Ticket #1 (new defect)

Opened 21 months ago

Last modified 16 months ago

segfault when opening an eventlog

Reported by: MikolajKonarski Owned by: somebody
Priority: major Component: ThreadScope
Version: Keywords:
Cc:

Description

Segfault in a dev version of ThreadScope? (with spark histogram), when opening a small eventlog file repeatedly. Happens about 1 in 10 times.

Ubuntu GNU/Linux with development version of Unity and its exotic gtk theme, other programs warn about assertion failures sometimes, too.

Starting program: /home/mikolaj/repos/ThreadScope/dist/build/threadscope/threadscope +RTS -K83886080
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffee6d7700 (LWP 10555)]
[New Thread 0x7fffeded6700 (LWP 10556)]
[New Thread 0x7fffe4ea2700 (LWP 10619)]
[Thread 0x7fffee6d7700 (LWP 10555) exited]
[Thread 0x7fffe4ea2700 (LWP 10619) exited]
[New Thread 0x7fffe4ea2700 (LWP 16293)]
[New Thread 0x7fffee6d7700 (LWP 16294)]
[Thread 0x7fffe4ea2700 (LWP 16293) exited]
[New Thread 0x7fffe4ea2700 (LWP 16415)]
[Thread 0x7fffe4ea2700 (LWP 16415) exited]
[New Thread 0x7fffe4ea2700 (LWP 16476)]
[Thread 0x7fffe4ea2700 (LWP 16476) exited]
[New Thread 0x7fffe4ea2700 (LWP 16517)]
[New Thread 0x7fff3bfff700 (LWP 16518)]
[Thread 0x7fff3bfff700 (LWP 16518) exited]
[Thread 0x7fffee6d7700 (LWP 16294) exited]
[New Thread 0x7fffee6d7700 (LWP 16559)]
[New Thread 0x7fff3bfff700 (LWP 16560)]
[Thread 0x7fff3bfff700 (LWP 16560) exited]
[Thread 0x7fffee6d7700 (LWP 16559) exited]
[New Thread 0x7fffee6d7700 (LWP 16683)]
[New Thread 0x7fff3bfff700 (LWP 16704)]
[Thread 0x7fff3bfff700 (LWP 16704) exited]
[Thread 0x7fffe4ea2700 (LWP 16517) exited]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7918f83 in _gtk_rbtree_next (tree=0x15d5860, node=0x31) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkrbtree.c:1287
1287	/build/buildd/gtk+2.0-2.24.4/gtk/gtkrbtree.c: No such file or directory.
	in /build/buildd/gtk+2.0-2.24.4/gtk/gtkrbtree.c
(gdb) where
#0  0x00007ffff7918f83 in _gtk_rbtree_next (tree=0x15d5860, node=0x31) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkrbtree.c:1287
#1  0x00007ffff79cb608 in gtk_tree_view_bin_expose (widget=0x13663e0, event=0x7fffffff9940) at /build/buildd/gtk+2.0-2.24.4/gtk/gtktreeview.c:5020
#2  0x00007ffff79cc665 in gtk_tree_view_expose (widget=0x13663e0, event=0x7fffffff9940) at /build/buildd/gtk+2.0-2.24.4/gtk/gtktreeview.c:5091
#3  0x00007ffff78d1578 in _gtk_marshal_BOOLEAN__BOXED (closure=0x12b4840, return_value=0x7fffffff95e0, n_param_values=<value optimised out>, param_values=0x1510100, invocation_hint=<value optimised out>, 
    marshal_data=<value optimised out>) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkmarshalers.c:86
#4  0x00007ffff5a9f81c in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#5  0x00007ffff5ab0e1f in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#6  0x00007ffff5ab9fa9 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#7  0x00007ffff5aba41f in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#8  0x00007ffff79ed4d1 in gtk_widget_event_internal (widget=0x13663e0, event=0x7fffffff9940) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkwidget.c:4988
#9  0x00007ffff78cfd9d in IA__gtk_main_do_event (event=0x7fffffff9940) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkmain.c:1610
#10 0x00007ffff75297dc in _gdk_window_process_updates_recurse (window=0x14cbea0, expose_region=0x13020c0) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5429
#11 0x00007ffff752978b in _gdk_window_process_updates_recurse (window=0x154bd80, expose_region=0x7fffe8041c30) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5402
