liferea crashes when it jumps to a new article

oh, I have forgotten to say that I have the 64 bit installation of ubuntu.

Just want to add in my error here, because this seems to be the same problem as mine. #5111 https://launchpad.net/distros/ubuntu/+source/liferea/+bug/5111 seems very similar as well, I went with this one cause this person they are using dapper, I am as well. I have the same package as the person above. I can't get a backtrace though, when it crashes it doesnt tell me that it had an error like most programs do, so I don't know how to get that. Here is what the commandline reads after a crash.
Oh yeah, this too: "Unhandled property: 12 border-collapse" pops up everytime I switch to a new article.

bmartens@shrift:~$ liferea
No browser module configured!
trying to load browser module GtkHTML2 (liblihtmlg.so)
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse

(liferea-bin:18307): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed
Segmentation fault

I get (most probably) the same crash... I'll try to debug it further later:

[...]
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse

(liferea-bin:16364): GLib-GObject-WARNING **: IA__g_object_weak_unref: couldn't find weak ref 0xb7724ac2(0x8343320)
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
Unhandled property: 12 border-collapse
*** glibc detected *** corrupted double-linked list: 0x0836abc8 ***
---Type <return> to continue, or q <return> to quit---

Program received signal SIGABRT, Aborted.
[Switching to Thread -1219835680 (LWP 16364)]
0xffffe410 in __kernel_vsyscall ()
(gdb) thread apply all bt

Thread 5 (Thread -1247749200 (LWP 16370)):
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb765d7c1 in select () from /lib/tls/i686/cmov/libc.so.6
#2 0x08099f00 in NetPoll ()
#3 0x0809a408 in NetIO ()
#4 0x0809b871 in DownloadFeed ()
#5 0x0809ba09 in downloadlib_process_url ()
#6 0x080981c9 in download_process ()
#7 0x08098596 in download_init ()
#8 0xb771ab92 in g_static_private_free () from /usr/lib/libglib-2.0.so.0
#9 0xb76cf361 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#10 0xb7664bce in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 4 (Thread -1239356496 (LWP 16369)):
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb76d4818 in connect () from /lib/tls/i686/cmov/libpthread.so.0
#2 0x0809a06e in NetConnect ()
#3 0x0809b83a in DownloadFeed ()
#4 0x0809ba09 in downloadlib_process_url ()
---Type <return> to continue, or q <return> to quit---
#5 0x080981c9 in download_process ()
#6 0x08098596 in download_init ()
#7 0xb771ab92 in g_static_private_free () from /usr/lib/libglib-2.0.so.0
#8 0xb76cf361 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#9 0xb7664bce in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 3 (Thread -1230963792 (LWP 16368)):
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb7655d3b in read () from /lib/tls/i686/cmov/libc.so.6
#2 0xb75faf58 in _IO_file_read () from /lib/tls/i686/cmov/libc.so.6
#3 0xb75fb48f in _IO_file_xsputn () from /lib/tls/i686/cmov/libc.so.6
#4 0xb75fc3d8 in _IO_sgetn () from /lib/tls/i686/cmov/libc.so.6
#5 0xb75f04f9 in fread () from /lib/tls/i686/cmov/libc.so.6
#6 0x0809a7da in NetIO ()
#7 0x0809b871 in DownloadFeed ()
#8 0x0809ba09 in downloadlib_process_url ()
#9 0x080981c9 in download_process ()
#10 0x08098596 in download_init ()
#11 0xb771ab92 in g_static_private_free () from /usr/lib/libglib-2.0.so.0
#12 0xb76cf361 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
---Type <return> to continue, or q <return> to quit---
#13 0xb7664bce in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 2 (Thread -1222571088 (LWP 16367)):
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb76d1c96 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib/tls/i686/cmov/libpthread.so.0
#2 0xb76ea6bc in g_async_queue_push () from /usr/lib/libglib-2.0.so.0
#3 0xb76ea7a9 in g_async_queue_pop () from /usr/lib/libglib-2.0.so.0
#4 ...

I did send an email to Nathan Conrad with a backtrace of liferea crashing. I hope that it can get sorted out.

debug backtrace:

