Segfault on Laptop: Suspend, then network change

[schlatterbeck]

kvats froze after suspend and network change. Trace attached.

Note: This looks to me as if the calling SipAccount object in Frame #2 is already invalid -- the 'this' pointer is 0x60 in the Timer object in Frame #0.

Looks to me that SipAccount::connectionIsDownEventHandler is called while the SipAccount is still valid. This schedules a callback which arrives when we already have a dangling reference. I'm at a loss here how to change this to a saner behaviour (and the course of events is only a guess but I've seen similar things at other occasions in qutecom). Can we somehow remove scheduled callbacks when the object is destroyed?

We're seeing this in kvats, our downstream bug-report is at ​http://tracker.kvats.net/kvats/issue101 in msg461, Vadim you should have an account already, opening the tracker to the public is still on my todo list.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x432e2950 (LWP 31717)]
0x0000000000b42f06 in PrivateThread::stop (this=0x60)
    at /home/ras/Desktop/kvats/kvats-2.2/libs/owutil/thread/src/Timer.cpp:96
96              _stop = true;
(gdb) where
#0  0x0000000000b42f06 in PrivateThread::stop (this=0x60)
    at /home/ras/Desktop/kvats/kvats-2.2/libs/owutil/thread/src/Timer.cpp:96
#1  0x0000000000b43572 in Timer::stop (this=0x7f670406fd88)
    at /home/ras/Desktop/kvats/kvats-2.2/libs/owutil/thread/src/Timer.cpp:158
#2  0x0000000000c31ca6 in SipAccount::connectionIsDownEventHandlerThreadSafe (
    this=0x7f670406fc30)
    
at /home/ras/Desktop/kvats/kvats-2.2/wengophone/src/model/account/SipAccount.cpp:263
#3  0x0000000000c36018 in boost::_mfi::mf0<void, SipAccount>::operator() (
    this=0x199ff70, p=0x7f670406fc30)
    at /usr/include/boost/bind/mem_fn_template.hpp:49
#4  0x0000000000c35d23 in boost::_bi::list1<boost::_bi::value<SipAccount*> 
>::operator()<boost::_mfi::mf0<void, SipAccount>, boost::_bi::list0> 
(this=0x199ff80,
    f=@0x199ff70, a=@0x432e1d17) at /usr/include/boost/bind.hpp:231
#5  0x0000000000c35b21 in boost::_bi::bind_t<void, boost::_mfi::mf0<void, 
SipAccount>, boost::_bi::list1<boost::_bi::value<SipAccount*> > >::operator() 
(
    this=0x199ff70) at /usr/include/boost/bind/bind_template.hpp:20
#6  0x0000000000c358ab in 
boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void, 
boost::_mfi::mf0<void, SipAccount>, boost::_bi::list1<boost::_bi:---Type 
<return> to continue, or q <return> to quit---
:value<SipAccount*> > >, void>::invoke (function_obj_ptr=@0x199ff70)
    at /usr/include/boost/function/function_template.hpp:155
#7  0x00000000009f13b8 in boost::function0<void, std::allocator<void> 
>::operator()
    (this=0x199ff68) at /usr/include/boost/function/function_template.hpp:691
#8  0x0000000000b0f8b9 in ThreadEvent0<void ()()>::callback (this=0x199ff60)
    at /home/ras/Desktop/kvats/kvats-2.2/libs/owutil/thread/ThreadEvent.h:67
#9  0x0000000000b4743e in Thread::runEvents (this=0x14364c0)
    at /home/ras/Desktop/kvats/kvats-2.2/libs/owutil/thread/src/Thread.cpp:132
#10 0x0000000000bcd842 in WengoPhone::run (this=0x14364c0)
    
at /home/ras/Desktop/kvats/kvats-2.2/wengophone/src/model/WengoPhone.cpp:118
#11 0x0000000000b4721a in Thread::runThread (this=0x14364c0)
    at /home/ras/Desktop/kvats/kvats-2.2/libs/owutil/thread/src/Thread.cpp:70
#12 0x0000000000b494f2 in boost::_mfi::mf0<void, Thread>::operator() (
    this=0x432e1fe8, p=0x14364c0) 
at /usr/include/boost/bind/mem_fn_template.hpp:49
#13 0x0000000000b4922d in boost::_bi::list1<boost::_bi::value<Thread*> 
>::operator()<boost::_mfi::mf0<void, Thread>, boost::_bi::list0> 
(this=0x432e1ff8,
    f=@0x432e1fe8, a=@0x432e1f57) at /usr/include/boost/bind.hpp:231
#14 0x0000000000b490e1 in boost::_bi::bind_t<void, boost::_mfi::mf0<void, 
Thread>, boost::_bi::list1<boost::_bi::value<Thread*> > >::operator() 
(this=0x432e1fe8)
---Type <return> to continue, or q <return> to quit---
    at /usr/include/boost/bind/bind_template.hpp:20
#15 0x0000000000b48f81 in 
boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void, 
boost::_mfi::mf0<void, Thread>, boost::_bi::list1<boost::_bi::value<Thread*> 
> >, void>::invoke (function_obj_ptr=@0x432e1fe8)
    at /usr/include/boost/function/function_template.hpp:155
#16 0x00007f6714a49537 in boost::function0<void, 
std::allocator<boost::function_base> >::operator() () 
from /usr/lib/libboost_thread-gcc42-mt-1_34_1.so.1.34.1
#17 0x00007f6714a491a2 in ?? ()
   from /usr/lib/libboost_thread-gcc42-mt-1_34_1.so.1.34.1
#18 0x00007f6710bb33f7 in start_thread () from /lib/libpthread.so.0
#19 0x00007f670f167b2d in clone () from /lib/libc.so.6
#20 0x0000000000000000 in ?? ()