Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Sign in / Register
J
jami-client-gnome
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 152
    • Issues 152
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
    • Iterations
  • Requirements
    • Requirements
    • List
  • Security & Compliance
    • Security & Compliance
    • Dependency List
    • License Compliance
  • Operations
    • Operations
    • Incidents
  • Analytics
    • Analytics
    • Insights
    • Issue
    • Repository
    • Value Stream
  • Wiki
    • Wiki
  • Members
    • Members
  • Collapse sidebar
  • Activity
  • Graph
  • Create a new issue
  • Commits
  • Issue Boards
  • savoirfairelinux
  • jami-client-gnome
  • Issues
  • #381

Closed
Open
Opened Oct 27, 2015 by RingBot@RingBotOwner

GNOME: segfault when quitting the client

Issue generated from Tuleap's migration script. Originally submitted by: Stepan Salenikovich (ssalenik)

A segfault often happens when quitting the client. ASAN detects a use after free likely related to this:

  
\*\* (gnome-ring:23978): DEBUG: quitting  
=================================================================  
==23978==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040002ce610 at pc 0x710f87 bp 0x7fffffffda10 sp 0x7fffffffda00  
READ of size 8 at 0x6040002ce610 thread T0  
    \#0 0x710f86 in RecentModel::\~RecentModel() /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:201  
    \#1 0x711020 in RecentModel::\~RecentModel() /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:204  
    \#2 0x7ffff50da18b in QObjectPrivate::deleteChildren() (/usr/lib/x86\_64-linux-gnu/libQt5Core.so.5+0x31118b)  
    \#3 0x7ffff50e47f2 in QObject::\~QObject() (/usr/lib/x86\_64-linux-gnu/libQt5Core.so.5+0x31b7f2)  
    \#4 0x7ffff50aa708 in QCoreApplication::\~QCoreApplication() (/usr/lib/x86\_64-linux-gnu/libQt5Core.so.5+0x2e1708)  
    \#5 0x4b4a9a in ring\_client\_shutdown /home/ssalenikovich/projects/ring-client-gnome/src/ring\_client.cpp:463  
    \#6 0x7ffff562b503 (/usr/lib/x86\_64-linux-gnu/libgobject-2.0.so.0+0x10503)  
    \#7 0x7ffff5644fa6 in g\_signal\_emit\_valist (/usr/lib/x86\_64-linux-gnu/libgobject-2.0.so.0+0x29fa6)  
    \#8 0x7ffff56458fe in g\_signal\_emit (/usr/lib/x86\_64-linux-gnu/libgobject-2.0.so.0+0x2a8fe)  
    \#9 0x7ffff591675c in g\_application\_run (/usr/lib/x86\_64-linux-gnu/libgio-2.0.so.0+0xa975c)  
    \#10 0x4b44df in main /home/ssalenikovich/projects/ring-client-gnome/src/main.cpp:45  
    \#11 0x7ffff2c14a3f in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x20a3f)  
    \#12 0x4b4338 in \_start (/home/ssalenikovich/projects/ring-client-gnome/build/gnome-ring+0x4b4338)  
  
0x6040002ce610 is located 0 bytes inside of 48-byte region [0x6040002ce610,0x6040002ce640)  
freed by thread T0 here:  
    \#0 0x7ffff6f556af in operator delete(void\*) (/usr/lib/x86\_64-linux-gnu/libasan.so.1+0x586af)  
    \#1 0x710b4c in \~RecentViewNode /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:216  
    \#2 0x710b4c in RecentModel::\~RecentModel() /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:201  
    \#3 0x711020 in RecentModel::\~RecentModel() /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:204  
    \#4 0x7ffff50da18b in QObjectPrivate::deleteChildren() (/usr/lib/x86\_64-linux-gnu/libQt5Core.so.5+0x31118b)  
  
previously allocated by thread T0 here:  
    \#0 0x7ffff6f551af in operator new(unsigned long) (/usr/lib/x86\_64-linux-gnu/libasan.so.1+0x581af)  
    \#1 0x718391 in RecentModelPrivate::slotLastUsedChanged(ContactMethod\*, long) /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:593  
    \#2 0x7199a2 in RecentModel::RecentModel(QObject\*) /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:188  
    \#3 0x719dc1 in RecentModel::instance() /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:262  
    \#4 0x521e6a in recent\_contacts\_view\_init /home/ssalenikovich/projects/ring-client-gnome/src/recentcontactsview.cpp:512  
    \#5 0x7ffff564cf98 in g\_type\_create\_instance (/usr/lib/x86\_64-linux-gnu/libgobject-2.0.so.0+0x31f98)  
  
SUMMARY: AddressSanitizer: heap-use-after-free /home/ssalenikovich/projects/ring-lrc/src/recentmodel.cpp:201 RecentModel::\~RecentModel()  
Shadow bytes around the buggy address:  
  0x0c0880051c70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
  0x0c0880051c80: fa fa 00 00 00 00 00 00 fa fa fa fa fa fa fa fa  
  0x0c0880051c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
  0x0c0880051ca0: fa fa fd fd fd fd fd fd fa fa fa fa fa fa fa fa  
  0x0c0880051cb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
=>0x0c0880051cc0: fa fa[fd]fd fd fd fd fd fa fa fa fa fa fa fa fa  
  0x0c0880051cd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
  0x0c0880051ce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
  0x0c0880051cf0: fa fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd  
  0x0c0880051d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
  0x0c0880051d10: fa fa fd fd fd fd fd fd fa fa fa fa fa fa fa fa  
Shadow byte legend (one shadow byte represents 8 application bytes):  
  Addressable:           00  
  Partially addressable: 01 02 03 04 05 06 07   
  Heap left redzone:       fa  
  Heap right redzone:      fb  
  Freed heap region:       fd  
  Stack left redzone:      f1  
  Stack mid redzone:       f2  
  Stack right redzone:     f3  
  Stack partial redzone:   f4  
  Stack after return:      f5  
  Stack use after scope:   f8  
  Global redzone:          f9  
  Global init order:       f6  
  Poisoned by user:        f7  
  Contiguous container OOB:fc  
  ASan internal:           fe  
==23978==ABORTING  
[Thread 0x7fffdba7c700 (LWP 23985) exited]  
[Thread 0x7ffff7f15a40 (LWP 23978) exited]  
[Inferior 1 (process 23978) exited with code 01]  
Assignee
Assign to
None
Milestone
None
Assign milestone
Time tracking
None
Due date
None
Reference: savoirfairelinux/ring-client-gnome#381