#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb76559a1 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0xb76572b9 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0xb76896da in __libc_message () from /lib/tls/i686/cmov/libc.so.6
#4 0xb768f6ed in malloc_consolidate () from /lib/tls/i686/cmov/libc.so.6
#5 0xb76905c3 in _int_malloc () from /lib/tls/i686/cmov/libc.so.6
#6 0xb7692381 in malloc () from /lib/tls/i686/cmov/libc.so.6
#7 0xb79a292f in xmlBufferCreateSize__internal_alias (size=8192) at tree.c:6593
#8 0xb79aa3b6 in xmlAllocParserInputBuffer__internal_alias (enc=XML_CHAR_ENCODING_NONE) at xmlIO.c:2016
#9 0xb79c83a4 in htmlCreatePushParserCtxt__internal_alias (sax=0xb72c5ee0, user_data=0x83161a0, chunk=0x83161c0 "",
    size=0, filename=0x0, enc=XML_CHAR_ENCODING_NONE) at HTMLparser.c:5303
#10 0xb72891b2 in html_parser_new (document=0x0, parser_type=HTML_PARSER_TYPE_HTML) at htmlparser.c:283
#11 0xb72882d1 in html_document_open_stream (document=0x8388338, mime_type=0xb7329d5a "text/html") at htmldocument.c:747
#12 0xb73295b2 in gtkhtml2_destroyed_cb () from /usr/lib/liferea/liblihtmlg.so
#13 0x0808cc26 in ui_htmlview_write ()
#14 0x0807cf3f in item_display ()
#15 0x0807e2ea in on_itemlist_selection_changed ()

debug version of package too:

Thread 1 (Thread -1220314912 (LWP 23224)):
#0 0xffffe410 in __kernel_vsyscall ()
#1 0xb754f9a1 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0xb75512b9 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0xb75836da in __libc_message () from /lib/tls/i686/cmov/libc.so.6
#4 0xb75896ed in malloc_consolidate () from /lib/tls/i686/cmov/libc.so.6
---Type <return> to continue, or q <return> to quit---
#5 0xb7589cc0 in _int_free () from /lib/tls/i686/cmov/libc.so.6
#6 0xb758a2ba in free () from /lib/tls/i686/cmov/libc.so.6
#7 0xb78bda80 in xmlBufferFree__internal_alias (buf=0x8385358) at tree.c:6676
#8 0xb78c563e in xmlFreeParserInputBuffer__internal_alias (in=0x83ddfe8)
    at xmlIO.c:2100
#9 0xb7893b9d in xmlFreeInputStream__internal_alias (input=0x83d8640)
    at parserInternals.c:1312
#10 0xb7894891 in xmlFreeParserCtxt__internal_alias (ctxt=0x8336230)
    at parserInternals.c:1719
#11 0xb718410d in html_parser_finalize (object=0x83d4828) at htmlparser.c:197
#12 0xb7a4edb9 in IA__g_object_unref (_object=0x83d4828) at gobject.c:1702
#13 0xb71833ee in html_document_finalize (object=0x83b1658)
    at htmldocument.c:487
#14 0xb7a4edb9 in IA__g_object_unref (_object=0x83b1658) at gobject.c:1702
#15 0xb71aea2c in html_view_set_document (view=0x82f1e68, document=0x81f7df8)
    at htmlview.c:2782
#16 0xb722454c in write_html (scrollpane=0x82efc58,
    string=0x83f43e8 "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\">\n<html>\n<head>\n<title></title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">\n<base href=\"http://linuxfr.org/\">\n<styl"..., length=9673, base=0x81aa590 "http://linuxfr.org/",
    contentType=0x80966b1 "text/html") at gtkhtml2.c:304
#17 0x08085cb3 in ui_htmlview_write (htmlview=0x82efc58,
---Type <return> to continue, or q <return> to quit---
    string=0x83f43e8 "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\">\n<html>\n<head>\n<title></title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">\n<base href=\"http://linuxfr.org/\">\n<styl"..., base=0x81aa590 "http://linuxfr.org/") at ui_htmlview.c:343
#18 0x08076c32 in item_display (ip=0x83133c0) at item.c:364
#19 0x0807807a in on_itemlist_selection_changed (selection=0x812f730, data=0x0)
    at itemlist.c:400

Hmm...

Tested here and with a friend. This crash seems to happen only if you are using a new Clearlooks Cairo enabled theme.

It cannot be reproduced with this new clearlooks theme. Is this a bug from the GTK engine ?

I suggest to change the title to reflect this.

I can reproduce this problem even with the ulgy default theme

no, it does crash with other themes too

The default theme (human) use also clearlooks engine. Try with a theme that doesn't use clearlooks.

I'm pretty sure it's the theme because :

- I hadn't any crash. I upgraded the clearlooks engine from dapper *and nothing else* and then crashes happened. (without changing antyhing in liferea)

- I changed my theme to human : it crashes. I changed it to Mist one day ago. No crash anymore.

- I'm not the only one who verified those two points.

apologies ! After one full day, I just have a crash with the "Mist" theme. I was wrong, this is not the theme then...

np but as I said before, it even crashes with the default gtk theme which is not human but this win95-like, ugly thing ;)

It's most probably a bug in gtkhtml itself

for me it's working now. I had no more crashes over the last days. I guess some of the last upgrades did resolve the problem

Same for me on x86 and ppc... but it still seems to crash often on am64

Can anyone reproduce this on the latest Dapper packages?

