28070 2009-08-07 09:07:47 -0700 [Gtk] Crash when saving a password 2009-09-28 22:18:00 -0700 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) PC Linux RESOLVED FIXED Gtk P2 Normal --- 28463 1 bugzilla webkit-unassigned gustavo jmalonzo xan.lopez oldest_to_newest 137917 0 bugzilla 2009-08-07 09:07:47 -0700 1. Go to https://fedorahosted.org/rel-eng/ 2. Click "log in" 3. Enter my credentials and select "save password" 4. Benco! libsoup-2.27.5-1.fc12.x86_64 webkitgtk-1.1.12-1.fc12.x86_64 epiphany-2.27.5-1.fc12.x86_64 (gdb) bt #0 save_password_callback (msg=<value optimized out>, authData=0xea2540) at WebKit/gtk/webkit/webkitsoupauthdialog.c:117 #1 0x00000030d240bb4e in IA__g_closure_invoke (closure=0xee4970, return_value=0x0, n_param_values=1, param_values=0xf00460, invocation_hint=0x7fffffffc610) at gclosure.c:767 #2 0x00000030d2421d06 in signal_emit_unlocked_R (node=0xdf22d0, detail=<value optimized out>, instance=<value optimized out>, emission_return=<value optimized out>, instance_and_params=<value optimized out>) at gsignal.c:3247 #3 0x00000030d242312e in IA__g_signal_emit_valist (instance=0x994cc0, signal_id=<value optimized out>, detail=0, var_args=0x7fffffffc800) at gsignal.c:2980 #4 0x00000030d24236a3 in IA__g_signal_emit (instance=0x0, signal_id=0, detail=0) at gsignal.c:3037 #5 0x00007ffff57180b0 in io_read (sock=0xe8aae0, msg=0x994cc0) at soup-message-io.c:835 #6 0x00000030d240bb4e in IA__g_closure_invoke (closure=0xe6da00, return_value=0x0, n_param_values=1, param_values=0xe70720, invocation_hint=0x7fffffffca70) at gclosure.c:767 #7 0x00000030d2421d06 in signal_emit_unlocked_R (node=0x9577f0, detail=<value optimized out>, instance=<value optimized out>, emission_return=<value optimized out>, instance_and_params=<value optimized out>) at gsignal.c:3247 #8 0x00000030d242312e in IA__g_signal_emit_valist (instance=0xe8aae0, signal_id=<value optimized out>, detail=0, var_args=0x7fffffffcc60) at gsignal.c:2980 #9 0x00000030d24236a3 in IA__g_signal_emit (instance=0x0, signal_id=0, detail=0) at gsignal.c:3037 #10 0x00007ffff5722891 in socket_read_watch (chan=<value optimized out>, cond=0, user_data=<value optimized out>) at soup-socket.c:1181 #11 0x00000030d20391be in g_main_dispatch (context=<value optimized out>) at gmain.c:1960 #12 IA__g_main_context_dispatch (context=<value optimized out>) at gmain.c:2513 #13 0x00000030d203cba8 in g_main_context_iterate (context=0x70c250, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591 #14 0x00000030d203cff5 in IA__g_main_loop_run (loop=0x7b06a0) at gmain.c:2799 #15 0x00007ffff6162f07 in IA__gtk_main () at gtkmain.c:1205 #16 0x000000000042d5a5 in main (argc=can't compute CFA for this frame ) at ephy-main.c:781 (gdb) list 112 static void