Showstopping crash in the panel for 1.4.1

[Kjartan Maraas <kmaraas online no>]

I've been trying to track down this crash in the panel for some time now
with some help from various people. Today I tried starting the panel
with LD_PRELOAD=/usr/lib/libefence.so and EF_PROTECT_FREE=1 in gdb and
ran into the following crash:

(gdb)   bt full
#0  0x420248f9 in _nl_find_msg () from /lib/i686/libc.so.6
No symbol table info available.
#1  0x420241a2 in __dcigettext () from /lib/i686/libc.so.6
No symbol table info available.
#2  0x420238ad in dcgettext () from /lib/i686/libc.so.6
No symbol table info available.
#3  0x42080a34 in strerror_r () from /lib/i686/libc.so.6
No symbol table info available.
#4  0x420809db in strerror () from /lib/i686/libc.so.6
No symbol table info available.
#5  0x4007e13d in dlerror () from /lib/libdl.so.2
No symbol table info available.
#6  0x404a3d16 in fetch_dlerror () at gmodule-dl.c:80
No locals.
#7  0x404a3e89 in _g_module_symbol (handle=0x45b07dcc, 
    symbol_name=0x404a49bc "g_module_check_init") at gmodule-dl.c:140
	p = 0x0
#8  0x404a47e7 in g_module_symbol (module=0x45b19fec, 
    symbol_name=0x404a49bc "g_module_check_init", symbol=0xbffff628)
    at gmodule.c:381
	symbol_name = (gchar *) 0x404a49bc "g_module_check_init"
	symbol = (gpointer *) 0xbffff628
	module_error = (gchar *) 0x0
	module_error = (gchar *) 0x0
---Type <return> to continue, or q <return> to quit---
#9  0x404a43ef in g_module_open (
    file_name=0x45b03fe4 "/usr/lib/libimlib-png.so",
flags=G_MODULE_BIND_LAZY)
    at gmodule.c:264
	saved_error = (gchar *) 0x0
	check_init = 0
	check_failed = (gchar *) 0x0
	module = (GModule *) 0x45b19fec
	handle = 0x0
#10 0x4030cb10 in get_module_loader_saver (mod=0x4030e63d "png", 
    loader=0x4030fc3c, def_loader=0x4030cab4, saver=0x4030fc48, 
    def_saver=0x4030cabc) at modules.c:90
	path = 0x45b03fe4 "/usr/lib/libimlib-png.so"
	modname = 0x45b01ff4 <Address 0x45b01ff4 out of bounds>
	m = (GModule *) 0x1
	v = 0
	ptr = (void *) 0xbffff6a8
#11 0x4030ccf8 in load_module_relay (mod=0x4030e63d "png",
lf=0x4030fc3c, 
    sf=0x4030fc48, f=0x45affe94, w=0xbffff700, h=0xbffff704,
t=0xbffff708)
    at modules.c:151
	lf = (gdk_imlib_loader_fn *) 0x4030fc3c
	t = (int *) 0xbffff708
#12 0x4030ced2 in loader_png (f=0x45affe94, w=0xbffff700, h=0xbffff704, 
    t=0xbffff708) at modules.c:210
---Type <return> to continue, or q <return> to quit---
No locals.
#13 0x402f54d5 in gdk_imlib_load_image (
    file=0x80a8820 "/usr/share/pixmaps/gnome-panel.png") at load.c:283
	w = -1073744072
	h = 1073787440
	data = (unsigned char *) 0x0
	im = (GdkImlibImage *) 0x45affe94
	p = (FILE *) 0x45affe94
	eim = 0
	fmt = 1
	trans = 0
#14 0x4029e6dd in gnome_window_icon_set_default_from_file (
    filename=0x80a8820 "/usr/share/pixmaps/gnome-panel.png")
    at gnome-window-icon.c:241
No locals.
#15 0x0805e6ef in main (argc=1, argv=0xbffff7d4) at main.c:526
	argv = (char **) 0x45ad1fbc
	orb = 0x45ad1fbc
	ev = {_major = CORBA_NO_EXCEPTION, _repo_id = 0x0, _params = 0x0, 
  _any = 0x0}
	duplicate = -1073744048
	real_global_path = (gchar *) 0xbffff750 ""
#16 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6
---Type <return> to continue, or q <return> to quit---list
No symbol table info available.
(gdb) list
509	
510	int
511	main(int argc, char **argv)
512	{
513		CORBA_ORB orb;
514		CORBA_Environment ev;
515		gboolean duplicate;
516		gchar *real_global_path;
517		
518		bindtextdomain (PACKAGE, GNOMELOCALEDIR);
(gdb) 
519		textdomain (PACKAGE);
520	
521		CORBA_exception_init(&ev);
522		orb = gnome_CORBA_init("panel", VERSION,
523				       &argc, argv,
524				       GNORBA_INIT_SERVER_FUNC, &ev);
525		CORBA_exception_free(&ev);
526		gnome_window_icon_set_default_from_file
(GNOME_ICONDIR"/gnome-panel.png");
527		setup_visuals ();
528	

