I am doing a small analisys of the problem (if helps to developers to
get fixed soon in someway)

Notify osd get a OS error code "4" that stands for "Interrupted system
call" in dmesg, the relevant info:

[952920.665441] notify-osd[12820]: segfault at aaaaaaaa ip 08056a87 sp
bfc97b10 error 4 in notify-osd[8048000+32000]

The StacktraceTop revealed by apport seems that the crash cames from
bubble_get_id function in bubble.c, line 3100:

StacktraceTop:
 bubble_get_id (self=self@entry=0x8a71ac0) at bubble.c:3100
 stack_notify_handler (self=0x8b032a0, app_name=0x8b32f90 "liferea", id=0, 
icon=0x8b33bc0 "liferea", summary=0x8b33bd0 "Actualizaci\303\263n", 
body=0x8a63d90 "<b>JS CodeBlocks</b> has <b>25</b> updates", actions=0x8b33be8, 
hints=0x8b00640, timeout=-1, context=0x8b33c60) at stack.c:776
 
dbus_glib_marshal_stack_VOID__STRING_UINT_STRING_STRING_STRING_BOXED_BOXED_INT_POINTER
 (closure=0xbfab4e08, return_value=0x0, n_param_values=10, 
param_values=0x8b33c88, invocation_hint=0x0, marshal_data=0x8063f50 
<stack_notify_handler>) at stack-glue.h:102
 invoke_object_method (message=0x8b35a30, connection=0x8a6e0b8, 
method=0x8070960 <dbus_glib_stack_methods>, object_info=0x8070944 
<dbus_glib_stack_object_info>, object=0x8b032a0) at dbus-gobject.c:1899
 object_registration_message (connection=0x8a6e0b8, 
message=message@entry=0x8b35a30, user_data=user_data@entry=0x8a9ef00) at 
dbus-gobject.c:2161

The app that seems to crash notify osd is Liferea, so I am relating this
bug with Liferea project too.

The portion code affected is:

guint
bubble_get_id (Bubble* self)
{
        if (!self || !IS_BUBBLE (self))
                return 0;

        return GET_PRIVATE (self)->id;
}

The GET_PRIVATE macro is a alias for:

#define GET_PRIVATE(o) \
  (G_TYPE_INSTANCE_GET_PRIVATE ((o), BUBBLE_TYPE, BubblePrivate))

The crash happens in register comparation as shows:

=> 0x8056a87 <bubble_get_id+23>:        cmp    %eax,(%edx)
   0x8056a89 <bubble_get_id+25>:        je     0x8056aa8 <bubble_get_id+56>
   0x8056a8b <bubble_get_id+27>:        mov    %eax,0x4(%esp)
   0x8056a8f <bubble_get_id+31>:        mov    %ebx,(%esp)
   0x8056a92 <bubble_get_id+34>:        call   0x8052690 
<g_type_check_instance_is_a@plt>
   0x8056a97 <bubble_get_id+39>:        test   %eax,%eax
   0x8056a99 <bubble_get_id+41>:        jne    0x8056aa8 <bubble_get_id+56>
   0x8056a9b <bubble_get_id+43>:        add    $0x18,%esp
   0x8056a9e <bubble_get_id+46>:        xor    %eax,%eax
   0x8056aa0 <bubble_get_id+48>:        pop    %ebx
   0x8056aa1 <bubble_get_id+49>:        ret    
   0x8056aa2 <bubble_get_id+50>:        lea    0x0(%esi),%esi
   0x8056aa8 <bubble_get_id+56>:        call   0x8053680 <bubble_get_type>
   0x8056aad <bubble_get_id+61>:        mov    %ebx,(%esp)
   0x8056ab0 <bubble_get_id+64>:        mov    %eax,0x4(%esp)
   0x8056ab4 <bubble_get_id+68>:        call   0x8052140 
<g_type_instance_get_private@plt>

In concrete during G_TYPE_INSTANCE_GET_PRIVATE

https://developer.gnome.org/gobject/stable/gobject-Type-
Information.html#G-TYPE-INSTANCE-GET-PRIVATE:CAPS

This function "Gets the private structure for a particular type. The
private structure must have been registered in the class_init function
with g_type_class_add_private()."

I check that BubblePrivate it is registered in bubble.c, funcion
bubble_class_init(), line 2141 with:

g_type_class_add_private (klass, sizeof (BubblePrivate));

And BUBBLE_TYPE is a macro alias for bubble_get_type() that returns a
GType object.

GType bubble_get_type (void);

#define BUBBLE_TYPE             (bubble_get_type ())

So, in some point the comparation is failing to get the private struct
part for BubblePrivate and it is making that NotifyOSD crash the whole
app. I would try debug more the problem and send a patch if I discover
the real problem for get fixed, but any help is appreciated, I am a lot
rusty with C development but I think that I could help to fix.


