View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0001446libextractorpluginspublic2009-02-02 08:502009-02-20 11:54
ReporterChristian Grothoff Assigned ToChristian Grothoff  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Product VersionGit master 
Summary0001446: crash in mt_extracttest2
Description(gdb) ba
#0 0xb7e5b4fb in g_slice_alloc () from /usr/lib/libglib-2.0.so.0
#1 0xb7e5bc15 in g_slice_alloc0 () from /usr/lib/libglib-2.0.so.0
#2 0xb8021e0b in g_type_create_instance () from /usr/lib/libgobject-2.0.so.0
#3 0xb80063d5 in g_object_freeze_notify () from /usr/lib/libgobject-2.0.so.0
#4 0xb8006c06 in g_object_newv () from /usr/lib/libgobject-2.0.so.0
#5 0xb80077d7 in g_object_new_valist () from /usr/lib/libgobject-2.0.so.0
#6 0xb800794e in g_object_new () from /usr/lib/libgobject-2.0.so.0
#7 0xb7c0d9f7 in gdk_pixbuf_loader_new () from /usr/lib/libgdk_pixbuf-2.0.so.0
#8 0xb80a9ba0 in libextractor_thumbnailgtk_extract (filename=0x8049200 "est.jpg",
    data=0xb7c4a000 <Address 0xb7c4a000 out of bounds>, size=78, prev=0xb08407d8) at thumbnailextractor.c:113
#9 0xb80a9e40 in libextractor_thumbnail_extract (filename=0x8049200 "est.jpg",
    data=0xb7c4a000 <Address 0xb7c4a000 out of bounds>, size=78, prev=0xb08407d8, options=0x0) at thumbnailextractor.c:175
#10 0xb80b4454 in getKeywords (extractor=0xb0847568, filename=0x8049200 "est.jpg",
    data=0xb7c4a000 <Address 0xb7c4a000 out of bounds>, size=78) at extractor.c:1276
#11 0xb80b45fa in EXTRACTOR_getKeywords (extractor=0xb0840db8, filename=0x8049200 "est.jpg") at extractor.c:1343
#12 0x08048c83 in get_keywords_for_file (file=0x8049280) at mt_extracttest2.c:104
#13 0x08048ce2 in test_plugins (arg=0xbfad6298) at mt_extracttest2.c:124
#14 0xb7deffc0 in start_thread (arg=0xb5309b90) at pthread_create.c:297
#15 0xb7d7097e in clone () from /usr/lib/debug/libc.so.6
Additional Information$ ./mt_extracttest2
testing with '../../test/test.bmp' for 10 seconds
testing with '../../test/test.jpg' for 10 seconds
testing with '../../test/test.png' for 10 seconds
testing with '../../test/test.sxw' for 10 seconds
testing with '../../test/test.bmp' for 10 seconds
Segmentation fault (core dumped)
TagsNo tags attached.

Activities

Christian Grothoff

2009-02-04 17:17

manager   ~0003777

Using 1000s, I get something with valgrind:

testing with '../../test/test.bmp' for 1000 seconds
==26010== Thread 6:
==26010== Invalid read of size 4
==26010== at 0x4231EF0: g_object_newv (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x42324B8: g_object_new_valist (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x42325FD: g_object_new (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x4EA3EA1: gdk_pixbuf_new_from_data (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4EA1F34: gdk_pixbuf_new (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4A5F68D: (within /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-bmp.so)
==26010== by 0x4EA7675: (within /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4EA7CEB: gdk_pixbuf_loader_close (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4033A1C: libextractor_thumbnailgtk_extract (thumbnailextractor.c:116)
==26010== by 0x4033C91: libextractor_thumbnail_extract (thumbnailextractor.c:178)
==26010== by 0x405843A: getKeywords (extractor.c:1261)
==26010== by 0x4058A3B: EXTRACTOR_getKeywords (extractor.c:1328)
==26010== Address 0x68706c61 is not stack'd, malloc'd or (recently) free'd
==26010==
==26010== Invalid read of size 4
==26010== at 0x4231F0A: g_object_newv (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x42324B8: g_object_new_valist (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x42325FD: g_object_new (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x4EA3EA1: gdk_pixbuf_new_from_data (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4EA1F34: gdk_pixbuf_new (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4A5F68D: (within /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-bmp.so)
==26010== by 0x4EA7675: (within /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4EA7CEB: gdk_pixbuf_loader_close (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4033A1C: libextractor_thumbnailgtk_extract (thumbnailextractor.c:116)
==26010== by 0x4033C91: libextractor_thumbnail_extract (thumbnailextractor.c:178)
==26010== by 0x405843A: getKeywords (extractor.c:1261)
==26010== by 0x4058A3B: EXTRACTOR_getKeywords (extractor.c:1328)
==26010== Address 0x68706c65 is not stack'd, malloc'd or (recently) free'd
==26010==
==26010== Process terminating with default action of signal 11 (SIGSEGV)
==26010== Bad permissions for mapped region at address 0x4EB20A1
==26010== at 0x43EC7D1: g_slice_free_chain_with_offset (in /usr/lib/libglib-2.0.so.0.1600.6)
==26010== by 0x43EDC20: g_slist_free (in /usr/lib/libglib-2.0.so.0.1600.6)
==26010== by 0x422EEB4: (within /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x43BA275: g_datalist_id_set_data_full (in /usr/lib/libglib-2.0.so.0.1600.6)
==26010== by 0x4231F3D: g_object_newv (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x42324B8: g_object_new_valist (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x42325FD: g_object_new (in /usr/lib/libgobject-2.0.so.0.1600.6)
==26010== by 0x4EA3EA1: gdk_pixbuf_new_from_data (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4EA1F34: gdk_pixbuf_new (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4A5F68D: (within /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-bmp.so)
==26010== by 0x4EA7675: (within /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010== by 0x4EA7CEB: gdk_pixbuf_loader_close (in /usr/lib/libgdk_pixbuf-2.0.so.0.1200.11)
==26010==
==26010== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 6415304 from 5)
==26010== malloc/free: in use at exit: 36,192,214 bytes in 287,716 blocks.
==26010== malloc/free: 53,095,683 allocs, 52,807,967 frees, 7,956,262,671 bytes allocated.
==26010== For counts of detected errors, rerun with: -v
==26010== searching for pointers to 287,716 not-freed blocks.
==26010== checked 84,139,896 bytes.
=