Yes, this still happens on amd64... x86 and ppc don't have any problems

Sebastian,

Since it has been more than a couple of months, may I ask if this issue still happens on the AMD64 machine that you said it happens on?

If this is no longer a problem, let us know so we can close this bug. It already is no longer a bug for other archs, looks like :)

This issue still happens here on my amd64.

If I change the browser setting to "Show Article with Mozilla" I do not experience a crash anymore. So possibly it has to do with the usage of GtkHTML2, not with Liferea itself.

Still happenning with liferea on amd64 and gtkhtml2, final version of Dapper Drake.

I'm using "mozilla" instead of "GtkHTML2", and it doesn't clarsh anymore. So it must be a bug from GtkHTML2.

This should be fixed with 1.0.16-0ubuntu1 in edgy. Please reopen otherwise

It still crashes on edgy in 64bit (1.0.16-0ubuntu1_amd64).
Here is backtrace:

#0 0x00002ae760280204 in memcpy () from /lib/libc.so.6
#1 0x00002ae75e0a9230 in _gdk_x11_convert_to_format ()
   from /usr/lib/libgdk-x11-2.0.so.0
#2 0x00002ae75e0aa078 in gdk_x11_drawable_get_xdisplay ()
   from /usr/lib/libgdk-x11-2.0.so.0
#3 0x00002ae75e09b89d in gdk_window_get_window_type ()
   from /usr/lib/libgdk-x11-2.0.so.0
#4 0x00002ae75dcf5083 in gtk_image_new_from_pixmap ()
   from /usr/lib/libgtk-x11-2.0.so.0
#5 0x00002ae75dd16afd in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#6 0x00002ae75f0686b0 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#7 0x00002ae75f077cff in g_signal_chain_from_overridden ()
   from /usr/lib/libgobject-2.0.so.0
#8 0x00002ae75f078bde in g_signal_emit_valist ()
   from /usr/lib/libgobject-2.0.so.0
#9 0x00002ae75f078ff3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#10 0x00002ae75de0eeee in gtk_widget_get_default_style ()
   from /usr/lib/libgtk-x11-2.0.so.0
#11 0x00002ae75dc8fad1 in gtk_container_propagate_expose ()
   from /usr/lib/libgtk-x11-2.0.so.0
#12 0x00002ae75dc9052e in gtk_container_forall ()
   from /usr/lib/libgtk-x11-2.0.so.0
#13 0x00002ae75dc5b1d4 in _gtk_button_paint ()
   from /usr/lib/libgtk-x11-2.0.so.0
#14 0x00002ae75dd16afd in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#15 0x00002ae75f0686b0 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#16 0x00002ae75f077cff in g_signal_chain_from_overridden ()
   from /usr/lib/libgobject-2.0.so.0
#17 0x00002ae75f078bde in g_signal_emit_valist ()
   from /usr/lib/libgobject-2.0.so.0
#18 0x00002ae75f078ff3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#19 0x00002ae75de0eeee in gtk_widget_get_default_style ()
   from /usr/lib/libgtk-x11-2.0.so.0
#20 0x00002ae75dc8fad1 in gtk_container_propagate_expose ()
   from /usr/lib/libgtk-x11-2.0.so.0
#21 0x00002ae75dc9052e in gtk_container_forall ()
   from /usr/lib/libgtk-x11-2.0.so.0
#22 0x00002ae75dd16afd in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#23 0x00002ae75f0686b0 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#24 0x00002ae75f077cff in g_signal_chain_from_overridden ()
   from /usr/lib/libgobject-2.0.so.0
#25 0x00002ae75f078bde in g_signal_emit_valist ()
   from /usr/lib/libgobject-2.0.so.0
#26 0x00002ae75f078ff3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#27 0x00002ae75de0eeee in gtk_widget_get_default_style ()
   from /usr/lib/libgtk-x11-2.0.so.0
#28 0x00002ae75dc8fad1 in gtk_container_propagate_expose ()
   from /usr/lib/libgtk-x11-2.0.so.0
#29 0x00002ae75ddcc6e7 in gtk_toolbar_set_drop_highlight_item ()
   from /usr/lib/libgtk-x11-2.0.so.0
#30 0x00002ae75dd16afd in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#31 0x00002ae75f0686b0 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#32 0x00002ae75f077cff in g_signal_chain_from_overridden ()
   from /usr/lib/libgobject-2.0.so.0
#33 0x00002ae75f078bde in g_signal_emit_valist ()
   from /usr/lib/libgobject-2.0.so.0
#34 0x00002ae75f078ff3 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#35 0x00002ae7...

It crashes here, too -> reopened

This _may_ be fixed with 1.0.20-0ubuntu1 now... can somebody on amd64 confirm this and close the bug?

