Bug 385128

Summary: Firefox crashes trying to open the filechooser
Product: [openSUSE] openSUSE 11.0 Reporter: Magnus Boman <captain.magnus>
Component: GNOMEAssignee: Federico Mena Quintero <federico>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Major    
Priority: P5 - None CC: mmeeks, wolfgang
Version: Factory   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: gnome-crash gnome-update
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 338003    
Attachments: glib2-bnc385128-bgo537555-gobject-class-init-threading.diff

Description Magnus Boman 2008-04-30 09:13:05 UTC
Sometimes (not very often, but often enough to be noticed) Firefox crashes trying to open the filechooser.

For instance;

1. Open Firefox
2. Browse to http://widehat.opensuse.org/pub/distribution/SL-OSS-factory/inst-source/boot/
3. Right click on boot.iso and select save as

Doing the above will *normally* work, but every so often, it crashes with this;

mboman@mblxsrv01:~> firefox 

GLib-GObject-ERROR **: g_type_plugin_*() invalidly modified type `GThemedIcon'
aborting...
Comment 1 Magnus Boman 2008-04-30 09:15:17 UTC
If it doesn't crash, it generates this;

mboman@mblxsrv01:~> firefox 

(firefox:14234): GLib-GObject-WARNING **: IA__g_object_new_valist: object class `GThemedIcon' has no property named `names'

(firefox:14234): GLib-GIO-CRITICAL **: g_themed_icon_constructed: assertion `themed->names != NULL && themed->names[0] != NULL' failed

(firefox:14234): GLib-CRITICAL **: g_strv_length: assertion `str_array != NULL' failed
Comment 2 Wolfgang Rosenauer 2008-04-30 09:17:39 UTC
Looks like a gtk issue?
Comment 3 Magnus Boman 2008-04-30 09:18:58 UTC
Yes, indeed. I remember seeing something like that from gedit and could reproduce. Will reassign to GNOME.

Here's from starting gedit and opening the filechooser;

mblxsrv01:/home/mboman # SuSEconfig 
Starting SuSEconfig, the SuSE Configuration Tool...
Running in full featured mode.
Reading /etc/sysconfig and updating the system...
Executing /sbin/conf.d/SuSEconfig.desktop-file-utils...
Executing /sbin/conf.d/SuSEconfig.fonts...
Creating fonts.{scale,dir} files .........
/etc/fonts/suse-font-dirs.conf unchanged
/etc/fonts/suse-hinting.conf unchanged
/etc/fonts/suse-bitmaps.conf unchanged
Creating cache files for fontconfig .................................
Creating 32bit cache files for fontconfig .................................
generating java font setup
Warning: cannot find a sans serif Japanese font. Japanese in Java might not work.
Warning: cannot find a serif Japanese font. Japanese in Java might not work.
Warning: cannot find a sans serif simplified Chinese font. Simplified Chinese in Java might not work.
Warning: cannot find a serif simplified Chinese font. Simplified Chinese in Java might not work.
Warning: cannot find a sans serif traditional Chinese font. Traditional Chinese in Java might not work.
Warning: cannot find a serif traditional Chinese font. Traditional Chinese in Java might not work.
Warning: cannot find a sans serif Korean font. Korean in Java might not work.
Warning: cannot find a serif Korean font. Korean in Java might not work.
Generating CJK setup for xpdf ...
Executing /sbin/conf.d/SuSEconfig.gdm...
Executing /sbin/conf.d/SuSEconfig.glib2...
Executing /sbin/conf.d/SuSEconfig.groff...
Executing /sbin/conf.d/SuSEconfig.gtk2...
Executing /sbin/conf.d/SuSEconfig.ispell...
Executing /sbin/conf.d/SuSEconfig.permissions...
Executing /sbin/conf.d/SuSEconfig.postfix...
Setting up postfix local as MDA...
Setting SPAM protection to "off"...
Executing /sbin/conf.d/SuSEconfig.scpm...
Executing /sbin/conf.d/SuSEconfig.words...
Finished.
mblxsrv01:/home/mboman # exit
exit
mboman@mblxsrv01:~> gedit 

(gedit:14635): GLib-GObject-WARNING **: IA__g_object_new_valist: object class `GThemedIcon' has no property named `names'

(gedit:14635): GLib-GIO-CRITICAL **: g_themed_icon_constructed: assertion `themed->names != NULL && themed->names[0] != NULL' failed

(gedit:14635): GLib-CRITICAL **: g_strv_length: assertion `str_array != NULL' failed
Comment 4 Magnus Boman 2008-05-02 06:05:26 UTC
Gah! This just killed all my gnome-terminal windows while trying to edit a profile.
Comment 5 Magnus Boman 2008-05-03 02:12:36 UTC
This does not happen on a clean install so perhaps close it?
Comment 6 Michael Meeks 2008-05-28 12:27:52 UTC
I've seen this too - but it's the very devil to reproduce; I ran firefox in valgrind for some hours without getting any problems :-)

Could it be related to the theme change issue ? bug #355402# ?