Christian Grothoff

2009-02-10 20:41

manager   ~0003796

Compiled gtk/glib with symbols, now I get:

0xb7cc6ce8 in magazine_chain_pop_head (magazine_chunks=0x84576e0) at gslice.c:474
474 (*magazine_chunks)->data = chunk->next;
(gdb) ba
#0 0xb7cc6ce8 in magazine_chain_pop_head (magazine_chunks=0x84576e0) at gslice.c:474
#1 0xb7cc773c in thread_memory_magazine1_alloc (tmem=0x84576d0, ix=1) at gslice.c:777
#2 0xb7cc741f in IA__g_slice_alloc (mem_size=16) at gslice.c:815
#3 0xb7cc777a in IA__g_slice_alloc0 (mem_size=16) at gslice.c:833
#4 0xb7eb5242 in IA__g_type_create_instance (type=138826360) at gtype.c:1654
#5 0xb7e9c4c3 in g_object_constructor (type=138826360, n_construct_properties=0, construct_params=0x0) at gobject.c:1334
#6 0xb7e9bc2c in IA__g_object_newv (object_type=138826360, n_parameters=0, parameters=0x0) at gobject.c:1211
#7 0xb7e9c09a in IA__g_object_new_valist (object_type=138826360, first_property_name=0x0, var_args=0xb578a168 "��ķ")
    at gobject.c:1274
#8 0xb7e9b791 in IA__g_object_new (object_type=138826360, first_property_name=0x0) at gobject.c:1056
#9 0xb78a043e in IA__gdk_pixbuf_loader_new () at gdk-pixbuf-loader.c:498
#10 0xb7f42ba0 in libextractor_thumbnailgtk_extract (filename=0x80491e0 "../../test/test.bmp", data=0xb7a25000 "BMN",
    size=78, prev=0x8465ba0) at thumbnailextractor.c:113
#11 0xb7f42e40 in libextractor_thumbnail_extract (filename=0x80491e0 "../../test/test.bmp", data=0xb7a25000 "BMN", size=78,
    prev=0x8465ba0, options=0x0) at thumbnailextractor.c:175
#12 0xb7f4d454 in getKeywords (extractor=0x845efb8, filename=0x80491e0 "../../test/test.bmp", data=0xb7a25000 "BMN", size=78)
    at extractor.c:1270
#13 0xb7f4d629 in EXTRACTOR_getKeywords (extractor=0x8468bd8, filename=0x80491e0 "../../test/test.bmp") at extractor.c:1337
#14 0x08048c63 in get_keywords_for_file (file=0x8049260) at mt_extracttest2.c:102
#15 0x08048cc2 in test_plugins (arg=0xbfe6caa8) at mt_extracttest2.c:120
#16 0xb7c5450f in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#17 0xb7bcd7ee in clone () from /lib/tls/i686/cmov/libc.so.6

Christian Grothoff

2009-02-10 20:53

manager   ~0003798

Last edited: 2009-02-10 21:07

 The code does:

 chunk = (*magazine_chunks)->data;
 if (chunk)
 {
   (*magazine_chunks)->data = chunk->next;
 }

with

(gdb) print chunk
$4 = (ChunkLink *) 0x36
(gdb) print (*magazine_chunks)->data
$5 = (ChunkLink *) 0x0

Bizarre.