save_password_callback(SoupMessage* msg, WebKitAuthData* authData) 113 { 114 /* Check only for Success status codes (2xx) */ 115 if (msg->status_code >= 200 && msg->status_code < 300) { 116 SoupURI* uri = soup_message_get_uri(authData->msg); 117 gnome_keyring_set_network_password(NULL, 118 authData->username, 119 soup_auth_get_realm(authData->auth), 120 uri->host, 121 NULL, (gdb) p uri $3 = (SoupURI *) 0x0 And with fatal warnings: libsoup-CRITICAL **: soup_message_get_uri: assertion `SOUP_IS_MESSAGE (msg)' failed aborting... Program received signal SIGTRAP, Trace/breakpoint trap. IA__g_logv (log_domain=<value optimized out>, log_level=<value optimized out>, format=<value optimized out>, args1=0x7fffffffc360) at gmessages.c:512 512 g_private_set (g_log_depth, GUINT_TO_POINTER (depth)); (gdb) bt #0 IA__g_logv (log_domain=<value optimized out>, log_level=<value optimized out>, format=<value optimized out>, args1=0x7fffffffc360) at gmessages.c:512 #1 0x00000030d20433d3 in IA__g_log (log_domain=0x7ffff52c2e98 "\300\n", <incomplete sequence \351>, log_level=15565728, format=0xed83a0 "\020\001") at gmessages.c:526 #2 0x00007ffff57137a4 in soup_message_get_uri (msg=<value optimized out>) at soup-message.c:1431 #3 0x00007ffff694634a in save_password_callback (msg=<value optimized out>, authData=0xe92190) at WebKit/gtk/webkit/webkitsoupauthdialog.c:116 #4 0x00000030d240bb4e in IA__g_closure_invoke (closure=0xed63b0, return_value=0x0, n_param_values=1, param_values=0xe6a580, invocation_hint=0x7fffffffc600) at gclosure.c:767 #5 0x00000030d2421d06 in signal_emit_unlocked_R (node=0xdf2140, detail=<value optimized out>, instance=<value optimized out>, emission_return=<value optimized out>, instance_and_params=<value optimized out>) at gsignal.c:3247 #6 0x00000030d242312e in IA__g_signal_emit_valist (instance=0x994cc0, signal_id=<value optimized out>, detail=0, var_args=0x7fffffffc7f0) at gsignal.c:2980 #7 0x00000030d24236a3 in IA__g_signal_emit (instance=0x7ffff52c2e98, signal_id=15565728, detail=15565728) at gsignal.c:3037 #8 0x00007ffff57180b0 in io_read (sock=0xe96220, msg=0x994cc0) at soup-message-io.c:835 #9 0x00000030d240bb4e in IA__g_closure_invoke (closure=0xf075d0, return_value=0x0, n_param_values=1, param_values=0xefc4a0, invocation_hint=0x7fffffffca60) at gclosure.c:767 #10 0x00000030d2421d06 in signal_emit_unlocked_R (node=0x957750, detail=<value optimized out>, instance=<value optimized out>, emission_return=<value optimized out>, instance_and_params=<value optimized out>) at gsignal.c:3247 #11 0x00000030d242312e in IA__g_signal_emit_valist (instance=0xe96220, signal_id=<value optimized out>, detail=0, var_args=0x7fffffffcc50) at gsignal.c:2980 #12 0x00000030d24236a3 in IA__g_signal_emit (instance=0x7ffff52c2e98, signal_id=15565728, detail=15565728) at