Bug#588302: liferea: Crashes with "Illegal Operation" when attempting to view feed items

[Andreas Metzler]

On 2010-07-08 Adrian Bunk <bunk at stusta.de> wrote:
> On Wed, Jul 07, 2010 at 07:46:29AM +0100, Ben Green wrote:
>> Package: liferea
>> Version: 1.6.3-1
>> Severity: important

>> When viewing some of the feed items from certain feeds Liferea crashes. An
>> example is the planet Debian feed:
 
>> http://planet.debian.org/rss20.xml
 
>> Running from the command line with --debug-all on then clicking on the recent
>> feed item "James Morrison: A speech that didn't happen" I get the following
>> output just before the crash:
 
>> DB: loading item 70 (thread=0x205ff60)
>> DB: loading item 70 (thread=0x205ff60)
>> GUI: item list selection changed to "James Morrison: A speech that didn't
>> happen"
>> HTML: HTML view: selecting "James Morrison: A speech that didn't happen"
>> DB: loading item 70 (thread=0x205ff60)
>> DB: loading item 70 (thread=0x205ff60)
>> DB: loading item 70 (thread=0x205ff60)
>> PERF: htmlview_render_item took 0,021s
>> HTML: writing 9313 bytes to HTML view
>> GUI: itemlist selection took 0,117s
>> PERF: itemlist_selection_changed took 0,117s
>> Illegal instruction
 
>> Liferea is set up with default settings in all cases, I have purely imported my
>> usual OPML feedlist.

>> -- System Information:
[...] 
>> Kernel: Linux 2.6.32-5-amd64 (SMP w/4 CPU cores)
>>...

> Thanks for your report. It works for me, and "Illegal instruction" 
> is a bit surprising.

> Please run liferea in gdb and provide the backtrace:
> gdb /usr/bin/liferea
> (gdb) run
> And after it crashed:
> (gdb) bt

Hello,
There is something fishy going on and I am not conviced it is gnutls
related. liferea works for me on sid/i386. Seeing that the bug
submitter was using AMD64 I also doublechecked in the the sid/amd64
chroot. Klicking around and removing the Debian-package-a-day sample feed I
(reproducibly) get this crash (which is completely different):

--------------------------------------------------
CONF: Scheduling feedlist save

Liferea did receive signal 11 (Segmentation fault).
You have propably triggered a program bug. I will now try to
create a backtrace which you can attach to any support requests.

#0  0x00007f4aa32b5b4d in waitpid () from /lib/libpthread.so.0
#1  0x00007f4aa2d9e687 in g_on_error_stack_trace () from /lib/libglib-2.0.so.0
#2  0x0000000000434292 in ?? ()
#3  <signal handler called>
#4  0x00007f4aa6117293 in ?? () from /usr/lib/libwebkit-1.0.so.2
#5  0x00007f4aa6117ed1 in ?? () from /usr/lib/libwebkit-1.0.so.2
#6  0x00007f4aa6117f18 in ?? () from /usr/lib/libwebkit-1.0.so.2
#7  0x00007f4aa6118f4f in ?? () from /usr/lib/libwebkit-1.0.so.2
#8  0x00007f4aa6119c07 in ?? () from /usr/lib/libwebkit-1.0.so.2
#9  0x00007f4aa5983cf5 in ?? () from /usr/lib/libwebkit-1.0.so.2
#10 0x00007f4aa5cf7426 in ?? () from /usr/lib/libwebkit-1.0.so.2
#11 0x00007f4aa5faeca2 in ?? () from /usr/lib/libwebkit-1.0.so.2
#12 0x00007f4aa2dc2e9b in ?? () from /lib/libglib-2.0.so.0
#13 0x00007f4aa2dc26c2 in g_main_context_dispatch ()
#14 0x00007f4aa2dc6538 in ?? () from /lib/libglib-2.0.so.0
#15 0x00007f4aa2dc6a45 in g_main_loop_run () from /lib/libglib-2.0.so.0
#16 0x00007f4aa4a98647 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#17 0x00000000004340a2 in main ()
--------------------------------------------------


After installing gdb libgnutls26-dbg libwebkit-1.0-2-dbg liferea-dbg I get
this in gdb:
--------------------------------------------------
Program received signal SIGSEGV, Segmentation fault.
JSC::Heap::markConservatively (this=<value optimized out>, markStack=...,
    start=<value optimized out>, end=<value optimized out>)
    at ../JavaScriptCore/runtime/Collector.cpp:771
771     ../JavaScriptCore/runtime/Collector.cpp: No such file or directory.
        in ../JavaScriptCore/runtime/Collector.cpp
(gdb) bt
#0  JSC::Heap::markConservatively (this=<value optimized out>, markStack=...,
    start=<value optimized out>, end=<value optimized out>)
    at ../JavaScriptCore/runtime/Collector.cpp:771
#1  0x00007ffff6888ed1 in JSC::Heap::markCurrentThreadConservativelyInternal (
    this=0x7ffff7e83230, markStack=...)
    at ../JavaScriptCore/runtime/Collector.cpp:799
#2  0x00007ffff6888f18 in JSC::Heap::markCurrentThreadConservatively (
    this=<value optimized out>, markStack=<value optimized out>)
    at ../JavaScriptCore/runtime/Collector.cpp:821
#3  0x00007ffff6889f4f in JSC::Heap::markStackObjectsConservatively (
    this=<value optimized out>) at ../JavaScriptCore/runtime/Collector.cpp:973
#4  JSC::Heap::markRoots (this=<value optimized out>)
    at ../JavaScriptCore/runtime/Collector.cpp:1113
#5  0x00007ffff688ac07 in JSC::Heap::collectAllGarbage (this=0x7ffff7e83230)
    at ../JavaScriptCore/runtime/Collector.cpp:1271
#6  0x00007ffff60f4cf5 in collect ()
    at ../WebCore/bindings/js/GCController.cpp:46
#7  0x00007ffff6468426 in WebCore::ThreadTimers::sharedTimerFiredInternal (
    this=0x7ffff7e28870) at ../WebCore/platform/ThreadTimers.cpp:112
#8  0x00007ffff671fca2 in timeout_cb ()
    at ../WebCore/platform/gtk/SharedTimerGtk.cpp:48
#9  0x00007ffff3533e9b in ?? () from /lib/libglib-2.0.so.0
#10 0x00007ffff35336c2 in g_main_context_dispatch ()
   from /lib/libglib-2.0.so.0
#11 0x00007ffff3537538 in ?? () from /lib/libglib-2.0.so.0
#12 0x00007ffff3537a45 in g_main_loop_run () from /lib/libglib-2.0.so.0
#13 0x00007ffff5209647 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#14 0x00000000004340a2 in main (argc=1, argv=0x7fffffffe7a8) at main.c:345
--------------------------------------------------

cu andreas
-- 
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'