#12 0x00007ffff752978b in _gdk_window_process_updates_recurse (window=0x12ad6c0, expose_region=0x7fffe8037e10) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5402
#13 0x00007ffff752473b in gdk_window_process_updates_internal (window=0x12ad6c0) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5588
#14 0x00007ffff7526929 in IA__gdk_window_process_all_updates () at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5696
#15 0x00007ffff7526999 in gdk_window_update_idle (data=<value optimised out>) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5322
#16 0x00007ffff7503c46 in gdk_threads_dispatch (data=0x7fffe805af00) at /build/buildd/gtk+2.0-2.24.4/gdk/gdk.c:512
#17 0x00007ffff51d3bcd in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007ffff51d43a8 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#19 0x00007ffff51d49f2 in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#20 0x00007ffff78ceaf7 in IA__gtk_main () at /build/buildd/gtk+2.0-2.24.4/gtk/gtkmain.c:1257
#21 0x000000000042b7f5 in sRLj_info ()
#22 0x0000000000000000 in ?? ()
(gdb) bt full
#0  0x00007ffff7918f83 in _gtk_rbtree_next (tree=0x15d5860, node=0x31) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkrbtree.c:1287
        __PRETTY_FUNCTION__ = "_gtk_rbtree_next"
#1  0x00007ffff79cb608 in gtk_tree_view_bin_expose (widget=0x13663e0, event=0x7fffffff9940) at /build/buildd/gtk+2.0-2.24.4/gtk/gtktreeview.c:5020
        done = 0
        parity = 1
        is_separator = <value optimised out>
        is_first = <value optimised out>
        is_last = <value optimised out>
        tree_view = 0x13663e0
        path = <value optimised out>
        tree = 0x15d5860
        list = <value optimised out>
        node = 0x14fe840
        cursor = 0x7fffe8041cc0
        cursor_tree = 0x15d5860
        drag_highlight = 0x0
        drag_highlight_tree = 0x0
        iter = {stamp = -85632914, user_data = 0x2, user_data2 = 0x200000000, user_data3 = 0x2}
        y_offset = 46
        cell_offset = <value optimised out>
        max_height = 23
        depth = 1
        background_area = {x = 0, y = 23, width = 178, height = 23}
        cell_area = {x = 12, y = 23, width = 165, height = 23}
        flags = 0
        highlight_x = <value optimised out>
        expander_cell_width = <value optimised out>
        bin_window_width = 178
        bin_window_height = <value optimised out>
        cursor_path = <value optimised out>
        drag_dest_path = <value optimised out>
        first_column = 0x13c1260
        last_column = 0x13c1260
        vertical_separator = 0
        horizontal_separator = 2
        focus_line_width = <value optimised out>
        allow_rules = 1
        has_special_cell = 1
        rtl = <value optimised out>
        n_visible_columns = <value optimised out>
        pointer_x = 1
        pointer_y = 4
        grid_line_width = 492
        got_pointer = 0
        row_ending_details = 0
        draw_vgrid_lines = 0
        draw_hgrid_lines = 0
        __PRETTY_FUNCTION__ = "gtk_tree_view_bin_expose"
#2  0x00007ffff79cc665 in gtk_tree_view_expose (widget=0x13663e0, event=0x7fffffff9940) at /build/buildd/gtk+2.0-2.24.4/gtk/gtktreeview.c:5091
        retval = <value optimised out>
        tmp_list = <value optimised out>
        tree_view = 0x13663e0
#3  0x00007ffff78d1578 in _gtk_marshal_BOOLEAN__BOXED (closure=0x12b4840, return_value=0x7fffffff95e0, n_param_values=<value optimised out>, param_values=0x1510100, invocation_hint=<value optimised out>, 
    marshal_data=<value optimised out>) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkmarshalers.c:86
        callback = 0x7ffff79cc580 <gtk_tree_view_expose>
        cc = 0x12b4840
        data1 = 0x13663e0