gsignal.c:3037 #13 0x00007ffff5722891 in socket_read_watch (chan=<value optimized out>, cond=0, user_data=<value optimized out>) at soup-socket.c:1181 #14 0x00000030d20391be in g_main_dispatch (context=<value optimized out>) at gmain.c:1960 #15 IA__g_main_context_dispatch (context=<value optimized out>) at gmain.c:2513 #16 0x00000030d203cba8 in g_main_context_iterate (context=0x70c2c0, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591 #17 0x00000030d203cff5 in IA__g_main_loop_run (loop=0x7ab6e0) at gmain.c:2799 #18 0x00007ffff6162f07 in IA__gtk_main () at gtkmain.c:1205 #19 0x000000000042d5a5 in main (argc=can't compute CFA for this frame ) at ephy-main.c:781 138267 1 jmalonzo 2009-08-07 20:40:37 -0700 CC'ing Gustavo and Xan who are more familiar with libsoup and gnome-keyring in WebKitGtk. 139762 2 xan.lopez 2009-08-13 02:26:24 -0700 This code has been changed in latest trunk, could you try again with it (you'll need libsoup master) and tell us if it still crashes? You can also wait for the 1.1.13 release, which will happen soon. 142534 3 xan.lopez 2009-08-25 00:15:03 -0700 Epiphany 2.27.91, libsoup 2.27.91 and WebKitGTK+ 1.1.13 are now released. 143883 4 gustavo 2009-09-01 07:27:30 -0700 Seems to still happen. I think I found the problem, I am testing the fix (waiting for build to finish). 143985 5 gustavo 2009-09-01 13:14:48 -0700 I have tried debugging this. We seem to have a problem with the reference counting of authData->auth (we do a g_object_unref on it without doing a g_object_ref), but the fact is adding g_object_ref to the initialization of auth, and to just after authenticated doesn't help. We still reach the save password callback with authData->auth as 0x0. This seems to be caused by memory corruption. I was unable to find out what is the actual problem, though. Valgrind log: ==12869== ==12869== Syscall param write(buf) points to uninitialised byte(s) ==12869== at 0xCCC852B: (within /lib/libpthread-2.9.so) ==12869== by 0xE6219E6: unixWrite (sqlite3.c:23842) ==12869== by 0xE5D713E: writeJournalHdr (sqlite3.c:11929) ==12869== by 0xE5D722C: pager_open_journal (sqlite3.c:34594) ==12869== by 0xE5D7357: sqlite3PagerBegin (sqlite3.c:34669) ==12869== by 0xE5E02B3: sqlite3BtreeBeginTrans (sqlite3.c:39351) ==12869== by 0xE5F8E65: sqlite3VdbeExec (sqlite3.c:53624) ==12869== by 0xE5FF887: sqlite3_step (sqlite3.c:49507) ==12869== by 0xE602A2C: sqlite3_exec (sqlite3.c:72147) ==12869== by 0x6FBFD38: exec_query_with_try_create_table (soup-cookie-jar-sqlite.c:242) ==12869== by 0x6FC0118: changed (soup-cookie-jar-sqlite.c:295) ==12869== by 0xB7E951C: g_closure_invoke (gclosure.c:767) ==12869== Address 0x14d544c9 is 9 bytes inside a block of size 1,032 alloc'd ==12869== at 0x4C2391E: malloc (vg_replace_malloc.c:207) ==12869== by 