devhelp and many other apps crash with SIGSEGV in g_closure_invoke() due to overlay-scrollbars

StacktraceTop:
 ?? ()
 g_cclosure_marshal_generic_va (closure=<error reading variable: Cannot access memory at address 0xffffffffffffff40>, return_value=<error reading variable: Cannot access memory at address 0xffffffffffffff20>, instance=<error reading variable: Cannot access memory at address 0xffffffffffffff68>, args_list=<optimized out>, marshal_data=<error reading variable: Cannot access memory at address 0xffffffffffffff18>, n_params=<error reading variable: Cannot access memory at address 0xffffffffffffff4c>, param_types=<error reading variable: Cannot access memory at address 0x10>) at /build/buildd/glib2.0-2.43.0~git20141021.4125415e/./gobject/gclosure.c:1552

apport-retrace --stdout /var/crash/_usr_bin_devhelp.1000.crash gives me this.

I had a long gdb session on this with the help of #gnome-hackers on irc.gnome.org.

This crash (and many like it) was caused by code in /usr/lib/x86_64-linux-gnu/gtk-3.0/modules/liboverlay-scrollbar.so. Instead of debugging it to the bitter end I apt-get removed overlay-scrollbar-gtk3 and the crashes are gone

BTW you may want to apt-get purge overlay-scrollbar to avoid spurious error messages on the console (bug 1134202).

This will need to be fixed for gtk+3.14 to land in vivid

Details about my GDB session:

- gdb gnome-calculator (easy to trigger the bug: click on the titlebar dropdown; bonus: doesn't hold a keyboard/mouse grab when it gets frozen by gdb)
- 'run'
- click on the titlebar dropdown, see the window freeze
- gdb shows a segfault at 0x0
- 'bt' shows the stack trace; frame #1 is g_closure_invoke; the closure pointer is the same for every crash
- higher up in the stack you see it was called by gtk_grab_notify()
- set a conditional breakpoint 'b g_closure_invoke if closure == 0x....'
- 'run' to restart
- click on the titlebar dropdown again
- the breakpoint trips three times; first two are benign so hit 'cont' twice; the third one causes the crash
- single-stepping with 'n' and 's' shows that you end up in g_type_class_meta_marshal() for GtkScrollbar, with a callback at some address (0x7fffeeb3abe0)
- gdb was unable to resolve that address to a symbol, but /proc/$(pidof gnome-calculator)/maps shows it was in the range mapped to /usr/lib/x86_64-linux-gnu/gtk-3.0/modules/liboverlay-scrollbar.so

For the record, I had overlay scrollbars disabled ('gsettings set com.canonical.desktop.interface scrollbar-mode normal') when I saw these segfaults.

This patch fixes the crash: https://gist.github.com/84d1545df63a4e0ad981

Here's what causes the crash:

- overlay-scrollbar's gtk_module_init() does this:

    widget_class = g_type_class_ref (GTK_TYPE_SCROLLBAR)
    pre_hijacked_scrollbar_grab_notify = widget_class->grab_notify;

  In GTK+ 3.14 widget_class->grab_notify for GTK_TYPE_SCROLLBAR is NULL.

- overlay-scrollbar's patch_scrollbar_class_vtable() does this:

    if (widget_class->grab_notify == pre_hijacked_scrollbar_grab_notify)
      widget_class->grab_notify = hijacked_scrollbar_grab_notify;

  Since widget_class->grab_notify is still NULL and it is equal to pre_hijacked_scrollbar_grab_notify, we install our own signal handler.

- overlay-scrollbar's hijacked_scrollbar_grab_notify() does this:

    if (use_overlay_scrollbar ())
      return;

    (* pre_hijacked_scrollbar_grab_notify) (widget, was_grabbed);

  Since in Ubuntu GNOME use_overlay_scrollbar() returns a false value due, this code calls a NULL pointer and segfaults.

A more future-proof fix would be to check all pre_hijacked_ handlers before calling them.

GtkScrollbar stopped paying attention to grab_notify signals in upstream commit 26dff0d7830b45b61fb4266664e4a5c1f98c4091 somewhere in 3.13.x.

You can see it online at https://github.com/GNOME/gtk/commit/26dff0d7830b45b61fb4266664e4a5c1f98c4091

Status changed to 'Confirmed' because the bug affects multiple users.

Looks like this is only to call the pre hijacked one if not on os, so probably OK and similar probably should be done for all of these hijacked functions. Lars, could you look?

Fixed for me by the following package upgrades fixed the problem for me:
   overlay-scrollbar (0.2.16+r359+14.10.20140625-0ubuntu1 => 0.2.16+r359+14.10.20140625-0ubuntu2~utopic1)
   overlay-scrollbar-gtk2 (0.2.16+r359+14.10.20140625-0ubuntu1 => 0.2.16+r359+14.10.20140625-0ubuntu2~utopic1)
   overlay-scrollbar-gtk3 (0.2.16+r359+14.10.20140625-0ubuntu1 => 0.2.16+r359+14.10.20140625-0ubuntu2~utopic1)

Before that, the problem actually went away by *enabling* rather than disabling the overlay-scrollbars (overlay-auto instead of normal)

Also see https://bugzilla.gnome.org/show_bug.cgi?id=738073

This bug was fixed in the package overlay-scrollbar - 0.2.16+r359+15.04.20141126-0ubuntu1

---------------
overlay-scrollbar (0.2.16+r359+15.04.20141126-0ubuntu1) vivid; urgency=low

  [ Tim Lunn ]
  * Check for null grab_notify handler before hijacking it. This fixes a
    crash in GTK+3.14 where grab_notify is no longer used, Thanks Marius
    Gedminas for the fix! (LP: #1386255)
 -- Ubuntu daily release <email address hidden> Wed, 26 Nov 2014 15:18:56 +0000