• Home
  • Categories
  • WIKI
  • LANGUAGE: en
    • bless 和 monodevelope 的崩溃问题
    Experiences and Insight 2416 views · 2 replies ·
    Tofloor
    poster avatar
    duanyao
    deepin
    2018-04-24 02:12
    Author
    本帖最后由 duanyao 于 2018-4-23 18:14 编辑

    https://bbs.deepin.org/user/48640 https://bbs.deepin.org/user/101846

    我在使用 bless 二进制编译器的时候经常遇到崩溃，其中最简单的重现方法是：
    1. 命令行启动 bless （ mono /usr/lib/bless/bless.exe ）；
    2. ctrl+o 打开文件对话框，随便选择一个文件打开；
    3. 点“x”关闭bless窗口。

    这时命令行中会出现崩溃信息（ free(): invalid pointer  或者 double free or corruption (out) ），应该是个内存双重释放（double free）的问题。
    不做第3步，使用一段时间后也有较大几率崩溃。

    我验证了 ubuntu 16.04 中 bless ，版本相同，但是并没有这样的崩溃问题。
    bless 是个纯 .net 程序，因此自身出现内存错误的可能性不大，估计是其依赖的库（mono、gtk等）有 bug。
    用 valgrind 检查，的确也检测到了 “Invalid free() / delete / delete[] / realloc()”，并且分配内存的地方是 gtk_file_chooser_get_filenames() 函数，看来与文件对话框有关。
    验证之后果然如此，只要不用文件对话框就不会崩溃（直接用命令行传递要打开的文件：mono /usr/lib/bless/bless.exe ），用了就会崩溃。

    又验证了一下 monodevelpe 程序，也有与文件对话框有关的崩溃现象，但崩溃更快，选中要打开的文件后就崩了，而不需要关闭窗口。用 valgrind 同样定位到  gtk_file_chooser_get_filenames() 函数。看来 mono 运行的 gtk# 2.0 程序都受到了影响。

    版本（deepin 15.5 升级到最新）：
      bless: 0.6.0-5
      libgtk2.0-cil: 2.12.40-1.1
      libglib2.0-cil: 2.12.40-1.1
      libgtk2.0-0: 2.24.31-34deepin

    版本（ubuntu 16.04)：
      bless: 0.6.0-5  
      libgtk2.0-cil: 2.12.10-6
      libglib2.0-cil: 2.12.10-6
      libgtk2.0-0: 2.24.30-1ubuntu1.16.04.1

    这是 bless 崩溃时的输出：

    1. *** Error in `mono': free(): invalid pointer: 0x00007fd0a40013c0 ***
    2. ======= Backtrace: =========
    3. /lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7fd0cf74abcb]
    4. /lib/x86_64-linux-gnu/libc.so.6(+0x76f96)[0x7fd0cf750f96]
    5. /lib/x86_64-linux-gnu/libc.so.6(+0x777de)[0x7fd0cf7517de]
    6. [0x41cc5c20]
    7. ======= Memory map: ========
    8. 41c05000-41c15000 rwxp 00000000 00:00 0
    9. # 略去很多内容 #
    10. 7fd0c5606000-7fd0c5806000 ---p 00112000 08:13 37749055                   /lib/x86_64-linux-gnu/libglib-2.0.so.0.5304.0Stacktrace:

    12.   at <0xffffffff>
    13.   at (wrapper managed-to-native) GLib.SList.g_free (intptr) <0x0005f>
    14.   at GLib.ListBase.Empty () <0x0013c>
    15.   at GLib.ListBase.Dispose (bool) <0x0000f>
    16.   at GLib.ListBase.Finalize () <0x0001d>
    17.   at (wrapper runtime-invoke) object.runtime_invoke_virtual_void__this__ (object,intptr,intptr,intptr) <0x00068>

