Segfault on access to user data passed to action callback

Bug #314675 reported by kriomant
4
Affects Status Importance Assigned to Milestone
notify-python (Ubuntu)
Triaged
Medium
Unassigned

Bug Description

Ubuntu Intrepid
python-notify-0.1.1-2build1

Trying to access user data passed to notification action callback leads to segfault.
Testcase is attached, it is slightly modified example program.

The reason is that refcount isn't incremented on 'user_data' argument in 'add_action', so it may be
garbage collected between calling 'add_action' and calling action callback.

Tags: patch
Revision history for this message
kriomant (kriomant) wrote :
Revision history for this message
kriomant (kriomant) wrote :
Revision history for this message
kriomant (kriomant) wrote :

As a workaround instead of:

  notification.add_action(id, name, callback, data)

use:

  notification.add_action(id, name, lambda n, id: callback(n, id, data))

Revision history for this message
kriomant (kriomant) wrote :

Fixed package is uploaded to my PPA: https://launchpad.net/~kriomant/+archive

Revision history for this message
Martin Mai (mrkanister-deactivatedaccount-deactivatedaccount) wrote :

Thank you for taking time to report this. Unfortunately I can not reproduce this with the test file you provided (It just shows a little notification "Matt is online" and thats it. No segfault (I run Intrepid).

Can you try it with a new user created on your system and maybe a clean install (dual boot or virtualbox should be enough). Thanks in advance.

Changed in notify-python:
status: New → Incomplete
Revision history for this message
kriomant (kriomant) wrote :

Did you click notification? It is needed to reproduce segfault.

If you did and got no segfault, I'll try to reproduce bug on clean installation.

Revision history for this message
Martin Mai (mrkanister-deactivatedaccount-deactivatedaccount) wrote :

I forgot to klick it, thanks for reminding me, but I still get no segfault. Here is the terminal output:

1) Left click on the notification
martin@martin-laptop:~/Desktop$ python test-default-action.py
You clicked the default action
User data: <__main__.A instance at 0x1e82bd8>

2) Left click on the "x" (close) button (I had to press [ctrl] + [c] because the python script didn't quit itself):
martin@martin-laptop:~/Desktop$ python test-default-action.py
^CTraceback (most recent call last):
  File "test-default-action.py", line 29, in <module>
    gtk.main()
KeyboardInterrupt

3) Right click on the notification:
martin@martin-laptop:~/Desktop$ python test-default-action.py
You clicked the default action
User data: <__main__.A instance at 0x1ed6bd8>

Seems like the problem is actually related to your configuration. Maybe a new user is enough do avoid the segfault. Thanks for trying.

Revision history for this message
kriomant (kriomant) wrote :

Just tried it on Ubuntu Intrepid Live CD. I don't even have to install pynotify, it is installed by default.

ubuntu@ubuntu:~$ python test.py
You clicked the default action
Segmentation fault (core dumped)
ubuntu@ubuntu:~$ python --version
Python 2.5.2
ubuntu@ubuntu:~$ dpkg-query -W python-notify
python-notify 0.1.1-2build1

Please try modified version of test with forced garbage collection. It is the only thing (which I know about) that may affect segfaulting, since reference is definitely isn't hold in code and object must be freed.

Revision history for this message
Martin Mai (mrkanister-deactivatedaccount-deactivatedaccount) wrote :

I am sorry, but still no segfault :)

martin@martin-laptop:~/Desktop$ python test-default-action-gc.py
You clicked the default action
User data: <__main__.A instance at 0x27496c8>
martin@martin-laptop:~/Desktop$ python --version
Python 2.5.2
martin@martin-laptop:~/Desktop$ dpkg-query -W python-notify
python-notify 0.1.1-2build1

Revision history for this message
Martin Mai (mrkanister-deactivatedaccount-deactivatedaccount) wrote :

Hm...this is interesting. I have two computers here and the one is segfaulting with your examples but the other is not segfaulting. The only remarkable difference is that the segfaulting computer runs Ubuntu 32-bit and the non segfaulting computer runs Ubuntu 64-bit

Changed in notify-python:
status: Incomplete → Confirmed
Changed in notify-python:
importance: Undecided → Medium
status: Confirmed → Triaged
Revision history for this message
David Futcher (bobbo) wrote :

In response to comment #10, I can't get this to segfault on 64bit Maverick alpha 1. I don't have any 32bit computers to test it on, but if someone could test the attached test-script on a 32bit install, that would be greatly helpful.

Thanks!

Revision history for this message
kriomant (kriomant) wrote :

Reproduced on Lucid 32bit.
Interesting that it segfaults if you click button using mouse, but it hangs if you press button using keyboard.

tags: added: patch
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.