gnome-settings-daemon crashed with SIGSEGV in __libc_free()

StacktraceTop:
 *__GI___libc_free (mem=0x7ff45e1cb2e3)
 popup_menu_set_group (item=<value optimized out>,
 apply_xkb_settings () at gsd-keyboard-xkb.c:546
 g_closure_invoke (closure=0x234bf80,
 signal_emit_unlocked_R (node=0x2336140,

Hmmm, it's a shame that the trace doesn't show the value of group_number in frame #1. If group_number > g, then there would be a condition where free() is called on an uninitialized pointer, which I guess is what is happening here (layout_name looks fairly uninitialized to me)

@Chris, can you tell if this is the same as bug 658777 or not?

Bug 658777 was a different issue, but still one that could have caused a similar crash, and I fixed that one already.

We could just initialize the pointer that I think is being wrongly freed here, but the condition that causes it to happen shouldn't really occur anyway, so I'd like to try and figure that out too. How often does this normally happen?

On Tue, Dec 14, 2010 at 12:30:29PM -0000, Chris Coulson wrote:
> We could just initialize the pointer that I think is being wrongly freed
> here, but the condition that causes it to happen shouldn't really occur
> anyway, so I'd like to try and figure that out too. How often does this
> normally happen?

It happens about once or twice per week, perhaps depending on how often I
suspend and resume.

I could try plugging in a USB keyboard repeatedly and see if that triggers
the problem, but at present I have no recipe.

--
 - mdz

I rebuilt gnome-settings-daemon for debugging, and just had it crash again. Unfortunately, telepathy-gabble is also still crashing routinely on my system (bug 668306) and this seems to have prevented apport from capturing the crash because they both crashed at the same time:

apport (pid 2974) Thu Dec 16 08:44:10 2010: another apport instance is already running, aborting
apport (pid 2996) Thu Dec 16 08:44:10 2010: called for pid 30681, signal 11
apport (pid 2996) Thu Dec 16 08:44:10 2010: executable: /usr/lib/telepathy/telepathy-gabble (command line "/usr/lib/telepathy/telepathy-gabble")
apport (pid 2996) Thu Dec 16 08:44:13 2010: this executable already crashed 2 times, ignoring

Two other symptoms I've seen which may be related:

X Error of failed request: XI_BadDevice (invalid Device parameter)
  Major opcode of failed request: 141 (XInputExtension)
  Minor opcode of failed request: 37 (X_ChangeDeviceProperty)
  Device id in failed request: 0x17
  Serial number of failed request: 1476
  Current serial number in output stream: 1477

The above was output by gnome-settings-daemon while it was running in the background attached to a terminal.

** (gnome-settings-daemon:1869): WARNING **: Connection failed, reconnecting...

The above was found in ~/.xsession-errors, adjacent to update-notifier's "checking for valid crashreport now" indicating a crash happened around the same time (though it may or may not have been gnome-settings-daemon).

I've tried repeatedly suspending and resuming my laptop, and also connecting and disconnecting a USB keyboard while it's running, to try to trigger this problem. So far, I have been unsuccessful in finding a reproducer, though it continues to crash as shown in comment #9.

@Chris - It looks like your hypothesis was correct.

I've rebuilt gnome-settings-daemon with DEB_BUILD_OPTIONS="noopt nostrip" to get a full stack trace, and filed a new crash report as bug 692149. Here's the popup_menu_set_group stack frame showing group_number > g:

#5 0x00007f4cb00667b0 in popup_menu_set_group (item=0x0, param=0x2) at gsd-keyboard-xkb.c:391
        shortnames = 0x1f8ef70
        lname = 0x1f8f050 "USA"
        ln2cnt_map = 0x1f8f9e0
        guide = 0x7f4cb006a507 "XXX"
        longnames = 0x1f8f0c0
        layout_name = 0x1 <Address 0x1 out of bounds>
        group_number = 2
        engine = 0x1650f80
        st = 0x165ba4c
        cur = 96469911
        __func__ = "popup_menu_set_group"
        xklrec = 0x1f16900
        registry = 0x1f8f2e0
        g = 1

Mike, as Chris already has tons of bugs assigned, do you have some time to look into this? Thanks!

Rodrigo says he has an idea about the issue

See attached branch. I think this should fix it, so please Matt, can you test it? To build the package, just run, from the branch:

bzr bd -- -b

and install the packages that it builds.

This bug was fixed in the package gnome-settings-daemon - 2.32.1-0ubuntu5

---------------
gnome-settings-daemon (2.32.1-0ubuntu5) natty; urgency=low

  * debian/patches/06_use_application_indicator.patch:
    - Initialize variable to avoid crashes on free (LP: #685785)
 -- Rodrigo Moya <email address hidden> Tue, 18 Jan 2011 16:23:55 +0100