** Also affects: liferea
   Importance: Undecided
       Status: New

** Description changed:

- This crash happens sometimes when a ubuntu unknown app send a bubble
- notify without enough data (probably a bad or invalid bubble notify
- identifier). This is probably a duplicate of #1181324 I am filling this
- report just in case that the stacktrace helps to debug more info about
- the problem.
+ This crash happens sometimes when a Liferea sends a bubble notify what
+ needs bubble private checking data (probably a bad or invalid bubble
+ notify identifier). This is probably a duplicate of #1181324 I am
+ filling this report just in case that the stacktrace helps to debug more
+ info about the problem.
  
  ProblemType: Crash
  DistroRelease: Ubuntu 13.10
  Package: notify-osd 0.9.35daily13.05.30-0ubuntu1
  ProcVersionSignature: Ubuntu 3.8.0-13.23-generic 3.8.3
  Uname: Linux 3.8.0-13-generic i686
  ApportVersion: 2.10.2-0ubuntu1
  Architecture: i386
  CrashCounter: 1
  Date: Mon Jun 10 01:10:43 2013
  DesktopSession: 'ubuntu'
  ExecutablePath: /usr/lib/i386-linux-gnu/notify-osd
  GtkTheme: 'Ambiance'
  IconTheme: 'ubuntu-mono-dark'
  InstallationDate: Installed on 2013-02-03 (126 days ago)
  InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release i386 (20100429)
  MachineType: Acer Aspire 5943G
  MarkForUpload: True
  ProcCmdline: /usr/lib/i386-linux-gnu/notify-osd
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.8.0-13-generic 
root=UUID=7f18d659-ec06-4afe-b3be-13b15de376b2 ro quiet splash vt.handoff=7
  RelatedPackageVersions:
-  xserver-xorg             1:7.7+1ubuntu4
-  libgl1-mesa-glx          9.1.3-0ubuntu2
-  libdrm2                  2.4.45-2ubuntu1
-  xserver-xorg-video-intel 2:2.21.9-0ubuntu1
-  xserver-xorg-video-ati   1:7.1.0-0ubuntu2
+  xserver-xorg             1:7.7+1ubuntu4
+  libgl1-mesa-glx          9.1.3-0ubuntu2
+  libdrm2                  2.4.45-2ubuntu1
+  xserver-xorg-video-intel 2:2.21.9-0ubuntu1
+  xserver-xorg-video-ati   1:7.1.0-0ubuntu2
  SegvAnalysis:
-  Segfault happened at: 0x8056a87 <bubble_get_id+23>:  cmp    %eax,(%edx)
-  PC (0x08056a87) ok
-  source "%eax" ok
-  destination "(%edx)" (0xaaaaaaaa) not located in a known VMA region (needed 
writable region)!
+  Segfault happened at: 0x8056a87 <bubble_get_id+23>:  cmp    %eax,(%edx)
+  PC (0x08056a87) ok
+  source "%eax" ok
+  destination "(%edx)" (0xaaaaaaaa) not located in a known VMA region (needed 
writable region)!
  SegvReason: writing unknown VMA
  Signal: 11
  SourcePackage: notify-osd
  StacktraceTop:
-  bubble_get_id ()
-  stack_notify_handler ()
-  
dbus_glib_marshal_stack_VOID__STRING_UINT_STRING_STRING_STRING_BOXED_BOXED_INT_POINTER
 ()
-  ?? () from /usr/lib/i386-linux-gnu/libdbus-glib-1.so.2
-  ?? () from /lib/i386-linux-gnu/libdbus-1.so.3
+  bubble_get_id ()
+  stack_notify_handler ()
+  
dbus_glib_marshal_stack_VOID__STRING_UINT_STRING_STRING_STRING_BOXED_BOXED_INT_POINTER
 ()
+  ?? () from /usr/lib/i386-linux-gnu/libdbus-glib-1.so.2
+  ?? () from /lib/i386-linux-gnu/libdbus-1.so.3
  Title: notify-osd crashed with SIGSEGV in bubble_get_id()
  UpgradeStatus: Upgraded to saucy on 2013-02-03 (126 days ago)
  UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare
  dmi.bios.date: 05/07/2010
  dmi.bios.vendor: Acer
  dmi.bios.version: V1.06
  dmi.board.asset.tag: Base Board Asset Tag
  dmi.board.name: Aspire 5943G
  dmi.board.vendor: Acer
  dmi.board.version: V1.06
  dmi.chassis.type: 10
  dmi.chassis.vendor: Acer
  dmi.chassis.version: V1.06
  dmi.modalias: 
dmi:bvnAcer:bvrV1.06:bd05/07/2010:svnAcer:pnAspire5943G:pvrV1.06:rvnAcer:rnAspire5943G:rvrV1.06:cvnAcer:ct10:cvrV1.06:
  dmi.product.name: Aspire 5943G
  dmi.product.version: V1.06
  dmi.sys.vendor: Acer

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1189281

Title:
  notify-osd crashed with SIGSEGV while checking bubble private mode
  G_TYPE_INSTANCE_GET_PRIVATE in bubble_get_id()

To manage notifications about this bug go to:
https://bugs.launchpad.net/liferea/+bug/1189281/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to