It still crashes here

Upgraded today to liferea 1.0.21-0ubuntu1 and liferea with gtkhtml2 does not crash anymore although it still prints as debug everytime new article is opened: "Unhandled property: 12 border-collapse".

Mozilla-plugin doesn't print that error and works too fine.

Thanks for everyone on fixing this bug. :)

Christian, does it work for you? Can we close this bug.
Thanks for the feedback, lemonade.

Unfortunately the new version (1.0.21-0ubuntu1) doesn't fix this problem here. I will create a new backtrace soon... maybe there is something helpful now.

Here is the backtrace

And a hopefully helpful valgrind log.

+1. Still crashes for me on amd64 only. (Running edgy: 1.0.23-0ubuntu1)

Happened again, attaching report.

ii liferea 1.0.23-0ubuntu2
ii liferea-gtkhtml 1.0.23-0ubuntu2

Linux vladimir-desktop 2.6.17-10-generic #2 SMP Fri Oct 13 15:34:39 UTC 2006 x86_64 GNU/Linux

Workaround: this crash appears to be related to the GtkHTML2 backend. Since switching (Program/Preferences/Browser/View Headlines With...) to "Mozilla" as the backend, I have not seen liferea crash again.

Can anybody confirm if this happens also with liferea 1.2.4? I have tried to reproduce this on my Feisty up-to-date without success... or with success, as I haven't this bug :)

Regards
Pochu

Ubuntu feisty here with flashplugin-nonfree. I've noticed that liferea crashes whenever it jumps to an article with an embedded Flash video.

Hey Augusto: could you attach the crash log in /var/crash ? That will help us a lot, in order to fix the bug.

Thanks
Pochu

Hello Pochu. Unfortunately there's nothing in /var/crash related to liferea. As there were some files in /var/crash, I've just forced a liferea crash by browsing to an article with a Flash video, and no new file showed up in /var/crash.

Then it should log the crash in another directory... but don't know which ;)

But you can try to get a backtrace reading this:
<http://wiki.ubuntu.com/DebuggingProgramCrash>

Regards
Pochu

Backtrace file. It's not actually a backtrace; I wonder why not.

Strace log.

I have a duplicatable crash, when moving from an article with a video and two mp3 attachments to another one.

gdb backtrace isn't awfully useful, but...

[00000279] main private debug: thread 2953206688 joined (playlist/playlist.c:247)
[00000278] main playlist debug: thread 2936421280 joined (playlist/playlist.c:248)
[00000278] main playlist debug: deleting playlist item `http://www.splattermail.org/wp-content/uploads/2007/02/04-map-of-the-problematique.mp3'
[00000278] main playlist debug: deleting playlist item `http://www.splattermail.org/wp-content/uploads/2007/02/04-map-of-the-problematique.mp3'
[00000278] main playlist debug: deleting playlist item `http://www.splattermail.org/wp-content/uploads/2007/02/04-map-of-the-problematique.mp3'
[00000278] main playlist debug: deleting playlist item `http://www.splattermail.org/wp-content/uploads/2007/02/04-map-of-the-problematique.mp3'
[00000001] main vlc debug: removing all video outputs
[00000001] main vlc debug: removing all audio outputs
[00000001] main vlc debug: removing module "memcpy"

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1220241744 (LWP 21343)]
0xb759be09 in vfprintf () from /lib/tls/i686/cmov/libc.so.6
(gdb) bt
#0 0xb759be09 in vfprintf () from /lib/tls/i686/cmov/libc.so.6
#1 0xb75bdb8c in vasprintf () from /lib/tls/i686/cmov/libc.so.6
#2 0xae6dd60f in __msg_Create () from /usr/lib/libvlc.so.0
#3 0xbf754708 in ?? ()
#4 0xae7d2120 in ?? () from /usr/lib/libvlc.so.0
#5 0xbf754754 in ?? ()
#6 0xfbad8000 in ?? ()
#7 0x091cb480 in ?? ()
#8 0x091cb480 in ?? ()
#9 0xb767f5b4 in _libc_intl_domainname () from /lib/tls/i686/cmov/libc.so.6
#10 0x091cb480 in ?? ()
#11 0xb768fff4 in ?? () from /lib/tls/i686/cmov/libc.so.6
#12 0x00000016 in ?? ()
#13 0x00000016 in ?? ()
#14 0xbf7546d0 in ?? ()
#15 0x00000001 in ?? ()
#16 0x00000000 in ?? ()

This looks like a VLC crash to me. I would suggest opening a new bug
report against the "vlc" package and include the same back-trace.

I'm closing the report, as this seems to be happening just with the liferea-gtkhtml engine, which has been deprecated (and it's no longer shipped since Feisty.

If you can reproduce it with liferea-mozilla, please, reopen it.