it crashed again. Then I tried again, and it worked fine, so this is not particularly deterministic.

Logs

Journal:

Feb 07 17:18:43 kirXps gnome-session-binary[1799]: WARNING: Application 'io.elementary.wingpanel.desktop' killed by signal 15
Feb 07 17:18:43 kirXps .wingpanel-wrap[8869]: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-2ePpf5HZQa: Connection refused
Feb 07 17:18:44 kirXps .gala-wrapped[1976]: invalid cast from 'CoglTexture2D' to '(null)'
Feb 07 17:18:49 kirXps .wingpanel-wrap[8869]: DBusService.vala:64: Service registration suceeded
Feb 07 17:18:49 kirXps io.elementary.wingpanel.desktop[8869]: realloc(): invalid next size
Feb 07 17:18:49 kirXps gnome-session[1799]: gnome-session-binary[1799]: WARNING: Application 'io.elementary.wingpanel.desktop' killed by signal 6
Feb 07 17:18:49 kirXps gnome-session[1799]: gnome-session-binary[1799]: WARNING: App 'io.elementary.wingpanel.desktop' respawning too quickly
Feb 07 17:18:49 kirXps gnome-session[1799]: gnome-session-binary[1799]: WARNING: Error on restarting session managed app: Component 'io.elementary.wingpanel.desktop' crashing too quickly
Feb 07 17:18:49 kirXps gnome-session-binary[1799]: WARNING: Application 'io.elementary.wingpanel.desktop' killed by signal 6
Feb 07 17:18:49 kirXps gnome-session-binary[1799]: WARNING: App 'io.elementary.wingpanel.desktop' respawning too quickly
Feb 07 17:18:49 kirXps gnome-session-binary[1799]: WARNING: Error on restarting session managed app: Component 'io.elementary.wingpanel.desktop' crashing too quickly
Feb 07 17:18:50 kirXps systemd-coredump[8904]: Process 8869 (.wingpanel-wrap) of user 1000 dumped core.

Backtrace from the coredump:

(gdb) bt
#0  0x00007fac312e5ffa in raise () from /nix/store/q53f5birhik4dxg3q3r2g5f324n7r5mc-glibc-2.31-74/lib/libc.so.6
#1  0x00007fac312d0528 in abort () from /nix/store/q53f5birhik4dxg3q3r2g5f324n7r5mc-glibc-2.31-74/lib/libc.so.6
#2  0x00007fac31327828 in __libc_message () from /nix/store/q53f5birhik4dxg3q3r2g5f324n7r5mc-glibc-2.31-74/lib/libc.so.6
#3  0x00007fac3132e98a in malloc_printerr () from /nix/store/q53f5birhik4dxg3q3r2g5f324n7r5mc-glibc-2.31-74/lib/libc.so.6
#4  0x00007fac3133297c in _int_realloc () from /nix/store/q53f5birhik4dxg3q3r2g5f324n7r5mc-glibc-2.31-74/lib/libc.so.6
#5  0x00007fac31333a87 in realloc () from /nix/store/q53f5birhik4dxg3q3r2g5f324n7r5mc-glibc-2.31-74/lib/libc.so.6
#6  0x00007fac321130c8 in g_realloc () from /nix/store/4x2sd5i73qacv1940yc6dg94izahpqrz-glib-2.64.5/lib/libglib-2.0.so.0
#7  0x00007fac320f9f0d in realloc_arrays () from /nix/store/4x2sd5i73qacv1940yc6dg94izahpqrz-glib-2.64.5/lib/libglib-2.0.so.0
#8  0x00007fac320fa25a in g_hash_table_resize () from /nix/store/4x2sd5i73qacv1940yc6dg94izahpqrz-glib-2.64.5/lib/libglib-2.0.so.0
#9  0x00007fac320fa825 in g_hash_table_insert_node () from /nix/store/4x2sd5i73qacv1940yc6dg94izahpqrz-glib-2.64.5/lib/libglib-2.0.so.0
#10 0x00007fac320fab56 in g_hash_table_insert_internal () from /nix/store/4x2sd5i73qacv1940yc6dg94izahpqrz-glib-2.64.5/lib/libglib-2.0.so.0
#11 0x00007fac32131151 in g_string_chunk_insert_const () from /nix/store/4x2sd5i73qacv1940yc6dg94izahpqrz-glib-2.64.5/lib/libglib-2.0.so.0
#12 0x00007fac2f09388a in zeitgeist_subject_set_mimetype () from /nix/store/a4ya53x8mgjlnskxpksjn10nfqj1aw49-zeitgeist-1.0.2-lib/lib/libzeitgeist-2.0.so.0
#13 0x00007fac2f09e608 in zeitgeist_db_reader_get_subject_from_row () from /nix/store/a4ya53x8mgjlnskxpksjn10nfqj1aw49-zeitgeist-1.0.2-lib/lib/libzeitgeist-2.0.so.0
#14 0x00007fac2f09e879 in zeitgeist_db_reader_get_events () from /nix/store/a4ya53x8mgjlnskxpksjn10nfqj1aw49-zeitgeist-1.0.2-lib/lib/libzeitgeist-2.0.so.0
#15 0x00007fac2f0a1938 in zeitgeist_db_reader_find_events () from /nix/store/a4ya53x8mgjlnskxpksjn10nfqj1aw49-zeitgeist-1.0.2-lib/lib/libzeitgeist-2.0.so.0
#16 0x00007fac2f0813b6 in ____lambda11__gthread_func () from /nix/store/a4ya53x8mgjlnskxpksjn10nfqj1aw49-zeitgeist-1.0.2-lib/lib/libzeitgeist-2.0.so.0
#17 0x00007fac2f082763 in ____lambda10__gfunc () from /nix/store/a4ya53x8mgjlnskxpksjn10nfqj1aw49-zeitgeist-1.0.2-lib/lib/libzeitgeist-2.0.so.0
#18 0x00007fac32136c34 in g_thread_pool_thread_proxy () from /nix/store/4x2sd5i73qacv1940yc6dg94izahpqrz-glib-2.64.5/lib/libglib-2.0.so.0
#19 0x00007fac321363cd in g_thread_proxy () from /nix/store/4x2sd5i73qacv1940yc6dg94izahpqrz-glib-2.64.5/lib/libglib-2.0.so.0
#20 0x00007fac31219ead in start_thread () from /nix/store/q53f5birhik4dxg3q3r2g5f324n7r5mc-glibc-2.31-74/lib/libpthread.so.0
#21 0x00007fac313a5caf in clone () from /nix/store/q53f5birhik4dxg3q3r2g5f324n7r5mc-glibc-2.31-74/lib/libc.so.6

Platform Information

cc @worldofpeace (in case this is somehow NixOS-specific and you saw something like this)

worldofpeace commented 3 years ago

OMG all the time exactly this

worldofpeace commented 3 years ago

Actually I think this has been rewritten slightly that https://github.com/NixOS/nixpkgs/issues/101527 should be different. I haven't had any time to recheck though

lorenz commented 1 year ago

Still reproduces on NixOS 22.11. Same backtrace, but it might also be misleading, as another thread is also simultaneously active. While the Zeitgeist thread is hitting the error, the other one might be causing the corruption.

