Crash in buttonbar_call

[jpalecek]

Hello,

while going through my /var/crash directory, I discovered some crashes of mc. Unfortunately, I cannot tell you what I was doing at the time, the only thing evident from the crash dumps is that I pressed F8. However, gdb shows some useful info:

(gdb) bt
#0  0x695f316c in ?? ()
#1  0x004cdd74 in send_message (data=0x0, parm=<optimized out>, msg=MSG_ACTION, sender=0x13ff2e0, w=<optimized out>) at ../../lib/widget/widget-common.h:216
#2  buttonbar_call (bb=bb@entry=0x13ff2e0, i=i@entry=7) at buttonbar.c:155
#3  0x004cde5f in buttonbar_callback (w=0x13ff2e0, sender=0x0, msg=MSG_HOTKEY, parm=1008, data=0x0) at buttonbar.c:172
#4  0x004d2d1a in send_message (data=0x0, parm=1008, msg=MSG_HOTKEY, sender=0x0, w=<optimized out>) at ../../lib/widget/widget-common.h:216
#5  dlg_try_hotkey (h=0x13dcd20, h=0x13dcd20, d_key=1008) at dialog.c:438
#6  dlg_key_event (d_key=1008, h=0x13dcd20) at dialog.c:483
#7  dlg_process_event (h=0x13dcd20, key=1008, event=0xbf830600) at dialog.c:1134
#8  0x004d2e7e in frontend_dlg_run (h=0x13dcd20) at dialog.c:545
#9  dlg_run (h=0x13dcd20) at dialog.c:1167
#10 0x004ee3dd in do_nc () at midnight.c:1836
#11 0x004c67a9 in main (argc=<optimized out>, argv=<optimized out>) at main.c:405

In buttonbar_call, the button bar is interesting:

(gdb) p *bb                    
$2 = {widget = {x = 0, y = 65, cols = 274, lines = 1, pos_flags = WPOS_KEEP_DEFAULT, options = WOP_WANT_HOTKEY, state = WST_DEFAULT, id = 6, callback = 0x4cdde0 <buttonbar_callback>, mouse_callback = 0x4cdd90 <buttonbar_mouse_callback>, owner = 0x13dcd20, mouse = {
      forced_capture = 0, capture = 0, last_msg = MSG_MOUSE_NONE, last_buttons_down = 0}}, visible = 1, labels = {{text = 0x1433fb0 "Nápověda", command = 42, receiver = 0x14d1800, end_coord = 27}, {text = 0x13f8560 "Nezal.", command = 600, receiver = 0x14d1800, 
      end_coord = 54}, {text = 0x13ff410 "Zobraz", command = 101, receiver = 0x0, end_coord = 81}, {text = 0x13ff470 "Hex", command = 603, receiver = 0x14d1800, end_coord = 109}, {text = 0x13ff4d0 "JítNa", command = 54, receiver = 0x14d1800, end_coord = 137}, {
      text = 0x13519a0 "", command = 0, receiver = 0x14d1800, end_coord = 164}, {text = 0x12a7d00 "Hledat", command = 37, receiver = 0x14d1800, end_coord = 191}, {text = 0x13ff5e0 "Nezprac", command = 601, receiver = 0x14d1800, end_coord = 218}, {
      text = 0x13ff640 "Hl. nabíd", command = 33, receiver = 0x0, end_coord = 246}, {text = 0x13ff6a0 "Konec", command = 87, receiver = 0x0, end_coord = 274}}}

Which means the button bar is for the viewer (could be the quick view as I was using that). However, the receiver is pointing to junk which is why it crashed:

(gdb) p *bb->labels[7].receiver
$1 = {x = 22435832, y = 23230968, cols = 762605673, lines = 1600610916, pos_flags = 842346041, options = (WOP_WANT_CURSOR | WOP_WANT_TAB | WOP_IS_INPUT | WOP_SELECTABLE | WOP_TOP_SELECT | unknown: 1936090176), 
  state = (WST_DISABLED | WST_IDLE | WST_MODAL | WST_ACTIVE | unknown: 724577632), id = 1633906540, callback = 0x695f316c, mouse_callback = 0x2e363833, owner = 0x30, mouse = {forced_capture = 48, capture = 19857944, last_msg = 1952934768, last_buttons_down = 1601467237}}

