[treebrowser] Intermittent crashing when deleting a file

[adamplumb]

I'm running Geany 1.32 with treebrowser as my only plugin. I've been using it more heavily than usual today to create files and delete files, and I've had three crashes just today. Here is a stack trace that I'm grabbing from Fedora's abrt application.

treebrowser-dump.txt
https://retrace.fedoraproject.org/faf/reports/1993243/

[lpaulsen93]

I tried to force a crash by deleting files and going back up in the directory tree, nothing happend. Also tried some different things. But I could not re-produce a crash.

Do you know a reproducible sequence of actions which will make geany crash?

[adamplumb]

Unfortunately I can't reproduce this regularly. It seems like it must be some kind of race condition caused when I'm deleting or moving around files, because it only happens intermittently.

[bbrtj]

I encounter the same issue on my new machine. Some things I found out (testing in almost empty directory - 0 files, 1 subdirectory):

• It does not happen on every deletion, but I can't find a valid pattern to when it crashes
• If I create two files and then delete them, it does not crash after the first deletion, only second
• If I create three files and then delete them, it also crashes after the last one
• If I create files outside geany it behaves the same way
• If there are more files in the directory (not recently created?) it appears to be behaving the same way and crashes after all created files are deleted
• It does not seem like privileges issue. The files are getting deleted just before the crash
  The issue is quite annoying because I loved file manipulation options of the plugin, I'll try to find out more and post here to help you spot the issue

[bbrtj]

I've been using geany for the past couple of days deleting files / directories from time to time. It doesn't crash often and definetly not often enough to give any hint on what could be the problem. The only time I can make it crash consistently is when I create and then immediately delete a file. For older files it seems random indeed. Thankfully geany launches in half a second so it's not that big of a deal but still I'd be thankful if you could take a deeper look into it (if you manage to reproduce it)

[codebrainz]

This assert seems to be firing.

I don't really know anything about GtkTreeView stuff, but maybe one of the calls to treebrowser_tree_store_iter_clear_nodes() is passing an invalid iterator and/or one with no parent?

If anyone can provide a backtrace with debugging symbols for Geany/TreeBrowser installed, it might be easier to track down.

[bbrtj]

I've reproduced this bug in gdb:

(geany:31866): Geany-CRITICAL **: 14:17:18.690: document_close: assertion 'doc' failed
**
Gtk:ERROR:../../../../gtk/gtktreestore.c:1220:gtk_tree_store_remove: assertion failed: (parent != NULL)

Thread 1 "geany" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51	../sysdeps/unix/sysv/linux/raise.c: Not a file or directory.

Backtrace:

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff7148801 in __GI_abort () at abort.c:79
#2  0x00007ffff4caa335 in g_assertion_message () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007ffff4caa39a in g_assertion_message_expr () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007ffff694d24e in gtk_tree_store_remove () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#5  0x00007fffda376512 in ?? () from /usr/lib/x86_64-linux-gnu/geany/treebrowser.so
#6  0x00007fffda376fad in ?? () from /usr/lib/x86_64-linux-gnu/geany/treebrowser.so
#7  0x00007fffda378a6e in ?? () from /usr/lib/x86_64-linux-gnu/geany/treebrowser.so
#8  0x00007ffff516210d in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#9  0x00007ffff517505e in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#10 0x00007ffff517d715 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#11 0x00007ffff517e12f in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#12 0x00007ffff69779d6 in gtk_widget_activate () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#13 0x00007ffff6849f76 in gtk_menu_shell_activate_item () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#14 0x00007ffff684a1f2 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#15 0x00007ffff682d8f7 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#16 0x00007ffff5162346 in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#17 0x00007ffff517d3cd in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#18 0x00007ffff517e12f in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#19 0x00007ffff6975534 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#20 0x00007ffff682a86e in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#21 0x00007ffff682c948 in gtk_main_do_event () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#22 0x00007ffff633d765 in ?? () from /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
#23 0x00007ffff636df92 in ?? () from /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
#24 0x00007ffff4c83417 in g_main_context_dispatch () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#25 0x00007ffff4c83650 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#26 0x00007ffff4c83962 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#27 0x00007ffff682ba25 in gtk_main () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#28 0x00007ffff778c33a in main_lib () from /usr/lib/x86_64-linux-gnu/libgeany.so.0
#29 0x00007ffff7129b97 in __libc_start_main (main=0x555555554650, argc=2, argv=0x7fffffffdfe8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdfd8)
    at ../csu/libc-start.c:310
#30 0x000055555555468a in ?? ()

[codebrainz]

@brtastic any chance to do it with debug symbols installed for Geany/TreeBrowser?