    19. Native stacktrace:

    21.         mono(+0xc8d94) [0x55c8dab6ad94]
    22.         /lib/x86_64-linux-gnu/libpthread.so.0(+0x110c0) [0x7fd0cfca10c0]
    23.         /lib/x86_64-linux-gnu/libc.so.6(gsignal+0xcf) [0x7fd0cf70cfcf]
    24.         /lib/x86_64-linux-gnu/libc.so.6(abort+0x16a) [0x7fd0cf70e3fa]
    25.         /lib/x86_64-linux-gnu/libc.so.6(+0x70bd0) [0x7fd0cf74abd0]
    26.         /lib/x86_64-linux-gnu/libc.so.6(+0x76f96) [0x7fd0cf750f96]
    27.         /lib/x86_64-linux-gnu/libc.so.6(+0x777de) [0x7fd0cf7517de]
    28.         [0x41cc5c20]

    30. Debug info from gdb:

    32. Traceback (most recent call last):
    33.   File "", line 3, in
    34. ImportError: No module named 'libstdcxx'
    35. /home/duanyao/.gdbinit:6: Error in sourced command file:
    36. Error while executing Python code.
    37. [New LWP 2418]
    38. [New LWP 2419]
    39. [New LWP 2422]
    40. [New LWP 2423]
    41. [New LWP 2535]
    42. [Thread debugging using libthread_db enabled]
    43. Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
    44. pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225
    45. 225        ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S: 没有那个文件或目录.
    46.   Id   Target Id         Frame
    47. * 1    Thread 0x7fd0d07a4740 (LWP 2417) "Main" pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225
    48.   2    Thread 0x7fd0cebff700 (LWP 2418) "SGen worker" pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
    49.   3    Thread 0x7fd0cf38a700 (LWP 2419) "Finalizer" 0x00007fd0cfca0b3a in __waitpid (pid=2541, stat_loc=0x7fd0cf3887ac, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:29
    50.   4    Thread 0x7fd0ba1b5700 (LWP 2422) "gmain" 0x00007fd0cf7b963d in poll () at ../sysdeps/unix/syscall-template.S:84
    51.   5    Thread 0x7fd0b99b4700 (LWP 2423) "gdbus" 0x00007fd0cf7b963d in poll () at ../sysdeps/unix/syscall-template.S:84
    52.   6    Thread 0x7fd0aa331700 (LWP 2535) "pool" syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38

    54. # 略去很多内容 #

    56. Thread 3 (Thread 0x7fe277271700 (LWP 14269)):
    57. #0  0x00007fe277b87b3a in __waitpid (pid=15017, stat_loc=0x7fe27726f76c, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:29
    58. #1  0x0000557c7d647e70 in  ()
    59. #2  0x00007fe277b880c0 in () at /lib/x86_64-linux-gnu/libpthread.so.0
    60. #3  0x00007fe2775f3fcf in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
    61. #4  0x00007fe2775f53fa in __GI_abort () at abort.c:89
    62. #5  0x00007fe277631bd0 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fe277726d58 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
    63. #6  0x00007fe277637f96 in malloc_printerr (action=3, str=0x7fe27772390a "free(): invalid pointer", ptr=, ar_ptr=) at malloc.c:5049
    64. #7  0x00007fe2776387de in _int_free (av=0x7fe27795ab00 , p=0x557c80582230, have_lock=0) at malloc.c:3905
    65. #8  0x0000000041417cf5 in  ()
    66. #9  0x0000557c80582240 in  ()
    67. #10 0x0000000000000000 in  ()


    70. Thread 1 (Thread 0x7fd0d07a4740 (LWP 2417)):
    71. #0  0x00007fd0cfc9d508 in pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225
    72. #1  0x000055c8dacf967f in  ()
    73. #2  0x000055c8dad0ff34 in  ()
    74. #3  0x000055c8dac8721b in  ()
    75. #4  0x000055c8dac87c7c in mono_domain_finalize ()
    76. #5  0x000055c8daadce24 in  ()
    77. #6  0x000055c8dab3c09c in mono_main ()
    78. #7  0x000055c8daadaab6 in  ()
    79. #8  0x00007fd0cf6fa2b1 in __libc_start_main (main=0x55c8daada9b0, argc=2, argv=0x7ffee51dc8e8, init=, fini=, rtld_fini=, stack_end=0x7ffee51dc8d8) at ../csu/libc-start.c:291
    80. #9  0x000055c8daadae8a in _start ()