If not; perhaps some ref-counting issue on the GThemedIcon - and calling methods on it after it is dead.
Comment 7 Michael Meeks 2008-06-03 09:57:23 UTC
Grief - I saw this again on my console this morning: 

(firefox:3778): GLib-GObject-WARNING **: IA__g_object_new_valist: object class `GThemedIcon' has no property named `names'
(firefox:3778): GLib-GIO-CRITICAL **: g_themed_icon_constructed: assertion `themed->names != NULL && themed->names[0] != NULL' failed
(firefox:3778): GLib-CRITICAL **: g_strv_length: assertion `str_array != NULL' failed
(firefox:3778): GLib-GObject-WARNING **: IA__g_object_notify: object class `GThemedIcon' has no property named `names'

I ran a zypper dup overnight. Tried to reproduce it on x86_64 by updating a load of icon theme bits & so on - with no joy. Running another big dup to try to reproduce it here.

It's notable that firefox doesn't appear to adapt to icon theme changes correctly; eg. all the 'bookmark' toolbar folder icons don't update etc.
Comment 8 Michael Meeks 2008-06-03 10:41:59 UTC
Interestingly, I got the same trace out of evolution [ also running over the update ] just now (could have kicked myself for not attaching the debugger before attaching something to a mail).
And funnily firefox just spewed it for a second time here - which is (perhaps) encouraging ...
Comment 9 Michael Meeks 2008-06-03 11:56:36 UTC
Unsure if it's related but I managed to trap some similar badness in the GIO code in the file-selector, triggered when closing the file selector.
Comment 10 Michael Meeks 2008-06-03 12:24:52 UTC
Might well be #396681# - although that has different symptoms & warning printout :-)
Comment 11 Federico Mena Quintero 2008-06-03 16:08:47 UTC
I've never managed to replicate this bug or the "SuSEconfig kills stuff" one :(  Michael, how do you do it?
Comment 12 Federico Mena Quintero 2008-06-04 18:49:28 UTC
Magnus, can you please test the packages mentioned in https://bugzilla.novell.com/show_bug.cgi?id=396681#c6 ?
Comment 13 Magnus Boman 2008-06-09 00:40:25 UTC
I don't see this issue with latest factory anymore.

mboman@linux-2ztj:~> rpm -q libgnomeui
libgnomeui-2.22.1-20
mboman@linux-2ztj:~> rpm -q --changelog libgnomeui|head
* Thu Apr 10 2008 ro@suse.de
- added baselibs.conf file to build xxbit packages
  for multilib support

* Thu Apr 10 2008 maw@suse.de
- Update to version 2.22.1:
  + Code cleanups
  + Use GIO for thumbnailing
  + Fix several crashes and critial warnings in the gio file
  chooser

Comment 14 Federico Mena Quintero 2008-06-09 10:58:25 UTC
Marking as duplicate, then.  Please reopen if the problem persists in Firefox.

*** This bug has been marked as a duplicate of bug 396681 ***
Comment 15 Michael Meeks 2008-06-09 14:03:50 UTC
I caught this in the debugger by some miracle; and it's not a dup; re-opening.
Comment 16 Michael Meeks 2008-06-09 14:05:13 UTC
So - this is a cross-thread race; here is the proof:

Thread 3 (Thread 0xb27ffb90 (LWP 11861)):
#0  IA__g_themed_icon_new_from_names (iconnames=0xb27ff0e0, len=3)
    at gthemedicon.c:288
#1  0xb7fb3b34 in IA__g_content_type_get_icon (
    type=0x81bb878 "inode/directory") at gcontenttype.c:673
#2  0xb7fe8cf0 in _g_local_file_info_get (basename=0x81bb850 "Desktop", 
    path=0x8191738 "/home/michael/Desktop", attribute_matcher=0x81bb800, 
    flags=G_FILE_QUERY_INFO_NONE, parent_info=0xb27ff264, error=0xb27ff2e8)
    at glocalfileinfo.c:1499
#3  0xb7fe4005 in g_local_file_query_info (file=0x8126240, 
    attributes=0xb2800688 "standard,time,thumbnail::*", 
    flags=G_FILE_QUERY_INFO_NONE, cancellable=0x8124f90, error=0xb27ff2e8)
    at glocalfile.c:1155
#4  0xb7fbcf66 in IA__g_file_query_info (file=0x8126240, 
    attributes=0xb2800688 "standard,time,thumbnail::*", 
    flags=G_FILE_QUERY_INFO_NONE, cancellable=0x8124f90, error=0xb27ff2e8)
    at gfile.c:1006
#5  0xb7fbf374 in query_info_async_thread (res=0x80cd3b0, object=0x8126240, 
    cancellable=0x8124f90) at gfile.c:3801
#6  0xb7fd3a39 in run_in_thread (job=0x81918c8, c=0x8124f90, _data=0x81918a0)
    at gsimpleasyncresult.c:613
#7  0xb7fcd414 in io_job_thread (data=0x81918c8, user_data=0x0)
---Type <return> to continue, or q <return> to quit---
    at gioscheduler.c:178
#8  0xb7002a06 in g_thread_pool_thread_proxy (data=0x81c14d8)
    at gthreadpool.c:265
#9  0xb700139f in g_thread_create_proxy (data=0x81918f0) at gthread.c:635
#10 0xb79c3175 in start_thread (arg=0xb27ffb90) at pthread_create.c:297
#11 0xb6efddce in clone () from /lib/libc.so.6

Thread 2 (Thread 0xb31ffb90 (LWP 11860)):
#0  0xb706cc41 in IA__g_param_spec_pool_lookup (pool=0x8060d90, 
    param_name=0xb78e8512 "name", owner_type=2994735592, walk_ancestors=0)
    at gparam.c:753
#1  0xb7068753 in install_property_internal (g_type=2994735592, 
    property_id=1721807957, pspec=0x81580f0) at gobject.c:289
#2  0xb70689e7 in IA__g_object_class_install_property (class=0x8124e98, 
    property_id=1, pspec=0x81580f0) at gobject.c:321
#3  0xb7fd4ac5 in g_themed_icon_class_intern_init (klass=0x8124e98)
    at gthemedicon.c:204
#4  0xb7084828 in IA__g_type_class_ref (type=<value optimized out>)
    at gtype.c:1880
#5  0xb706b4de in IA__g_object_new_valist (object_type=2994735592, 
    first_property_name=0xb7ffa473 "names", var_args=0xb31ff098 "�t\200�")
    at gobject.c:988
#6  0xb706b89e in IA__g_object_new (object_type=2994735592, 
---Type <return> to continue, or q <return> to quit---
    first_property_name=0xb7ffa473 "names") at gobject.c:795
#7  0xb7fd4831 in IA__g_themed_icon_new_from_names (iconnames=0xb31ff0e0, 
    len=3) at gthemedicon.c:302
#8  0xb7fb3b34 in IA__g_content_type_get_icon (
    type=0xb2800938 "inode/directory") at gcontenttype.c:673
#9  0xb7fe8cf0 in _g_local_file_info_get (basename=0x8124e40 "michael", 
    path=0x81b3f70 "/home/michael", attribute_matcher=0x8124e00, 
    flags=G_FILE_QUERY_INFO_NONE, parent_info=0xb31ff264, error=0xb31ff2e8)
    at glocalfileinfo.c:1499
#10 0xb7fe4005 in g_local_file_query_info (file=0x81269a0, 
    attributes=0x81bced8 "standard,time,thumbnail::*", 
    flags=G_FILE_QUERY_INFO_NONE, cancellable=0x8124f60, error=0xb31ff2e8)
    at glocalfile.c:1155
#11 0xb7fbcf66 in IA__g_file_query_info (file=0x81269a0, 
    attributes=0x81bced8 "standard,time,thumbnail::*", 
    flags=G_FILE_QUERY_INFO_NONE, cancellable=0x8124f60, error=0xb31ff2e8)
    at gfile.c:1006
#12 0xb7fbf374 in query_info_async_thread (res=0x80cd380, object=0x81269a0, 
    cancellable=0x8124f60) at gfile.c:3801
#13 0xb7fd3a39 in run_in_thread (job=0x8127bc0, c=0x8124f60, _data=0x81075e8)
    at gsimpleasyncresult.c:613
#14 0xb7fcd414 in io_job_thread (data=0x8127bc0, user_data=0x0)
    at gioscheduler.c:178
---Type <return> to continue, or q <return> to quit---
#15 0xb7002a06 in g_thread_pool_thread_proxy (data=0x81c14d8)
    at gthreadpool.c:265
#16 0xb700139f in g_thread_create_proxy (data=0x811f7a0) at gthread.c:635
#17 0xb79c3175 in start_thread (arg=0xb31ffb90) at pthread_create.c:297
#18 0xb6efddce in clone () from /lib/libc.so.6