Christian Grothoff

2009-02-10 22:36

manager   ~0003799

More fun info, this time valgrind with debug symbols for gtk:

==10999== Thread 9:
==10999== Invalid read of size 4
==10999== at 0x772DFF2: cache_magic_matchlet_compare_to_data (xdgmimecache.c:194)
==10999== by 0x772E0CF: cache_magic_matchlet_compare (xdgmimecache.c:220)
==10999== by 0x772E1E9: cache_magic_compare_to_data (xdgmimecache.c:252)
==10999== by 0x772E2BF: cache_magic_lookup_data (xdgmimecache.c:288)
==10999== by 0x772EE08: cache_get_mime_type_for_data (xdgmimecache.c:629)
==10999== by 0x772EECB: __gio_xdg_cache_get_mime_type_for_data (xdgmimecache.c:659)
==10999== by 0x772CC12: _gio_xdg_get_mime_type_for_data (xdgmime.c:473)
==10999== by 0x76E304C: g_content_type_guess (gcontenttype.c:931)
==10999== by 0x49A5A37: _gdk_pixbuf_get_module (gdk-pixbuf-io.c:797)
==10999== by 0x49A8F20: gdk_pixbuf_loader_load_module (gdk-pixbuf-loader.c:350)
==10999== by 0x49A9973: gdk_pixbuf_loader_close (gdk-pixbuf-loader.c:712)
==10999== by 0x4036BE4: libextractor_thumbnailgtk_extract (thumbnailextractor.c:116)
==10999== Address 0xdee72b0 is 8 bytes inside a block of size 12 free'd
==10999== at 0x4024B4A: free (vg_replace_malloc.c:323)
==10999== by 0x772DD2F: __gio_xdg_cache_unref (xdgmimecache.c:106)
==10999== by 0x772D0FE: _gio_xdg_shutdown (xdgmime.c:651)
==10999== by 0x772CB64: xdg_mime_init (xdgmime.c:444)
==10999== by 0x772CBED: _gio_xdg_get_mime_type_for_data (xdgmime.c:470)
==10999== by 0x76E304C: g_content_type_guess (gcontenttype.c:931)
==10999== by 0x49A5A37: _gdk_pixbuf_get_module (gdk-pixbuf-io.c:797)
==10999== by 0x49A8F20: gdk_pixbuf_loader_load_module (gdk-pixbuf-loader.c:350)
==10999== by 0x49A9973: gdk_pixbuf_loader_close (gdk-pixbuf-loader.c:712)
==10999== by 0x4036BE4: libextractor_thumbnailgtk_extract (thumbnailextractor.c:116)
==10999== by 0x4036E3F: libextractor_thumbnail_extract (thumbnailextractor.c:175)
==10999== by 0x402D453: getKeywords (extractor.c:1270)

Christian Grothoff

2009-02-10 22:40

manager   ~0003800

Ok, in the valgrind trace for the path freeing data there is xdg_mime_shutdown, which has the following wonderful beginning:

void
xdg_mime_shutdown (void)
{
  XdgCallbackList *list;

  /* FIXME: Need to make this (and the whole library) thread safe */


Looks like somebody knows that there is a major problem...

Christian Grothoff

2009-02-15 00:26

manager   ~0003813

Matthias Clasen <mclasen@redhat.com> (Red Hat, Inc) writes:

 

If you look at gio/gcontenttype.c, you'll notice that we protect all
uses of xdgmime functions by a lock, so there should not be any
thread-safety issues here.

Christian Grothoff

2009-02-15 00:31

manager   ~0003814

Gotcha. We need to call "g_thread_init()" to get the lock to be active...

Issue History

Date Modified Username Field Change
2009-02-02 08:50 Christian Grothoff New Issue
2009-02-04 17:17 Christian Grothoff Note Added: 0003777
2009-02-10 20:41 Christian Grothoff Note Added: 0003796
2009-02-10 20:53 Christian Grothoff Note Added: 0003798
2009-02-10 20:55 Christian Grothoff Note Edited: 0003798
2009-02-10 21:07 Christian Grothoff Note Edited: 0003798
2009-02-10 22:36 Christian Grothoff Note Added: 0003799
2009-02-10 22:40 Christian Grothoff Note Added: 0003800
2009-02-15 00:26 Christian Grothoff Note Added: 0003813
2009-02-15 00:31 Christian Grothoff Note Added: 0003814
2009-02-15 00:31 Christian Grothoff Status new => resolved
2009-02-15 00:31 Christian Grothoff Resolution open => fixed
2009-02-15 00:31 Christian Grothoff Assigned To => Christian Grothoff
2009-02-20 11:54 Christian Grothoff Status resolved => closed