This crash went away when I ran the panel with LC_ALL=C, so I'm really
wondering what causes this.

Anyway, running the panel with EF_PROTECT_FREE=1 I couldn't get it up
and running even with LC_ALL=C so I tried without that env var set.

Now the panel runs fine and I started trying to reproduce the dreaded
bug

http://bugzilla.gnome.org/show_bug.cgi?id=59500 for those who haven't
tracked bugzilla lately :)

This lead to the following crash:

(gdb) bt full
#0  gtk_widget_event (widget=0xe0010e, event=0x47630018) at
gtkwidget.c:2728
	widget = (GtkWidget *) 0xe0010e
	return_val = -1073744376
	signal_num = 1077810620
#1  0x403e17b8 in gtk_main_do_event (event=0x47630018) at gtkmain.c:834
	event_widget = (GtkWidget *) 0xe0010e
	grab_widget = (GtkWidget *) 0xe0010e
	next_event = (GdkEvent *) 0x47630018
	tmp_list = (GList *) 0xe0010e
#2  0x40488d5b in gdk_event_dispatch (source_data=0x0, 
    current_time=0xbffff6d0, user_data=0x0) at gdkevents.c:2143
	event = (GdkEvent *) 0x47630018
#3  0x404b5e41 in g_main_dispatch (dispatch_time=0xbffff6d0) at
gmain.c:656
	hook_data = 0x0
	source_data = 0x0
	dispatch = (gboolean (*)()) 0x40488cfc <gdk_event_dispatch>
	source = (GSource *) 0x40b9ee18
#4  0x404b6445 in g_main_iterate (block=1, dispatch=1) at gmain.c:877
	block = 1
	hook = (GHook *) 0x40b9ee68
	current_time = {tv_sec = 1021317989, tv_usec = 775827}
	n_ready = 1
	current_priority = 0
---Type <return> to continue, or q <return> to quit---
	timeout = 1
	retval = 0
#5  0x404b65d4 in g_main_run (loop=0x4755fffc) at gmain.c:935
	loop = (GMainLoop *) 0x4755fffc
#6  0x403e1013 in gtk_main () at gtkmain.c:524
	tmp_list = (GList *) 0x0
	functions = (GList *) 0x0
	init = (GtkInitFunction *) 0x0
	loop = (GMainLoop *) 0x4755fffc
#7  0x0805e9cb in main (argc=1, argv=0xbffff7d4) at main.c:651
	argv = (char **) 0x407f0f84
	orb = 0x407f0f84
	ev = {_major = CORBA_NO_EXCEPTION, _repo_id = 0x0, _params = 0x0, 
  _any = 0x0}
	duplicate = 1109139436
	real_global_path = (gchar *) 0x421c1fec "/panel.d/default/"
#8  0x42017499 in __libc_start_main () from /lib/i686/libc.so.6
No symbol table info available.

Which indicates to me that the problem is somewhere in list handling
code.

I'd really appreciate any an all help with tracking down this problem
and I promise I'll have a big chunk of space set off for that person in
the 1.4.1 release announcement ;-)

Glory to be had...come and get it.

PS. The procedure for reproducing the bug is:

1. Open new nautilus window
2. Right click a pdf doc in it
3. Chose open with xpdf
4. Click "Quit" in xpdf

if it doesn't crash here - close the nautilus window and try over. It
usually takes me 5-10 tries to get it.

Cheers
Kjartan