0xE61FFC1: sqlite3MemMalloc (sqlite3.c:12342) ==12869== by 0xE5BA748: mallocWithAlarm (sqlite3.c:15530) ==12869== by 0xE5BA81F: sqlite3Malloc (sqlite3.c:15558) ==12869== by 0xE5BBE82: pcache1Alloc (sqlite3.c:29512) ==12869== by 0xE5BBFA5: sqlite3PageMalloc (sqlite3.c:29583) ==12869== by 0xE5C3FD6: sqlite3PagerSetPagesize (sqlite3.c:32906) ==12869== by 0xE5DF037: sqlite3BtreeFactory (sqlite3.c:33837) ==12869== by 0xE5E6837: openDatabase (sqlite3.c:92579) ==12869== by 0x6FC00E0: changed (soup-cookie-jar-sqlite.c:285) ==12869== by 0xB7E951C: g_closure_invoke (gclosure.c:767) ==12869== by 0xB7FF934: signal_emit_unlocked_R (gsignal.c:3177) libsoup-CRITICAL **: soup_auth_save_password: assertion `SOUP_IS_AUTH (auth)' fa iled aborting... ==12869== ==12869== Process terminating with default action of signal 5 (SIGTRAP): dumping core ==12869== at 0xBA668CC: g_logv (gmessages.c:512) ==12869== by 0xBA66C22: g_log (gmessages.c:526) ==12869== by 0x512417A: save_password_callback (webkitsoupauthdialog.c:105) ==12869== by 0xB7E951C: g_closure_invoke (gclosure.c:767) ==12869== by 0xB80003D: signal_emit_unlocked_R (gsignal.c:3247) ==12869== by 0xB8015EE: g_signal_emit_valist (gsignal.c:2980) ==12869== by 0xB801AF2: g_signal_emit (gsignal.c:3037) ==12869== by 0x6D99B5F: io_read (soup-message-io.c:835) ==12869== by 0xB7E951C: g_closure_invoke (gclosure.c:767) ==12869== by 0xB80003D: signal_emit_unlocked_R (gsignal.c:3247) ==12869== by 0xB8015EE: g_signal_emit_valist (gsignal.c:2980) ==12869== by 0xB801AF2: g_signal_emit (gsignal.c:3037) 150498 6 40230 xan.lopez 2009-09-28 06:30:48 -0700 Created attachment 40230 soupauthfix.diff Proposed patch. 150738 7 40230 eric 2009-09-28 17:15:13 -0700 Comment on attachment 40230 soupauthfix.diff Rubber stamp = me. 150799 8 xan.lopez 2009-09-28 22:18:00 -0700 Thanks, landed in r48858. 40230 2009-09-28 06:30:48 -0700 2009-09-28 17:15:13 -0700 soupauthfix.diff soupauthfix.diff text/plain 2629 xan.lopez RnJvbSBhYzA5OTM5MWNhYjM2YjRkOTY4ZjE0ZDYyNzQ1OTgzZGI3ZGJmYmI5IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBYYW4gTG9wZXogPHhsb3BlekBpZ2FsaWEuY29tPgpEYXRlOiBN b24sIDI4IFNlcCAyMDA5IDE2OjI5OjEyICswMzAwClN1YmplY3Q6IFtQQVRDSF0gMjAwOS0wOS0y OCAgWGFuIExvcGV6ICA8eGxvcGV6QGlnYWxpYS5jb20+CgogICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgoKICAgICAgICBbR3RrXSBDcmFzaCB3aGVuIHNhdmluZyBhIHBhc3N3b3Jk CiAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTI4MDcwCgog ICAgICAgIERpc2Nvbm5lY3QgdGhlICdnb3QtaGVhZGVycycgY2FsbGJhY2sgd2hlbiB3ZSBhcmUg ZG9uZSB3aXRoCiAgICAgICAgaXQuIFRoZSBzaWduYWwgY2FuIGJlIGVtaXR0ZWQgbW9yZSB0aGFu IG9uY2UgaWYgdGhlIG1lc3NhZ2UgaXMKICAgICAgICByZXRyYW5zbWl0dGVkLCBidXQgZWFjaCB0 aW1lIHRoYXQgaGFwcGVucyBhdXRoRGF0YSBpcyBjcmVhdGVkCiAgICAgICAgYWdhaW4gYW5kIGEg