        data2 = <value optimised out>
        v_return = <value optimised out>
---Type <return> to continue, or q <return> to quit---
        __PRETTY_FUNCTION__ = "_gtk_marshal_BOOLEAN__BOXED"
#4  0x00007ffff5a9f81c in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#5  0x00007ffff5ab0e1f in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#6  0x00007ffff5ab9fa9 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#7  0x00007ffff5aba41f in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#8  0x00007ffff79ed4d1 in gtk_widget_event_internal (widget=0x13663e0, event=0x7fffffff9940) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkwidget.c:4988
        signal_num = <value optimised out>
        return_val = 0
#9  0x00007ffff78cfd9d in IA__gtk_main_do_event (event=0x7fffffff9940) at /build/buildd/gtk+2.0-2.24.4/gtk/gtkmain.c:1610
        event_widget = 0x13663e0
        grab_widget = 0x13663e0
        window_group = 0x13d0ea0
        rewritten_event = <value optimised out>
        tmp_list = <value optimised out>
        __PRETTY_FUNCTION__ = "IA__gtk_main_do_event"
#10 0x00007ffff75297dc in _gdk_window_process_updates_recurse (window=0x14cbea0, expose_region=0x13020c0) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5429
        event = {type = GDK_EXPOSE, any = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000'}, expose = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', area = {x = 0, y = 0, width = 178, height = 510}, 
            region = 0x13020c0, count = 0}, no_expose = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000'}, visibility = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', state = GDK_VISIBILITY_UNOBSCURED}, 
          motion = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', time = 0, x = 3.7771525079181847e-312, y = 2.5197347937903574e-321, axes = 0x13020c0, state = 0, is_hint = 32767, device = 0x3a00000001, 
            x_root = 6.9533359274326163e-310, y_root = 1.1032857409000708e-316}, button = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', time = 0, x = 3.7771525079181847e-312, y = 2.5197347937903574e-321, 
            axes = 0x13020c0, state = 0, button = 32767, device = 0x3a00000001, x_root = 6.9533359274326163e-310, y_root = 1.1032857409000708e-316}, scroll = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', time = 0, 
            x = 3.7771525079181847e-312, y = 2.5197347937903574e-321, state = 19931328, direction = GDK_SCROLL_UP, device = 0x7fff00000000, x_root = 1.2307575587647986e-312, y_root = 6.9533359274326163e-310}, key = {type = GDK_EXPOSE, 
            window = 0x14cbea0, send_event = 0 '\000', time = 0, state = 0, keyval = 178, length = 510, string = 0x13020c0 "\002", hardware_keycode = 0, group = 0 '\000', is_modifier = 0}, crossing = {type = GDK_EXPOSE, 
            window = 0x14cbea0, send_event = 0 '\000', subwindow = 0xb200000000, time = 510, x = 9.8473844407937208e-317, y = 6.9531436082559078e-310, x_root = 1.2307575587647986e-312, y_root = 6.9533359274326163e-310, mode = 22330752, 
            detail = GDK_NOTIFY_ANCESTOR, focus = -402243552, state = 32767}, focus_change = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', in = 0}, configure = {type = GDK_EXPOSE, window = 0x14cbea0, 
            send_event = 0 '\000', x = 0, y = 0, width = 178, height = 510}, property = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', atom = 0xb200000000, time = 510, state = 0}, selection = {type = GDK_EXPOSE, 
            window = 0x14cbea0, send_event = 0 '\000', selection = 0xb200000000, target = 0x1fe, property = 0x13020c0, time = 0, requestor = 32767}, owner_change = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', 