Assuming the document_close assertion is coming from TreeBrowser, I notice a few places where it calls document_close without checking if the document is NULL and/or valid, especially here where the called function will return NULL if the file isn't found. This code appears to be in the path of deleting a file, though it may be entirely unrelated to the crasher.

[bbrtj]

As far as I understand I'd have to compile TreeBrowser from source to have it's debug symbols?
That would be problematic, I can only reproduce in my workplace so I can't spend too much time on this. Do you have some reference material which will guide me through the process in shortest time possible?

[ChrisJAllan]

Stack trace with debug symbols:

#0  0x00007efbff202ce5 raise (libc.so.6 + 0x3bce5)
#1  0x00007efbff1ec857 abort (libc.so.6 + 0x25857)
#2  0x00007efbfe4fa056 n/a (libglib-2.0.so.0 + 0x1c056)
#3  0x00007efbfe522ddd g_assertion_message_expr (libglib-2.0.so.0 + 0x44ddd)
#4  0x00007efbfec5c8f7 gtk_tree_store_remove (libgtk-3.so.0 + 0x1708f7)
#5  0x00007efbf712c814 treebrowser_tree_store_iter_clear_nodes (treebrowser.so + 0x6814)
#6  0x00007efbf712d3eb treebrowser_browse (treebrowser.so + 0x73eb)
#7  0x00007efbf712f14b on_menu_delete (treebrowser.so + 0x914b)
#8  0x00007efbfe64b61a g_closure_invoke (libgobject-2.0.so.0 + 0x3e61a)
#9  0x00007efbfe62c97e n/a (libgobject-2.0.so.0 + 0x1f97e)
#10 0x00007efbfe62fab9 g_signal_emit_valist (libgobject-2.0.so.0 + 0x22ab9)
#11 0x00007efbfe6316b0 g_signal_emit (libgobject-2.0.so.0 + 0x246b0)
#12 0x00007efbfec2af8b gtk_widget_activate (libgtk-3.so.0 + 0x13ef8b)
#13 0x00007efbfed6069d gtk_menu_shell_activate_item (libgtk-3.so.0 + 0x27469d)
#14 0x00007efbfed631d4 n/a (libgtk-3.so.0 + 0x2771d4)
#15 0x00007efbfeec34ec n/a (libgtk-3.so.0 + 0x3d74ec)
#16 0x00007efbfe6300a0 g_signal_emit_valist (libgobject-2.0.so.0 + 0x230a0)
#17 0x00007efbfe6316b0 g_signal_emit (libgobject-2.0.so.0 + 0x246b0)
#18 0x00007efbfec2cad6 n/a (libgtk-3.so.0 + 0x140ad6)
#19 0x00007efbfed72dd5 n/a (libgtk-3.so.0 + 0x286dd5)
#20 0x00007efbfed7636c gtk_main_do_event (libgtk-3.so.0 + 0x28a36c)
#21 0x00007efbfea86ed4 n/a (libgdk-3.so.0 + 0x94ed4)
#22 0x00007efbfea33c24 n/a (libgdk-3.so.0 + 0x41c24)
#23 0x00007efbfe5499be g_main_context_dispatch (libglib-2.0.so.0 + 0x6b9be)
#24 0x00007efbfe54b831 n/a (libglib-2.0.so.0 + 0x6d831)
#25 0x00007efbfe54c843 g_main_loop_run (libglib-2.0.so.0 + 0x6e843)
#26 0x00007efbfed6f94f gtk_main (libgtk-3.so.0 + 0x28394f)
#27 0x00007efbff40bd1f main_lib (libgeany.so.0 + 0x7ed1f)
#28 0x00007efbff1ee023 __libc_start_main (libc.so.6 + 0x27023)
#29 0x000056555555405e n/a (geany + 0x105e)