Thread 1 (Thread 0xb6dfd6c0 (LWP 11850)):
#0  shortcuts_add_volumes (impl=0x8105088) at gtkfilechooserdefault.c:2098
#1  0xb7705ed4 in gtk_file_chooser_default_constructor (type=135270160, 
    n_construct_properties=1, construct_params=0x8104b10)
    at gtkfilechooserdefault.c:2412
#2  0xb706ab66 in IA__g_object_newv (object_type=135270160, n_parameters=1, 
    parameters=0x80cd400) at gobject.c:937
#3  0xb706b752 in IA__g_object_new_valist (object_type=135270160, 
    first_property_name=0xb78e60f2 "file-system-backend", 
    var_args=0xbf9db42c "") at gobject.c:1027
#4  0xb706b89e in IA__g_object_new (object_type=135270160, 
    first_property_name=0xb78e60f2 "file-system-backend") at gobject.c:795
#5  0xb76f5aa8 in _gtk_file_chooser_default_new (file_system=0x0)
    at gtkfilechooserdefault.c:11157
#6  0xb770bcbc in gtk_file_chooser_widget_constructor (type=135268840, 
    n_construct_properties=1, construct_params=0x8101af0)
    at gtkfilechooserwidget.c:103
---Type <return> to continue, or q <return> to quit---
#7  0xb706ab66 in IA__g_object_newv (object_type=135268840, n_parameters=0, 
    parameters=0x0) at gobject.c:937
#8  0xb706b727 in IA__g_object_new_valist (object_type=135268840, 
    first_property_name=0x0, 
    var_args=0xbf9db668 "\210�\017\b�\t�x�\v\b|�\017\b\020\020\020\b�\t�x�\v\b|�\017\b��\235�f�\006�H\037\t\b\003") at gobject.c:986
#9  0xb706b89e in IA__g_object_new (object_type=135268840, 
    first_property_name=0x0) at gobject.c:795
#10 0xb7707a65 in gtk_file_chooser_dialog_constructor (type=134815560, 
    n_construct_properties=3, construct_params=0x80fff70)
    at gtkfilechooserdialog.c:284
#11 0xb706ab66 in IA__g_object_newv (object_type=134815560, n_parameters=3, 
    parameters=0x8100800) at gobject.c:937
#12 0xb706b752 in IA__g_object_new_valist (object_type=134815560, 
    first_property_name=0xb78d791b "title", var_args=0xbf9db89c "")
    at gobject.c:1027
#13 0xb706b89e in IA__g_object_new (object_type=134815560, 
    first_property_name=0xb78d791b "title") at gobject.c:795
#14 0xb77073c1 in gtk_file_chooser_dialog_new_valist (title=0x0, parent=0x0, 
    action=GTK_FILE_CHOOSER_ACTION_OPEN, backend=0x0, 
    first_button_text=0xb78d79f3 "gtk-cancel", 
    varargs=0xbf9db8f0 "����\216����") at gtkfilechooserdialog.c:477
#15 0xb770746d in IA__gtk_file_chooser_dialog_new (title=0x0, parent=0x0, 
---Type <return> to continue, or q <return> to quit---
    action=GTK_FILE_CHOOSER_ACTION_OPEN, 
    first_button_text=0xb78d79f3 "gtk-cancel") at gtkfilechooserdialog.c:522
#16 0xb76f4c38 in gtk_file_chooser_button_constructor (type=134815864, 
    n_params=2, params=0x80ee828) at gtkfilechooserbutton.c:664
#17 0xb706ab66 in IA__g_object_newv (object_type=134815864, n_parameters=2, 
    parameters=0x80ef9b0) at gobject.c:937
#18 0xb706b752 in IA__g_object_new_valist (object_type=134815864, 
    first_property_name=0xb7956d92 "action", var_args=0xbf9dbb74 "")
    at gobject.c:1027
#19 0xb706b89e in IA__g_object_new (object_type=134815864, 
    first_property_name=0xb7956d92 "action") at gobject.c:795
#20 0xb76f1055 in IA__gtk_file_chooser_button_new (
    title=0xb80accf6 "Select a folder", 
    action=GTK_FILE_CHOOSER_ACTION_SELECT_FOLDER)
    at gtkfilechooserbutton.c:2757
#21 0x08050089 in screenshot_dialog_new ()
#22 0x0804eaa9 in _start ()