bmV3IGNhbGxiYWNrIGNvbm5lY3RlZCwgc28gd2UgaGF2ZSB0byBnZXQgcmlkIG9mIHRoZQogICAg ICAgIG9sZCBvbmUgKHdoaWNoIHdpbGwgY3Jhc2ggYmVjYXVzZSB3ZSBmcmVlIGF1dGhEYXRhKS4K CiAgICAgICAgKiB3ZWJraXQvd2Via2l0c291cGF1dGhkaWFsb2cuYzoKICAgICAgICAoc2F2ZV9w YXNzd29yZF9jYWxsYmFjayk6Ci0tLQogV2ViS2l0L2d0ay9DaGFuZ2VMb2cgICAgICAgICAgICAg ICAgICAgICB8ICAgMTYgKysrKysrKysrKysrKysrKwogV2ViS2l0L2d0ay93ZWJraXQvd2Via2l0 c291cGF1dGhkaWFsb2cuYyB8ICAgIDUgKysrKysKIDIgZmlsZXMgY2hhbmdlZCwgMjEgaW5zZXJ0 aW9ucygrKSwgMCBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9XZWJLaXQvZ3RrL0NoYW5nZUxv ZyBiL1dlYktpdC9ndGsvQ2hhbmdlTG9nCmluZGV4IDEwN2JmMDMuLjA0Y2FiMmUgMTAwNjQ0Ci0t LSBhL1dlYktpdC9ndGsvQ2hhbmdlTG9nCisrKyBiL1dlYktpdC9ndGsvQ2hhbmdlTG9nCkBAIC0x LDMgKzEsMTkgQEAKKzIwMDktMDktMjggIFhhbiBMb3BleiAgPHhsb3BlekBpZ2FsaWEuY29tPgor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFtHdGtdIENy YXNoIHdoZW4gc2F2aW5nIGEgcGFzc3dvcmQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTI4MDcwCisKKyAgICAgICAgRGlzY29ubmVjdCB0aGUgJ2dvdC1o ZWFkZXJzJyBjYWxsYmFjayB3aGVuIHdlIGFyZSBkb25lIHdpdGgKKyAgICAgICAgaXQuIFRoZSBz aWduYWwgY2FuIGJlIGVtaXR0ZWQgbW9yZSB0aGFuIG9uY2UgaWYgdGhlIG1lc3NhZ2UgaXMKKyAg ICAgICAgcmV0cmFuc21pdHRlZCwgYnV0IGVhY2ggdGltZSB0aGF0IGhhcHBlbnMgYXV0aERhdGEg aXMgY3JlYXRlZAorICAgICAgICBhZ2FpbiBhbmQgYSBuZXcgY2FsbGJhY2sgY29ubmVjdGVkLCBz byB3ZSBoYXZlIHRvIGdldCByaWQgb2YgdGhlCisgICAgICAgIG9sZCBvbmUgKHdoaWNoIHdpbGwg Y3Jhc2ggYmVjYXVzZSB3ZSBmcmVlIGF1dGhEYXRhKS4KKworICAgICAgICAqIHdlYmtpdC93ZWJr aXRzb3VwYXV0aGRpYWxvZy5jOgorICAgICAgICAoc2F2ZV9wYXNzd29yZF9jYWxsYmFjayk6CisK IDIwMDktMDktMjUgIEd1c3Rhdm8gTm9yb25oYSBTaWx2YSAgPGd1c3Rhdm8ubm9yb25oYUBjb2xs YWJvcmEuY28udWs+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgWGFuIExvcGV6LgpkaWZmIC0tZ2l0 IGEvV2ViS2l0L2d0ay93ZWJraXQvd2Via2l0c291cGF1dGhkaWFsb2cuYyBiL1dlYktpdC9ndGsv d2Via2l0L3dlYmtpdHNvdXBhdXRoZGlhbG9nLmMKaW5kZXggNWZmMjAzOC4uNTM4ZGJmYSAxMDA2 NDQKLS0tIGEvV2ViS2l0L2d0ay93ZWJraXQvd2Via2l0c291cGF1dGhkaWFsb2cuYworKysgYi9X ZWJLaXQvZ3RrL3dlYmtpdC93ZWJraXRzb3VwYXV0aGRpYWxvZy5jCkBAIC0xMDcsNiArMTA3LDEx IEBAIHN0YXRpYyB2b2lkIHNhdmVfcGFzc3dvcmRfY2FsbGJhY2soU291cE1lc3NhZ2UqIG1zZywg V2ViS2l0QXV0aERhdGEqIGF1dGhEYXRhKQogICAgIGlmIChtc2ctPnN0YXR1c19jb2RlICE9IDQw MSAmJiBtc2ctPnN0YXR1c19jb2RlIDwgNTAwKQogICAgICAgICBzb3VwX2F1dGhfc2F2ZV9wYXNz d29yZChhdXRoRGF0YS0+YXV0aCwgYXV0aERhdGEtPnVzZXJuYW1lLCBhdXRoRGF0YS0+cGFzc3dv cmQpOwogCisgICAgLyogRGlzY29ubmVjdCB0aGUgY2FsbGJhY2suIElmIHRoZSBhdXRoZW50aWNh dGlvbiBzdWNjZWVkZWQgd2UgYXJlCisgICAgICogZG9uZSwgYW5kIGlmIGl0IGZhaWxlZCB3ZSds bCBjcmVhdGUgYSBuZXcgYXV0aERhdGEgYW5kIHdlJ2xsCisgICAgICogY29ubmVjdCB0byAnZ290 LWhlYWRlcnMnIGFnYWluIGluIHJlc3BvbnNlX2NhbGxiYWNrICovCisgICAgZ19zaWduYWxfaGFu ZGxlcnNfZGlzY29ubmVjdF9ieV9mdW5jKG1zZywgc2F2ZV9wYXNzd29yZF9jYWxsYmFjaywgYXV0 aERhdGEpOworCiAgICAgZnJlZV9hdXRoRGF0YShhdXRoRGF0YSk7CiB9CiAjZW5kaWYKLS0gCjEu Ni40LjIKCg==