Xviewer crashes loading an image while different images are being written to the same directory #201
Description
* Xviewer version (xviewer --version)
* Distribution - (Mint 17.2, Arch, Fedora 25, etc...)
Xviewer 3.2.10
DISTRIB_ID=LinuxMint
DISTRIB_RELEASE=21
DISTRIB_CODENAME=vanessa
DISTRIB_DESCRIPTION="Linux Mint 21 Vanessa"
Issue
Xviewer crashes trying to open an image in a directory while new images are being written to the same directory.
Steps to reproduce
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer --disable-gallery random_image_1.png
[1] 3787259
(xviewer:3787400): GLib-WARNING **: 21:22:18.877: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3787400): GLib-WARNING **: 21:22:18.877: Accessing a sequence while it is being sorted or searched is not allowed
double free or corruption (!prev)
Aborted (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer --disable-gallery random_image_1.png
[2] 3789287
[1] Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
(xviewer:3789398): GLib-WARNING **: 21:22:25.079: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3789398): GLib-WARNING **: 21:22:25.079: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3789398): GLib-WARNING **: 21:22:25.115: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3789398): GLib-WARNING **: 21:22:25.124: Accessing a sequence while it is being sorted or searched is not allowed
malloc(): invalid size (unsorted)
Aborted (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer random_image_1.png
[3] 3791306
[2] Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
** (xviewer:3791432): CRITICAL **: 21:22:36.432: xviewer_image_get_collate_key: assertion 'XVIEWER_IS_IMAGE (img)' failed
Segmentation fault (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer random_image_1.png
[4] 3793324
[3] Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
(xviewer:3793454): GLib-WARNING **: 21:22:38.727: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3793454): GLib-WARNING **: 21:22:38.727: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3793454): GLib-WARNING **: 21:22:38.741: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3793454): GLib-WARNING **: 21:22:38.774: Accessing a sequence while it is being sorted or searched is not allowed
malloc(): invalid size (unsorted)
Aborted (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer random_image_1.png
[5] 3795326
[4]- Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
free(): invalid pointer
Aborted (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer random_image_1.png
[6] 3797364
[5] Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
** (xviewer:3797450): CRITICAL **: 21:23:00.680: xviewer_image_get_collate_key: assertion 'XVIEWER_IS_IMAGE (img)' failed
Segmentation fault (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer random_image_1.png
[7] 3799383
[6] Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
(xviewer:3799505): GLib-WARNING **: 21:23:05.172: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3799505): GLib-WARNING **: 21:23:05.172: Accessing a sequence while it is being sorted or searched is not allowed
malloc(): invalid size (unsorted)
Aborted (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer random_image_1.png
[8] 3801401
[7] Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
(xviewer:3801610): GLib-WARNING **: 21:23:09.186: Accessing a sequence while it is being sorted or searched is not allowed
** (xviewer:3801610): CRITICAL **: 21:23:09.186: xviewer_image_get_collate_key: assertion 'XVIEWER_IS_IMAGE (img)' failed
[8]+ Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
Segmentation fault (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer random_image_1.png
[1] 3803536
(xviewer:3804051): GLib-WARNING **: 21:24:18.471: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3804051): GLib-WARNING **: 21:24:18.471: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3804051): GLib-WARNING **: 21:24:18.472: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3804051): GLib-WARNING **: 21:24:18.479: Accessing a sequence while it is being sorted or searched is not allowed
malloc(): invalid size (unsorted)
Aborted (core dumped)
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer random_image_999.png
[3] 3807579
[2] Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
(xviewer:3808165): GLib-WARNING **: 21:24:39.728: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3808165): GLib-WARNING **: 21:24:39.749: Accessing a sequence while it is being sorted or searched is not allowed
(xviewer:3808165): GLib-WARNING **: 21:24:39.749: Accessing a sequence while it is being sorted or searched is not allowed
malloc(): invalid size (unsorted)
Aborted (core dumped)
redacted:/tmp$ cp random_image_1.png bystander.png
[3]+ Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
redacted:/tmp$ (for i in $(seq 1 2000); do convert -size 1x1 xc:red "random_image_$i.png" >/dev/null 2>&1 & done) & sleep 0.5; xviewer bystander.png
[1] 3809610
** (xviewer:3810264): CRITICAL **: 21:25:20.358: xviewer_image_get_collate_key: assertion 'XVIEWER_IS_IMAGE (img)' failed
[1]+ Done ( for i in $(seq 1 2000);
do
convert -size 1x1 xc:red "random_image_$i.png" > /dev/null 2>&1 &
done )
Segmentation fault (core dumped)
Note: this is not a race condition in the pipes. I can reproduce this in two separate shells, while one is writing files to the directory and the other is trying to read a bystander file that is definitely written.