this is from gnome-screenshot. Notice we are about to create a new class instance without finishing the class_init: this can (presumably) lead to all manner of bad stuff, but (I guess) just hadn't been noticed before we had the file-selector racing there.
Comment 17 Michael Meeks 2008-06-09 14:11:38 UTC
up-stream bug; will extract fix:
    http://bugzilla.gnome.org/show_bug.cgi?id=64764

Comment 18 Michael Meeks 2008-06-09 14:17:24 UTC

*** This bug has been marked as a duplicate of bug 398548 ***
Comment 19 Michael Meeks 2008-06-10 10:40:54 UTC
re-opening, I was wrong :-)
Comment 20 Michael Meeks 2008-06-10 10:42:24 UTC
Hokay; re-filed up-stream as:
    http://bugzilla.gnome.org/show_bug.cgi?id=537555
and working on a solution.
Comment 21 Michael Meeks 2008-06-10 10:50:26 UTC
It seems part of the reason people see the race - but only the first time you launch a given application [ intensely frustrating ;-], is that it's a narrow race: not only do you need a dual CPU machine, but you also need a slow class init method [ ie. using gettext to translate object properties on class init - with a cold .po file ] is enough.
Comment 22 Federico Mena Quintero 2008-06-10 12:18:54 UTC
Test packages here:
http://www.gnome.org/~federico/misc/glib2/
Comment 23 Federico Mena Quintero 2008-06-10 12:20:26 UTC
Created attachment 221250 [details]
glib2-bnc385128-bgo537555-gobject-class-init-threading.diff
Comment 24 Federico Mena Quintero 2008-06-10 12:46:38 UTC
Setting as needinfo from Michael, as he wants to test the packages before I commit the patch.
Comment 25 Michael Meeks 2008-06-10 13:17:36 UTC
packages appear to work: kill the problem inasmuch as it was reproducible, and have apparrently no ill effects on my routine desktop use. Good stuff :-)
Comment 26 Federico Mena Quintero 2008-06-11 09:32:53 UTC
Anja, we'd like to release this as an update for openSUSE 11.0.  Can we please have a swampid? :)
Comment 29 Federico Mena Quintero 2008-06-11 13:53:04 UTC
Submitted to 11.0 in autobuild, and submitted the patchinfo as well.

* Tue Jun 11 2008 - federico@novell.com
- Added glib2-bnc385128-bgo537555-gobject-class-init-threading.diff to
  fix https://bugzilla.novell.com/show_bug.cgi?id=385128 - GObject
  class initialization had a race condition with multiple threads.
Comment 30 Michael Meeks 2008-07-07 10:35:21 UTC
bad news I'm afraid: I got this crash again, with the GObject fix included (I believe) - though I'd have to wait for it again to be 100% certain.
Comment 31 Michael Meeks 2008-07-07 10:41:07 UTC
Not fixed; I just re-ran firefox and got this on the console:

(firefox:12167): GLib-GObject-WARNING **: IA__g_object_new_valist: object class `GThemedIcon' has no property named `names'
(firefox:12167): GLib-GIO-CRITICAL **: g_themed_icon_constructed: assertion `themed->names != NULL && themed->names[0] != NULL' failed
(firefox:12167): GLib-CRITICAL **: g_strv_length: assertion `str_array != NULL' failed
(firefox:12167): GLib-GObject-WARNING **: IA__g_object_notify: object class `GThemedIcon' has no property named `names'

yet I have:

rpm -q --changelog glib2 2>&1 | head
* Tue Jun 10 2008 federico@novell.com
- Added glib2-bnc385128-bgo537555-gobject-class-init-threading.diff to
  fix https://bugzilla.novell.com/show_bug.cgi?id=385128 - GObject
  class initialization had a race condition with multiple threads.

Federico - are you certain the package really contains this fix ? :-)
Comment 32 Anja Stock 2008-07-09 14:50:25 UTC
released
Comment 33 Michael Meeks 2008-07-10 14:27:14 UTC
hmm, it's possible I've just got an inconsistent system somehow; re-closing.