Copying from https://bugs.debian.org/cgi-
bin/bugreport.cgi?bug=800723#96:
This is with thunar-1.6.10: (line numbers will be off because I was
adding debug printfs)
thunar_file_info_reload() touches memory deleted by
thunar_folder_reload()
I don't think this is a thread race because I always see both
functions running on the same thread.
What I think is happening here:
thunar_file_reload_idle() does:
g_idle_add((GSourceFunc) thunar_file_reload, file);
This defers a call of thunar_file_reload(file) until after
thunar_folder_reload() has deleted "file"
The crash looks like this in valgrind:
==12276== Process terminating with default action of signal 11 (SIGSEGV)
==12276== Access not within mapped region at address 0x0
==12276== at 0x4362BA: thunar_file_info_reload (thunar-file.c:977)
==12276== by 0x436720: thunar_file_load.constprop.8 (thunar-file.c:1179)
==12276== by 0x4367BF: thunar_file_reload (thunar-file.c:3931)
==12276== by 0x7E37E89: g_main_context_dispatch (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==12276== by 0x7E3822F: g_main_context_iterate.isra.29 (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==12276== by 0x7E38551: g_main_loop_run (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==12276== by 0x5E0A586: gtk_main (in
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0.2400.29)
==12276== by 0x41FBF8: main (main.c:314)
glib's g_main_context_dispatch() is calling into thunar_file_reload(),
which means it came via g_idle_add.
Then we get to this part of thunar_file_info_reload():
/* determine the basename */
file->basename = g_file_get_basename (file->gfile); //[1]
if (strcmp (file->basename, "kmsg") == 0 //[2]
[1] "file" has been freed, so the read (of gfile) and write (of
basename) are "invalid read/write of size 8" according to valgrind,
but don't crash.
g_file_get_basename() writes to the terminal:
(thunar:13169): GLib-GIO-CRITICAL **: g_file_get_basename: assertion
'G_IS_FILE (file)' failed
[2] file->basename is set to NULL, so the strcmp() attempt causes
SIGSEGV.
(strcmp doesn't appear in the backtrace because it gets compiled to a
"repz cmpsb" instruction)
If I comment out the g_idle_add, the bad memory accesses seem to go
away.
I'm not sure what the right fix for this is though.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1512120
Title:
[SRU] thunar crashes on file renaming
To manage notifications about this bug go to:
https://bugs.launchpad.net/thunar/+bug/1512120/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