One trace:
Stack trace of thread 3684047:
#0 0x00007fe2d62969fc __pthread_kill_implementation (libc.so.6 + 0x969fc)
#1 0x00007fe2d6242476 __GI_raise (libc.so.6 + 0x42476)
#2 0x00007fe2d62287f3 __GI_abort (libc.so.6 + 0x287f3)
#3 0x00007fe2d6289676 __libc_message (libc.so.6 + 0x89676)
#4 0x00007fe2d62a0cfc malloc_printerr (libc.so.6 + 0xa0cfc)
#5 0x00007fe2d62a40dc _int_malloc (libc.so.6 + 0xa40dc)
#6 0x00007fe2d62a65f9 __libc_calloc (libc.so.6 + 0xa65f9)
#7 0x00007fe2d6e94c51 g_malloc0 (libglib-2.0.so.0 + 0x5ec51)
#8 0x00007fe2d6e76481 n/a (libglib-2.0.so.0 + 0x40481)
#9 0x00007fe2d6e7a3c2 g_hash_table_destroy (libglib-2.0.so.0 + 0x443c2)
#10 0x00007fe2d68487e1 n/a (libgtk-3.so.0 + 0x2487e1)
#11 0x00007fe2d69f8a76 n/a (libgtk-3.so.0 + 0x3f8a76)
#12 0x00007fe2d684be65 gtk_list_store_set_valist (libgtk-3.so.0 + 0x24be65)
#13 0x00007fe2d684bf88 gtk_list_store_set (libgtk-3.so.0 + 0x24bf88)
#14 0x00007fe2d7204b0f xviewer_list_store_add_thumbnail_job (libxviewer.so + 0x33b0f)
#15 0x00007fe2d7207b94 file_monitor_changed_cb (libxviewer.so + 0x36b94)
#16 0x00007fe2d7048be7 n/a (libgio-2.0.so.0 + 0x78be7)
#17 0x00007fe2d6fa2700 g_signal_emit_valist (libgobject-2.0.so.0 + 0x32700)
#18 0x00007fe2d6fa2863 g_signal_emit (libgobject-2.0.so.0 + 0x32863)
#19 0x00007fe2d710b246 n/a (libgio-2.0.so.0 + 0x13b246)
#20 0x00007fe2d6e8bd3b g_main_context_dispatch (libglib-2.0.so.0 + 0x55d3b)
#21 0x00007fe2d6ee12b8 n/a (libglib-2.0.so.0 + 0xab2b8)
#22 0x00007fe2d6e893e3 g_main_context_iteration (libglib-2.0.so.0 + 0x533e3)
#23 0x00007fe2d70b0fb5 g_application_run (libgio-2.0.so.0 + 0xe0fb5)
#24 0x000058be8915e4bc main (xviewer + 0x24bc)
#25 0x00007fe2d6229d90 __libc_start_call_main (libc.so.6 + 0x29d90)
#26 0x00007fe2d6229e40 __libc_start_main_impl (libc.so.6 + 0x29e40)
#27 0x000058be8915e5c5 _start (xviewer + 0x25c5)
Stack trace of thread 3684051:
#0 0x00007fe2d6e7659b n/a (libglib-2.0.so.0 + 0x4059b)
#1 0x00007fe2d6e799cc n/a (libglib-2.0.so.0 + 0x439cc)
#2 0x00007fe2d6e79df0 g_hash_table_insert (libglib-2.0.so.0 + 0x43df0)
#3 0x00007fe2d684874e n/a (libgtk-3.so.0 + 0x24874e)
#4 0x00007fe2d69f8a54 n/a (libgtk-3.so.0 + 0x3f8a54)
#5 0x00007fe2d684be65 gtk_list_store_set_valist (libgtk-3.so.0 + 0x24be65)
#6 0x00007fe2d684bf88 gtk_list_store_set (libgtk-3.so.0 + 0x24bf88)
#7 0x00007fe2d72021de xviewer_list_store_append_image (libxviewer.so + 0x311de)