realloc(): invalid next size
#6  0x00007f64de133553 realloc (libc.so.6 + 0x99553)
#7  0x00007f64defa4bf8 g_realloc (libglib-2.0.so.0 + 0x5ebf8)
#8  0x00007f64def8a20c realloc_arrays (libglib-2.0.so.0 + 0x4420c)
#9  0x00007f64def8a546 g_hash_table_resize (libglib-2.0.so.0 + 0x44546)
#10 0x00007f64def8ad1c g_hash_table_insert_node (libglib-2.0.so.0 + 0x44d1c)
#11 0x00007f64def8bb10 g_hash_table_add (libglib-2.0.so.0 + 0x45b10)
#12 0x00007f64defc3aa2 g_string_chunk_insert_const (libglib-2.0.so.0 + 0x7daa2)
#13 0x00007f64c92a15ca zeitgeist_subject_set_mimetype (libzeitgeist-2.0.so.0 + 0x2e5ca)
#14 0x00007f64c92ac838 zeitgeist_db_reader_get_subject_from_row (libzeitgeist-2.0.so.0 + 0x39838)
#15 0x00007f64c92acad9 zeitgeist_db_reader_get_events (libzeitgeist-2.0.so.0 + 0x39ad9)
#16 0x00007f64c92afd18 zeitgeist_db_reader_find_events (libzeitgeist-2.0.so.0 + 0x3cd18)
#17 0x00007f64c928e746 ____lambda11__gthread_func (libzeitgeist-2.0.so.0 + 0x1b746)
#18 0x00007f64c928d473 ____lambda10__gfunc (libzeitgeist-2.0.so.0 + 0x1a473)
#19 0x00007f64defca1b4 g_thread_pool_thread_proxy (libglib-2.0.so.0 + 0x841b4)
#20 0x00007f64defc98cd g_thread_proxy (libglib-2.0.so.0 + 0x838cd)
#21 0x00007f64de122e86 start_thread (libc.so.6 + 0x88e86)
#22 0x00007f64de1a9d70 __clone3 (libc.so.6 + 0x10fd70)

Other Thread:

#1  0x00007f64de13390c realloc (libc.so.6 + 0x9990c)
#2  0x00007f64de1179f3 __vasprintf_internal (libc.so.6 + 0x7d9f3)
#3  0x00007f64defeeeef g_vasprintf (libglib-2.0.so.0 + 0xa8eef)
#4  0x00007f64defbf7ad g_strdup_vprintf (libglib-2.0.so.0 + 0x797ad)
#5  0x00007f64def86c80 g_error_new_valist (libglib-2.0.so.0 + 0x40c80)
#6  0x00007f64def8731b g_set_error (libglib-2.0.so.0 + 0x4131b)
#7  0x00007f64def961be g_key_file_get_value (libglib-2.0.so.0 + 0x501be)
#8  0x00007f64def963c8 g_key_file_get_string (libglib-2.0.so.0 + 0x503c8)
#9  0x00007f64def96bc6 g_key_file_get_locale_string (libglib-2.0.so.0 + 0x50bc6)
#10 0x00007f64dee2e6c0 g_desktop_app_info_load_from_keyfile (libgio-2.0.so.0 + 0xcf6c0)
#11 0x00007f64dee317d3 g_desktop_app_info_new_from_filename_unlocked (libgio-2.0.so.0 + 0xd27d3)
#12 0x00007f64dee32c0d g_app_info_get_all (libgio-2.0.so.0 + 0xd3c0d)
#13 0x00007f64c9328664 synapse_desktop_file_service_load_all_desktop_files (libslingshot.so + 0x4b664)
#14 0x00007f64c9328a3c synapse_desktop_file_service_initialize_co.isra.0 (libslingshot.so + 0x4ba3c)
#15 0x00007f64dee15ff3 g_task_return_now (libgio-2.0.so.0 + 0xb6ff3)
#16 0x00007f64dee16029 complete_in_idle_cb (libgio-2.0.so.0 + 0xb7029)
#17 0x00007f64def9e8e4 g_main_context_dispatch (libglib-2.0.so.0 + 0x588e4)
#18 0x00007f64def9ec88 g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0x58c88)
#19 0x00007f64def9ed3f g_main_context_iteration (libglib-2.0.so.0 + 0x58d3f)
#20 0x00007f64dee4419d g_application_run (libgio-2.0.so.0 + 0xe519d)
#21 0x0000000000409011 main (.io.elementary.wingpanel-wrapped + 0x9011)
#22 0x00007f64de0c324e __libc_start_call_main (libc.so.6 + 0x2924e)
#23 0x00007f64de0c3309 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29309)
#24 0x0000000000409055 _start (.io.elementary.wingpanel-wrapped + 0x9055)