            owner = 0, reason = GDK_OWNER_CHANGE_NEW_OWNER, selection = 0x1fe, time = 19931328, selection_time = 0}, proximity = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', time = 0, device = 0xb200000000}, client = {
            type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', message_type = 0xb200000000, data_format = 510, data = {b = "\300 0\001\000\000\000\000\000\000\000\000\377\177\000\000\001\000\000", s = {8384, 304, 0, 0, 0, 0, 
                32767, 0, 1, 0}, l = {19931328, 140733193388032, 249108103169, 140737085971504, 22330752}}}, dnd = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', context = 0xb200000000, time = 510, x_root = 0, 
            y_root = 0}, window_state = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', changed_mask = 0, new_window_state = 0}, setting = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', 
            action = GDK_SETTING_ACTION_NEW, name = 0xb200000000 <Address 0xb200000000 out of bounds>}, grab_broken = {type = GDK_EXPOSE, window = 0x14cbea0, send_event = 0 '\000', keyboard = 0, implicit = 0, grab_window = 0x1fe}}
        private = 0x14cbea0
        child = <value optimised out>
        child_region = <value optimised out>
        r = {x = 510, y = 0, width = 0, height = 0}
        l = <value optimised out>
        children = 0x0
#11 0x00007ffff752978b in _gdk_window_process_updates_recurse (window=0x154bd80, expose_region=0x7fffe8041c30) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5402
        private = 0x154bd80
        child = 0x14cbea0
        child_region = 0x13020c0
        r = {x = 0, y = 0, width = 178, height = 510}
        l = 0x7fffe8064020
        children = 0x7fffe8064020
#12 0x00007ffff752978b in _gdk_window_process_updates_recurse (window=0x12ad6c0, expose_region=0x7fffe8037e10) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5402
        private = 0x12ad6c0
        child = 0x154bd80
        child_region = 0x7fffe8041c30
        r = {x = 2, y = 67, width = 178, height = 510}
        l = 0x7fffe8054240
        children = 0x1600f80
#13 0x00007ffff752473b in gdk_window_process_updates_internal (window=0x12ad6c0) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5588
        expose_region = 0x7fffe8037e10
        update_area = 0x13ef660
---Type <return> to continue, or q <return> to quit---
        private = 0x12ad6c0
        impl_iface = <value optimised out>
        save_region = 0
        clip_box = {x = 2, y = 67, width = 178, height = 510}
#14 0x00007ffff7526929 in IA__gdk_window_process_all_updates () at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5696
        private = 0x12ad6c0
        old_update_windows = 0x7fffe803e750
        tmp_list = 0x7fffe803e750
        in_process_all_updates = 1
        got_recursive_update = 0
#15 0x00007ffff7526999 in gdk_window_update_idle (data=<value optimised out>) at /build/buildd/gtk+2.0-2.24.4/gdk/gdkwindow.c:5322
No locals.
#16 0x00007ffff7503c46 in gdk_threads_dispatch (data=0x7fffe805af00) at /build/buildd/gtk+2.0-2.24.4/gdk/gdk.c:512
        dispatch = 0x7fffe805af00
        ret = 0
#17 0x00007ffff51d3bcd in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#18 0x00007ffff51d43a8 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#19 0x00007ffff51d49f2 in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#20 0x00007ffff78ceaf7 in IA__gtk_main () at /build/buildd/gtk+2.0-2.24.4/gtk/gtkmain.c:1257
        tmp_list = <value optimised out>
        functions = 0x0
        init = <value optimised out>
        loop = 0x14dd7d0
#21 0x000000000042b7f5 in sRLj_info ()
No symbol table info available.
#22 0x0000000000000000 in ?? ()
No symbol table info available.
(gdb)