#8 0x00007fe2d7230f3d xviewer_list_store_append_directory.constprop.0 (libxviewer.so + 0x5ff3d)
#9 0x00007fe2d720762e xviewer_list_store_add_files (libxviewer.so + 0x3662e)
#10 0x00007fe2d720792e xviewer_job_model_run (libxviewer.so + 0x3692e)
#11 0x00007fe2d7204e9f xviewer_job_scheduler (libxviewer.so + 0x33e9f)
#12 0x00007fe2d6ebaab1 n/a (libglib-2.0.so.0 + 0x84ab1)
#13 0x00007fe2d6294ac3 start_thread (libc.so.6 + 0x94ac3)
#14 0x00007fe2d6326850 __clone3 (libc.so.6 + 0x126850)
Stack trace of thread 3684048:
#0 0x00007fe2d6318bcf __GI___poll (libc.so.6 + 0x118bcf)
#1 0x00007fe2d6ee1256 n/a (libglib-2.0.so.0 + 0xab256)
#2 0x00007fe2d6e893e3 g_main_context_iteration (libglib-2.0.so.0 + 0x533e3)
#3 0x00007fe2d6e89431 n/a (libglib-2.0.so.0 + 0x53431)
#4 0x00007fe2d6ebaab1 n/a (libglib-2.0.so.0 + 0x84ab1)
#5 0x00007fe2d6294ac3 start_thread (libc.so.6 + 0x94ac3)
#6 0x00007fe2d6326850 __clone3 (libc.so.6 + 0x126850)
Stack trace of thread 3684049:
#0 0x00007fe2d6318bcf __GI___poll (libc.so.6 + 0x118bcf)
#1 0x00007fe2d6ee1256 n/a (libglib-2.0.so.0 + 0xab256)
#2 0x00007fe2d6e893e3 g_main_context_iteration (libglib-2.0.so.0 + 0x533e3)
#3 0x00007fe2d1a7b33d n/a (libdconfsettings.so + 0x733d)
#4 0x00007fe2d6ebaab1 n/a (libglib-2.0.so.0 + 0x84ab1)
#5 0x00007fe2d6294ac3 start_thread (libc.so.6 + 0x94ac3)
#6 0x00007fe2d6326850 __clone3 (libc.so.6 + 0x126850)
Stack trace of thread 3684050:
#0 0x00007fe2d6318bcf __GI___poll (libc.so.6 + 0x118bcf)
#1 0x00007fe2d6ee1256 n/a (libglib-2.0.so.0 + 0xab256)
#2 0x00007fe2d6e8b2b3 g_main_loop_run (libglib-2.0.so.0 + 0x552b3)
#3 0x00007fe2d70e581a n/a (libgio-2.0.so.0 + 0x11581a)
#4 0x00007fe2d6ebaab1 n/a (libglib-2.0.so.0 + 0x84ab1)
#5 0x00007fe2d6294ac3 start_thread (libc.so.6 + 0x94ac3)
#6 0x00007fe2d6326850 __clone3 (libc.so.6 + 0x126850)
Expected behavior
Don't crash. Also, for a default image viewer that should be 100% reliable, don't access files on a filesystem other than the files specified in the argument or without any user intent. This is linux. If you want to do feature-rich things without user intent in default applications, there are more appropriate platforms for that ethos.
Other information
At first I thought this was the same as the previously reported bug (#114), but I was corrected that it is a different bug. This one requires active file writes.