Bug 393058 - Embedded terminal crashes with invalid pointer
Summary: Embedded terminal crashes with invalid pointer
Status: RESOLVED DOWNSTREAM
Alias: None
Product: dolphin
Classification: Applications
Component: panels: terminal (show other bugs)
Version: 17.12.3
Platform: Arch Linux Linux
: NOR normal
Target Milestone: ---
Assignee: Dolphin Bug Assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-04-12 18:29 UTC by John Ramsden
Modified: 2018-08-02 02:17 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
Email thread with ZSH developer. (5.96 KB, text/plain)
2018-04-14 05:55 UTC, John Ramsden
Details

Note You need to log in before you can comment on or make changes to this bug.
Description John Ramsden 2018-04-12 18:29:06 UTC
Upon opening dolphin, I get a message in the terminal:

---

free(): invalid pointer


Warning: Program '/usr/bin/zsh' crashed.

---

This only happens in dolphin, and only upon opening a new dolphin window. If I close and re-open the terminal panel, there is no crash.
Comment 1 John Ramsden 2018-04-12 18:39:24 UTC
Actually, closing and re-opening the terminal panel still causes a crash.
Comment 2 Kai Uwe Broulik 2018-04-12 19:36:27 UTC
Can you get a gdb backtrace for this, please?
Comment 3 dreem 2018-04-12 20:57:21 UTC
Hi, I can confirm, just occured on my arch.

dreem@mecho ~/Desktop % coredumpctl gdb 1531
           PID: 1531 (zsh)
           UID: 1000 (dreem)
           GID: 1000 (dreem)
        Signal: 6 (ABRT)
     Timestamp: Thu 2018-04-12 22:49:56 CEST (2min 24s ago)
  Command Line: /usr/bin/zsh
    Executable: /usr/bin/zsh
 Control Group: /user.slice/user-1000.slice/session-c2.scope
          Unit: session-c2.scope
         Slice: user-1000.slice
       Session: c2
     Owner UID: 1000 (dreem)
       Boot ID: 5061339e45b94107b4dcc442b5aaeebb
    Machine ID: 663c77d312cf43228f53b38197a75db7
      Hostname: mecho
       Storage: /var/lib/systemd/coredump/core.zsh.1000.5061339e45b94107b4dcc442b5aaeebb.1531.1523566196000000.lz4
       Message: Process 1531 (zsh) of user 1000 dumped core.
                
                Stack trace of thread 1531:
                #0  0x00007f46e80ca860 raise (libc.so.6)
                #1  0x00007f46e80cbec9 abort (libc.so.6)
                #2  0x00007f46e810d437 __libc_message (libc.so.6)
                #3  0x00007f46e811378b malloc_printerr (libc.so.6)
                #4  0x00007f46e811524c _int_free (libc.so.6)
                #5  0x00007f46e789ee19 zrefresh (zle.so)
                #6  0x00007f46e78922e6 zleread (zle.so)
                #7  0x0000555af11bb784 zleentry (zsh)
                #8  0x0000555af11bccb8 n/a (zsh)
                #9  0x0000555af11b456c n/a (zsh)
                #10 0x0000555af11c665e n/a (zsh)
                #11 0x0000555af11e6437 parse_event (zsh)
                #12 0x0000555af11b7ee5 loop (zsh)
                #13 0x0000555af11bbdf6 zsh_main (zsh)
                #14 0x00007f46e80b6f4a __libc_start_main (libc.so.6)
                #15 0x0000555af11819aa _start (zsh)

GNU gdb (GDB) 8.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/zsh...(no debugging symbols found)...done.
[New LWP 1531]
Core was generated by `/usr/bin/zsh'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f46e80ca860 in raise () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007f46e80ca860 in raise () from /usr/lib/libc.so.6                                                                                                                                                                                                   
#1  0x00007f46e80cbec9 in abort () from /usr/lib/libc.so.6                                                                                                                                                                                                   
#2  0x00007f46e810d437 in __libc_message () from /usr/lib/libc.so.6                                                                                                                                                                                          
#3  0x00007f46e811378b in malloc_printerr () from /usr/lib/libc.so.6                                                                                                                                                                                         
#4  0x00007f46e811524c in _int_free () from /usr/lib/libc.so.6                                                                                                                                                                                               
#5  0x00007f46e789ee19 in zrefresh () from /usr/lib/zsh/5.5/zsh/zle.so                                                                                                                                                                                       
#6  0x00007f46e78922e6 in zleread () from /usr/lib/zsh/5.5/zsh/zle.so                                                                                                                                                                                        
#7  0x0000555af11bb784 in zleentry ()                                                                                                                                                                                                                        
#8  0x0000555af11bccb8 in ?? ()                                                                                                                                                                                                                              
#9  0x0000555af11b456c in ?? ()                                                                                                                                                                                                                              
#10 0x0000555af11c665e in ?? ()                                                                                                                                                                                                                              
#11 0x0000555af11e6437 in parse_event ()                                                                                                                                                                                                                     
#12 0x0000555af11b7ee5 in loop ()                                                                                                                                                                                                                            
#13 0x0000555af11bbdf6 in zsh_main ()                                                                                                                                                                                                                        
#14 0x00007f46e80b6f4a in __libc_start_main () from /usr/lib/libc.so.6                                                                                                                                                                                       
#15 0x0000555af11819aa in _start ()
Comment 4 John Ramsden 2018-04-12 21:53:22 UTC
(In reply to Kai Uwe Broulik from comment #2)
> Can you get a gdb backtrace for this, please?