    82. =================================================================
    83. Got a SIGABRT while executing native code. This usually indicates
    84. a fatal error in the mono runtime or one of the native libraries
    85. used by your application.
    86. =================================================================
    Copy the Code

    这是 valgrind 检查 bless 的输出：

    1. valgrind --tool=memcheck mono /usr/lib/bless/bless.exe

    3. ==32562== Thread 3 Finalizer:
    4. ==32562== # 略去一些内容 #
    5. ==32562== Invalid free() / delete / delete[] / realloc()
    6. ==32562==    at 0x4C2CE1B: free (vg_replace_malloc.c:530)
    7. ==32562==    by 0xC327283: g_slice_free_chain_with_offset (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5304.0)
    8. ==32562==    by 0x1B94A9B4: ???
    9. ==32562==    by 0x1B94A1A0: ???
    10. ==32562==    by 0x2ECF8B: ??? (in /usr/bin/mono-sgen)
    11. ==32562==    by 0x33C07B: ??? (in /usr/bin/mono-sgen)
    12. ==32562==    by 0x2ED4BD: ??? (in /usr/bin/mono-sgen)
    13. ==32562==    by 0x2CB460: ??? (in /usr/bin/mono-sgen)
    14. ==32562==    by 0x38A9C9: ??? (in /usr/bin/mono-sgen)
    15. ==32562==    by 0x554F493: start_thread (pthread_create.c:333)
    16. ==32562==    by 0x5A64A8E: clone (clone.S:97)
    17. ==32562==  Address 0x95db190 is 0 bytes inside a block of size 16 free'd
    18. ==32562==    at 0x4C2CE1B: free (vg_replace_malloc.c:530)
    19. ==32562==    by 0x1B94A8B4: ???
    20. ==32562==    by 0x1B94A1A0: ???
    21. ==32562==    by 0x2ECF8B: ??? (in /usr/bin/mono-sgen)
    22. ==32562==    by 0x33C07B: ??? (in /usr/bin/mono-sgen)
    23. ==32562==    by 0x2ED4BD: ??? (in /usr/bin/mono-sgen)
    24. ==32562==    by 0x2CB460: ??? (in /usr/bin/mono-sgen)
    25. ==32562==    by 0x38A9C9: ??? (in /usr/bin/mono-sgen)
    26. ==32562==    by 0x554F493: start_thread (pthread_create.c:333)
    27. ==32562==    by 0x5A64A8E: clone (clone.S:97)
    28. ==32562==  Block was alloc'd at
    29. ==32562==    at 0x4C2BBEF: malloc (vg_replace_malloc.c:299)
    30. ==32562==    by 0xC30E208: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5304.0)
    31. ==32562==    by 0xC326642: g_slice_alloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5304.0)
    32. ==32562==    by 0xC3276B5: g_slist_prepend (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5304.0)
    33. ==32562==    by 0x9B31BAD: ??? (in /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0.2400.31)
    34. ==32562==    by 0x9B337F1: gtk_file_chooser_get_filenames (in /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0.2400.31)
    35. ==32562==    by 0x17CBFED4: ???
    36. ==32562==    by 0x145978: ??? (in /usr/bin/mono-sgen)
    37. ==32562==    by 0x2F381D: ??? (in /usr/bin/mono-sgen)
    38. ==32562==    by 0x2FA770: ??? (in /usr/bin/mono-sgen)
    39. ==32562==    by 0x26E988: ??? (in /usr/bin/mono-sgen)
    40. ==32562==    by 0x10AAEAAC: ???
    Copy the Code

    Reply Favorite View the author
    All Replies
    avatar
    liushijun
    deepin
    2018-05-26 01:41
    #1
    遇到同样的问题   monodevelope 创建项目直接崩溃
    Reply View the author
    avatar
    ltree
    deepin
    2019-08-08 01:47
    #2
    同问题，待解决
    Reply View the author