Possibly related error messages from ~/.xsession-errors:

** (<unknown>:1900): DEBUG: MaximizeIfBigEnough: window mapped and already maximized, just undecorate

** (<unknown>:1900): WARNING **: Unable to fetch children: Method "Children" with signature "" on interface "org.ayatana.bamf.view" doesn't exist



** (<unknown>:1900): WARNING **: Unable to fetch children: Method "Children" with signature "" on interface "org.ayatana.bamf.view" doesn't exist



(nautilus:1909): GdkPixbuf-CRITICAL **: gdk_pixbuf_format_get_name: assertion `format != NULL' failed

** (<unknown>:1900): WARNING **: Unable to fetch children: Method "Children" with signature "" on interface "org.ayatana.bamf.view" doesn't exist



** (<unknown>:1900): WARNING **: Unable to fetch children: Method "Children" with signature "" on interface "org.ayatana.bamf.view" doesn't exist


** (<unknown>:1900): DEBUG: MaximizeIfBigEnough: Threadscope window size doesn't fit

(<unknown>:1900): GLib-GObject-WARNING **: instance with invalid (NULL) class pointer

(<unknown>:1900): GLib-GObject-CRITICAL **: g_signal_handler_disconnect: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed

(<unknown>:1900): GLib-GObject-WARNING **: instance of invalid non-instantiatable type `(null)'

(<unknown>:1900): GLib-GObject-CRITICAL **: g_signal_handler_disconnect: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed

(<unknown>:1900): GLib-GObject-WARNING **: instance of invalid non-instantiatable type `(null)'

(<unknown>:1900): GLib-GObject-CRITICAL **: g_signal_handler_disconnect: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed

(<unknown>:1900): GLib-GObject-WARNING **: instance of invalid non-instantiatable type `(null)'

(<unknown>:1900): GLib-GObject-CRITICAL **: g_signal_handler_disconnect: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed

(<unknown>:1900): GLib-GObject-WARNING **: instance of invalid non-instantiatable type `(null)'

(<unknown>:1900): GLib-GObject-CRITICAL **: g_signal_handler_disconnect: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed

Change History

Changed 21 months ago by MikolajKonarski

Happened with released ThreadScope? 0.2.0 now and with nothing very suspect in ~/.xsession-errors this time.

Changed 20 months ago by MikolajKonarski

Now I've got a segfault when reloading an eventlog. Probably the same, but I couldn't verify. The old one persists.

Changed 20 months ago by MikolajKonarski

Confirmed, it's the same segfault and now I can trigger it very often: 1. load and eventlog, 2. select the Trace tab, 3. reload (Control-R) a couple of times, 4. if still nothing, change some trace checkboxes and reload a few times again.

Sometimes the debug info is as before, buy sometimes there is more info:

(threadscope:18747): Gtk-CRITICAL **: /build/buildd/gtk+2.0-2.24.4/gtk/gtktreeview.c:5027 (gtk_tree_view_bin_expose): assertion `has_next' failed.
There is a disparity between the internal view of the GtkTreeView,
and the GtkTreeModel.  This generally means that the model has changed
without letting the view know.  Any display from now on is likely to
be incorrect.

**
Gtk:ERROR:/build/buildd/gtk+2.0-2.24.4/gtk/gtkrbtree.c:1096:_gtk_rbtree_find_offset: assertion failed: (tree)

Program received signal SIGABRT, Aborted.
0x00007ffff4396d05 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
	in ../nptl/sysdeps/unix/sysv/linux/raise.c

Changed 20 months ago by MikolajKonarski

  • component changed from component1 to ThreadScope

Seems peole get it a lot on the Net and are equally perplexed. It's usually either wrong order of removing stuff (removing parents before children) or a thread changing the model, while another draws it (out eventlog load/reload runs on a separate thread, IIRC).

May be related:

http://edsiper.linuxchile.cl/blog/2009/04/03/pygtk-threads-treewiew-treemodelfilter-treemodelsort

http://old.nabble.com/TreeView-update-td17663659.html

http://www.spinics.net/lists/gtk/msg00835.html

http://mail.gnome.org/archives/gtkmm-list/2002-November/msg00229.html

Changed 20 months ago by MikolajKonarski

may be related to the following TODO from GUI/Main.hs:

--TODO: set state to be empty during loading

Changed 18 months ago by MikolajKonarski

The bug persists with gtk-0.12.2.

Changed 18 months ago by MikolajKonarski

Duncan confirms the same or similar bug.

Changed 18 months ago by MikolajKonarski

Reported on the gtk2hs Trac as

http://hackage.haskell.org/trac/gtk2hs/ticket/1181

Changed 16 months ago by MikolajKonarski

With TS 0.2.1, which includes a workaound I get the segfaults less often, but I still get them, in _gtk_rbtree_next and in other functions of gtk_tree_view, by doing reloads as described above. OTOH, I can't now get any of the warnings or violated assertions I was getting before.

Note: See TracTickets for help on using tickets.