Bug#708559: Seeing the same issue with chrome

[Tobias Diedrich]

I'm seeing the same issue triggered by using dwm and chrome:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff282d616 in gtk_tray_icon_manager_filter (xevent=0x7fffffffd9c0,
event=<optimized out>, user_data=0x2b036eb7f9d0)
    at /build/gtk+2.0-czQfyJ/gtk+2.0-2.24.25/gtk/gtktrayicon-x11.c:400
400     /build/gtk+2.0-czQfyJ/gtk+2.0-2.24.25/gtk/gtktrayicon-x11.c: No
such file or directory.
(gdb)  bt
#0  0x00007ffff282d616 in gtk_tray_icon_manager_filter
(xevent=0x7fffffffd9c0, event=<optimized out>, user_data=0x2b036eb7f9d0)
    at /build/gtk+2.0-czQfyJ/gtk+2.0-2.24.25/gtk/gtktrayicon-x11.c:400
#1  0x00007ffff230ed71 in gdk_event_apply_filters (xevent=0x7fffffffd9c0,
event=0x2b036f9ee500, window=0x0)
    at /build/gtk+2.0-czQfyJ/gtk+2.0-2.24.25/gdk/x11
/gdkevents-x11.c:371
#2  0x00007ffff2310074 in gdk_event_translate (display=0x2b0364a4d020
[GdkDisplayX11], event=0x2b036f9ee500, xevent=0x7fffffffd9c0,
return_exposes=return_exposes at entry=0) at
/build/gtk+2.0-czQfyJ/gtk+2.0-2.24.25/gdk/x11/gdkevents-x11.c:969
#3  0x00007ffff2311a86 in _gdk_events_queue
(display=display at entry=0x2b0364a4d020
[GdkDisplayX11])
    at /build/gtk+2.0-czQfyJ/gtk+2.0-2.24.25/gdk/x11/gdkevents-x11.c:2358
#4  0x00007ffff2311b2e in gdk_event_dispatch (source=<optimized out>,
callback=<optimized out>, user_data=<optimized out>)
    at /build/gtk+2.0-czQfyJ/gtk+2.0-2.24.25/gdk/x11/gdkevents-x11.c:2419
#5  0x00007ffff72b3c3d in g_main_context_dispatch (context=0x2b03649df790)
at /build/glib2.0-NiYzoW/glib2.0-2.44.1/./glib/gmain.c:3122
#6  0x00007ffff72b3c3d in g_main_context_dispatch (context=context at entry
=0x2b03649df790)
    at /build/glib2.0-NiYzoW/glib2.0-2.44.1/./glib/gmain.c:3737
#7  0x00007ffff72b3f20 in g_main_context_iterate
(context=context at entry=0x2b03649df790,
block=block at entry=0, dispatch=dispatch at entry=1, self=<optimized out>) at
/build/glib2.0-NiYzoW/glib2.0-2.44.1/./glib/gmain.c:3808
#8  0x00007ffff72b3fcc in g_main_context_iteration (context=0x2b03649df790,
may_block=0)
    at /build/glib2.0-NiYzoW/glib2.0-2.44.1/./glib/gmain.c:3869
#9  0x00005555565b1e12 in  ()
#10 0x00002b03649e4480 in  ()
#11 0x00000001565b9500 in  ()
#12 0x0000000000000001 in  ()
#13 0x00007fffffffdca8 in  ()
#14 0x0000555555fdc028 in  ()
#15 0x00007fffffffdf50 in  ()
#16 0x00007fffffffdc38 in  ()
#17 0x00002b0364a15ea0 in  ()
#18 0x000055555b3927d0 in  ()
#19 0x0000555556579540 in  ()
#20 0x000055555b3927d0 in  ()
#21 0x00000000012e444f in  ()
#22 0x00002b0364a14c80 in  ()
#23 0x00002b0300052a20 in  ()
#24 0x0000000000000000 in  ()
(gdb)


The gtktrayicon-x11.c code is this:
383: static GdkFilterReturn
384: gtk_tray_icon_manager_filter (GdkXEvent *xevent,
385:       GdkEvent  *event,
386:       gpointer   user_data)
387: {
388:   GtkTrayIcon *icon = user_data;
389:   XEvent *xev = (XEvent *)xevent;
390:
391:   if (xev->xany.type == ClientMessage &&
392:       xev->xclient.message_type == icon->priv->manager_atom &&
393:       xev->xclient.data.l[1] == icon->priv->selection_atom)
394:     {
395:       GTK_NOTE (PLUGSOCKET,
396:  g_print ("GtkStatusIcon %p: tray manager appeared\n", icon));
397:
398:       gtk_tray_icon_update_manager_window (icon);
399:     }
400:   else if (xev->xany.window == icon->priv->manager_window)
    {
      if (xev->xany.type == PropertyNotify &&
  xev->xproperty.atom == icon->priv->orientation_atom)
{
          GTK_NOTE (PLUGSOCKET,
    g_print ("GtkStatusIcon %p: got PropertyNotify on manager window for
orientation atom\n", icon));

  gtk_tray_icon_get_orientation_property (icon);
}
      else if (xev->xany.type == DestroyNotify)
{
          GTK_NOTE (PLUGSOCKET,
    g_print ("GtkStatusIcon %p: got DestroyNotify for manager window\n",
icon));

  gtk_tray_icon_manager_window_destroyed (icon);
}
      else
        GTK_NOTE (PLUGSOCKET,
  g_print ("GtkStatusIcon %p: got other message on manager window\n",
icon));
    }

  return GDK_FILTER_CONTINUE;
}


I suspect that this is a nullpointer dereference of icon->priv?
If there is an upstream fix in GTK+3, it would be nice to backport this to
the gtk2 lib as I'm getting ~daily crashes from this bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/pkg-gnome-maintainers/attachments/20150531/4ebcb5b3/attachment-0001.html>