Hope this helps, had to recompile dolphin with debugging symbols.

Here's the Dolphin back-trace, is there a way to get more information? What I did was:

---

(gdb) set logging file trace.log
(gdb) set logging on
Copying output to trace.log.
(gdb) thread apply all bt full

---

Starting program: /usr/bin/dolphin 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7fffe0981700 (LWP 27638)]
[New Thread 0x7fffda28b700 (LWP 27639)]
[New Thread 0x7fffd1c49700 (LWP 27640)]
[Thread 0x7fffd1c49700 (LWP 27640) exited]
[Thread 0x7fffe0981700 (LWP 27638) exited]
[Thread 0x7fffda28b700 (LWP 27639) exited]
[Inferior 1 (process 27637) exited normally]

---

And the core dump:

---

           PID: 27641 (zsh)
           UID: 1000 (john)
           GID: 1000 (john)
        Signal: 6 (ABRT)
     Timestamp: Thu 2018-04-12 14:44:47 PDT (1min 47s ago)
  Command Line: /usr/bin/zsh
    Executable: /usr/bin/zsh
 Control Group: /user.slice/user-1000.slice/session-c1.scope
          Unit: session-c1.scope
         Slice: user-1000.slice
       Session: c1
     Owner UID: 1000 (john)
       Boot ID: 3b1a9f82088f4a9a820938ba9f91a719
    Machine ID: 6f76760fe58f4b6293e0004853517d7d
      Hostname: wooly
       Storage: /var/lib/systemd/coredump/core.zsh.1000.3b1a9f82088f4a9a820938ba9f91a719.27641.1523569487000000.lz4
       Message: Process 27641 (zsh) of user 1000 dumped core.
                
                Stack trace of thread 27641:
                #0  0x00007ffff7094860 raise (libc.so.6)
                #1  0x00007ffff7095ec9 abort (libc.so.6)
                #2  0x00007ffff70d7437 __libc_message (libc.so.6)
                #3  0x00007ffff70dd78b malloc_printerr (libc.so.6)
                #4  0x00007ffff70df24c _int_free (libc.so.6)
                #5  0x00007ffff6c29e19 zrefresh (zle.so)
                #6  0x00007ffff6c1d2e6 zleread (zle.so)
                #7  0x00005555555a4784 zleentry (zsh)
                #8  0x00005555555a5cb8 n/a (zsh)
                #9  0x000055555559d56c n/a (zsh)
                #10 0x00005555555af65e n/a (zsh)
                #11 0x00005555555cf437 parse_event (zsh)
                #12 0x00005555555a0ee5 loop (zsh)
                #13 0x00005555555a4df6 zsh_main (zsh)
                #14 0x00007ffff7080f4a __libc_start_main (libc.so.6)
                #15 0x000055555556a9aa _start (zsh)

---
  
You have the following choices:
Comment 5 Christoph Feck 2018-04-12 22:26:53 UTC
It is zsh that crashes, for whatever reason.
Comment 6 dreem 2018-04-13 20:23:49 UTC
Christoph is right.
Downgrade of zsh (5.5-1 => 5.4.2-2) fixed the issue
Comment 7 John Ramsden 2018-04-13 21:58:09 UTC
I sent an email to zsh-workers@zsh.org, hopefully they can solve the issue.
Comment 8 John Ramsden 2018-04-14 05:55:55 UTC
Created attachment 112021 [details]
Email thread with ZSH developer.

Email thread going into more detail about the ZSH problem, and a workaround that was found.
Comment 9 John Ramsden 2018-04-14 05:58:41 UTC
A tldr if someone doesn't want to read the previous attachment. A work around is adding a small sleep to zshrc. It seems to be related to zsh not being happy while the window is resizing and the sleep makes sure the window is completely open before the stage that causes the problem occurs.
Comment 10 David Faure 2018-08-01 08:41:57 UTC
Interestingly, after hitting this bug and reading this report, I simply compiled zsh from git (git://git.code.sf.net/p/zsh/code) (master was at commit 79153bec1 back then) using the same configure flags as the openSUSE RPM (http://www.davidfaure.fr/2018/myconf_zsh.sh)
and the bug seems gone !?

Either it got fixed meanwhile (but I don't see a relevant commit), or building it myself is slightly different from the RPM binary...
Comment 11 John Ramsden 2018-08-02 02:17:12 UTC
At least on Arch, this has been fixed by zsh.