Going to the top dlg_run and inspecting the top level window:

(gdb) p *h
$4 = {widget = {x = 0, y = 0, cols = 274, lines = 66, pos_flags = WPOS_FULLSCREEN, options = (WOP_WANT_TAB | WOP_SELECTABLE | WOP_TOP_SELECT), state = (WST_FOCUSED | WST_ACTIVE), id = 0, callback = 0x4ed0d0 <midnight_callback>, mouse_callback = 0x0, owner = 0x0, mouse = {
      forced_capture = 0, capture = 0, last_msg = MSG_MOUSE_NONE, last_buttons_down = 0}}, compact = 0, help_ctx = 0x574e09 "[main]", color = 0x60b9d4 <dialog_colors>, title = 0x0, ret_value = 0, winch_pending = 0, mouse_status = 1, widgets = 0x13deb90 = {0x13e1510, 
    0x13f80f0, 0x12d7980, 0x13f80a0, 0x13ff2e0, 0x14a46a0, 0x13fecf0}, current = 0x13e0e60 = {0x13fecf0}, widget_id = 7, data = 0x0, event_group = 0x12dea90 "Dialog_0x13dcd20", get_shortcut = 0x4eb8a0 <midnight_get_shortcut>, get_title = 0x4eb7e0 <midnight_get_title>}

The widgets are actually interesting, especially the last two. They are the panels and IIUC it shows the two panels were actually file lists:

(gdb) p *(WPanel*)0x14a46a0
$35 = {widget = {x = 0, y = 1, cols = 137, lines = 62, pos_flags = WPOS_KEEP_DEFAULT, options = (WOP_SELECTABLE | WOP_TOP_SELECT), state = WST_DEFAULT, id = 1, callback = 0x4f52e0 <panel_callback>, mouse_callback = 0x4f3f80 <panel_mouse_callback>, owner = 0x13dcd20, 
    mouse = {forced_capture = 0, capture = 0, last_msg = MSG_MOUSE_NONE, last_buttons_down = 0}}, dir = {list = 0x1556000, size = 128, len = 52, callback = 0x4efbd0 <panel_dir_list_callback>}, list_format = list_full, active = 0, cwd_vpath = 0x135d410, 
  lwd_vpath = 0x14223a0, dir_history = 0x159c690 = {0x13ebcd0}, dir_history_current = 0x159c690 = {0x13ebcd0}, hist_name = 0x15d55c0 "Dir Hist New Left Panel", marked = 0, dirs_marked = 0, total = 0, top_file = 0, selected = 0, list_cols = 1, brief_cols = 2, 
  is_panelized = 0, frame_size = frame_half, filter = 0x0, sort_info = {reverse = 0, case_sensitive = 1, exec_first = 0}, sort_field = 0x5da788 <panel_fields+40>, dirty = 0, user_mini_status = 0, user_format = 0x13f6a00 "half type name | size | perm", 
  user_status_format = {0x13d7db0 "half type name | size | perm", 0x135ee30 "half type name | size | perm", 0x1308800 "half type name | size | perm", 0x12ee180 "half type name | size | perm"}, format = 0x142fc48 = {0x13863e0, 0x13f7e00, 0x14228e0, 0x13088e0, 0x13e0d90, 
    0x13f8600}, status_format = 0x13e0940 = {0x1403010, 0x13ccc70}, panel_name = 0x1400b40 "New Left Panel", dir_stat = {st_dev = 2081, __pad1 = 0, __st_ino = 913988, st_mode = 16877, st_nlink = 10, st_uid = 1000, st_gid = 1000, st_rdev = 0, __pad2 = 0, st_size = 4096, 
    st_blksize = 4096, st_blocks = 8, st_atim = {tv_sec = 1588252362, tv_nsec = 313895252}, st_mtim = {tv_sec = 1588252135, tv_nsec = 595048878}, st_ctim = {tv_sec = 1588252135, tv_nsec = 595048878}, st_ino = 913988}, codepage = -1, searching = 0, 
  search_buffer = '\000' <repeats 254 times>, prev_search_buffer = '\000' <repeats 254 times>, search_char = '\000' <repeats 15 times>, search_chpoint = 0, content_shift = -1, max_shift = -1}
(gdb) p *(WPanel*)0x13fecf0
$37 = {widget = {x = 137, y = 1, cols = 137, lines = 62, pos_flags = WPOS_KEEP_DEFAULT, options = (WOP_SELECTABLE | WOP_TOP_SELECT), state = WST_FOCUSED, id = 2, callback = 0x4f52e0 <panel_callback>, mouse_callback = 0x4f3f80 <panel_mouse_callback>, owner = 0x13dcd20, 
    mouse = {forced_capture = 0, capture = 0, last_msg = MSG_MOUSE_UP, last_buttons_down = 4}}, dir = {list = 0x14af980, size = 128, len = 61, callback = 0x4efbd0 <panel_dir_list_callback>}, list_format = list_full, active = 1, cwd_vpath = 0x1431950, 
  lwd_vpath = 0x1351960, dir_history = 0x13b0710 = {0x12c1e40}, dir_history_current = 0x13b0710 = {0x12c1e40}, hist_name = 0x13c29e0 "Dir Hist New Right Panel", marked = 0, dirs_marked = 0, total = 0, top_file = 0, selected = 1, list_cols = 1, brief_cols = 2, 
  is_panelized = 0, frame_size = frame_half, filter = 0x0, sort_info = {reverse = 0, case_sensitive = 1, exec_first = 0}, sort_field = 0x5da788 <panel_fields+40>, dirty = 0, user_mini_status = 0, user_format = 0x13f43b0 "half type name | size | perm", 
  user_status_format = {0x12cfc90 "half type name | size | perm", 0x13c2680 "half type name | size | perm", 0x1362e40 "half type name | size | perm", 0x14470c0 "half type name | size | perm"}, format = 0x14032c0 = {0x141fad0, 0x1626880, 0x135bac0, 0x141faf0, 0x1404110, 
    0x13ca980}, status_format = 0x14bc440 = {0x13da3d0, 0x1386260}, panel_name = 0x1421160 "New Right Panel", dir_stat = {st_dev = 0, __pad1 = 0, __st_ino = 0, st_mode = 0, st_nlink = 0, st_uid = 0, st_gid = 0, st_rdev = 0, __pad2 = 0, st_size = 0, st_blksize = 0, 
    st_blocks = 0, st_atim = {tv_sec = 0, tv_nsec = 0}, st_mtim = {tv_sec = 0, tv_nsec = 0}, st_ctim = {tv_sec = 0, tv_nsec = 0}, st_ino = 0}, codepage = -1, searching = 0, search_buffer = "handb\000d-c\000dmo_", '\000' <repeats 240 times>, 
  prev_search_buffer = "handb\000d-c\000dmo_", '\000' <repeats 240 times>, search_char = "b", '\000' <repeats 14 times>, search_chpoint = 0, content_shift = -1, max_shift = -1}

One of the others is the offending button bar with bad receiver, others are some labels.

It seems the buttonbar didn't get updated when the viewer ceased to exist. Could you please look at it?

mc is version 4.8.24 from Debian testing packages.

[andrew_b]

Replying to jpalecek:

mc is version 4.8.24 from Debian testing packages.

Sorry, I'm not Debian user and this info is useless for me.

What version of mc are you using exactly?

[jpalecek]

Replying to andrew_b:

Replying to jpalecek:

mc is version 4.8.24 from Debian testing packages.

Sorry, I'm not Debian user and this info is useless for me.

What version of mc are you using exactly?

$ LC_ALL=C mc -V
GNU Midnight Commander 4.8.24
Built with GLib 2.62.4
Using the S-Lang library with terminfo database
With builtin Editor and Aspell support
With subshell support as default
With support for background operations
With mouse support on xterm and Linux console
With support for X11 events
With internationalization support
With multiple codepages support
Virtual File Systems: cpiofs, tarfs, sfs, extfs, ext2undelfs, ftpfs, sftpfs, fish
Data types: char: 8; int: 32; long: 32; void *: 32; size_t: 32; off_t: 64;