And there's another leak in the same area:

==6216== 496 bytes in 23 blocks are definitely lost in loss record 124 of 212
==6216==    at 0x3414EC61: realloc (vg_replace_malloc.c:196)
==6216==    by 0x348DC641: g_realloc (gmem.c:170)
==6216==    by 0x348EF19B: g_string_maybe_expand (gstring.c:239)
==6216==    by 0x348EF60A: g_string_insert_len (gstring.c:479)
==6216==    by 0x348EF8A9: g_string_append (gstring.c:505)
==6216==    by 0x347A3A27: gnome_vfs_uri_to_string (gnome-vfs-uri.c:1170)
==6216==    by 0x347A4ADC: gnome_vfs_make_uri_canonical_old (gnome-vfs-utils.c:655)
==6216==    by 0x347A5F17: gnome_vfs_make_uri_canonical (gnome-vfs-utils.c:1811)
==6216==    by 0x352C56D1: make_uri_canonical (gtkfilesystemgnomevfs.c:597)
==6216==    by 0x352C7422: gtk_file_system_gnome_vfs_get_folder
(gtkfilesystemgnomevfs.c:628)
==6216==    by 0x344776A3: gtk_file_system_get_folder (gtkfilesystem.c:327)
==6216==    by 0x34468834: check_is_folder (gtkfilechooserdefault.c:1192)
==6216==    by 0x34468948: shortcuts_insert_path (gtkfilechooserdefault.c:1227)
==6216==    by 0x3446E98E: gtk_file_chooser_default_constructor
(gtkfilechooserdefault.c:1312)
==6216==    by 0x3473DDE7: g_object_newv (gobject.c:942)
==6216==    by 0x3473E94E: g_object_new_valist (gobject.c:1026)
==6216==    by 0x3473EA6D: g_object_new (gobject.c:823)
==6216==    by 0x3446F907: _gtk_file_chooser_default_new
(gtkfilechooserdefault.c:6141)
==6216==    by 0x34470A0A: gtk_file_chooser_widget_constructor
(gtkfilechooserwidget.c:156)
==6216==    by 0x3473DDE7: g_object_newv (gobject.c:942)
==6216==    by 0x3473E8F8: g_object_new_valist (gobject.c:985)
==6216==    by 0x3473EA6D: g_object_new (gobject.c:823)
==6216==    by 0x344664B7: gtk_file_chooser_dialog_constructor
(gtkfilechooserdialog.c:390)
==6216==    by 0x3473DDE7: g_object_newv (gobject.c:942)
==6216==    by 0x3473E94E: g_object_new_valist (gobject.c:1026)
==6216==    by 0x3473EA6D: g_object_new (gobject.c:823)
==6216==    by 0x34466714: gtk_file_chooser_dialog_new_valist
(gtkfilechooserdialog.c:580)
==6216==    by 0x34466780: gtk_file_chooser_dialog_new (gtkfilechooserdialog.c:625)
==6216==    by 0x3446507B: gtk_file_chooser_button_constructor
(gtkfilechooserbutton.c:613)
==6216==    by 0x3473DDE7: g_object_newv (gobject.c:942)

I don't see the first of these any more. The second is still there though, and
I've got another one in new logs from valgrind:

==3757== 47 bytes in 1 blocks are definitely lost in loss record 11123 of 14935
==3757==    at 0x1B9043DA: malloc (vg_replace_malloc.c:220)
==3757==    by 0x1C6685C1: g_malloc (gmem.c:137)
==3757==    by 0x1C6788E9: g_strdup (gstrfuncs.c:91)
==3757==    by 0x1C1637F4: update_combo_box (gtkfilechooserbutton.c:1489)
==3757==    by 0x1C5C0EFC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==3757==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)
==3757==    by 0x1C5C4272: signal_emit_unlocked_R (gsignal.c:2488)
==3757==    by 0x1C5C5636: g_signal_emit_valist (gsignal.c:2247)
==3757==    by 0x1C5C87DC: g_signal_emit_by_name (gsignal.c:2315)
==3757==    by 0x1D77C8A4: gtk_file_system_gnome_vfs_remove_bookmark
(gtkfilesystemgnomevfs.c:1850)
==3757==    by 0x1C1773F8: gtk_file_system_remove_bookmark (gtkfilesystem.c:753)
==3757==    by 0x1C168934: remove_selected_bookmarks (gtkfilechooserdefault.c:2065)
==3757==    by 0x1C5C0EFC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==3757==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)
==3757==    by 0x1C5C4272: signal_emit_unlocked_R (gsignal.c:2488)
==3757==    by 0x1C5C5636: g_signal_emit_valist (gsignal.c:2247)
==3757==    by 0x1C5C59D6: g_signal_emit (gsignal.c:2291)
==3757==    by 0x1C10B7DE: gtk_button_clicked (gtkbutton.c:782)
==3757==    by 0x1C10CE14: gtk_real_button_released (gtkbutton.c:1294)
==3757==    by 0x1C5C0EFC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==3757==    by 0x1C5B5C18: g_type_class_meta_marshal (gclosure.c:514)
==3757==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)
==3757==    by 0x1C5C3B56: signal_emit_unlocked_R (gsignal.c:2418)
==3757==    by 0x1C5C5636: g_signal_emit_valist (gsignal.c:2247)
==3757==    by 0x1C5C59D6: g_signal_emit (gsignal.c:2291)
==3757==    by 0x1C10B762: gtk_button_released (gtkbutton.c:774)
==3757==    by 0x1C10C52A: gtk_button_button_release (gtkbutton.c:1210)
==3757==    by 0x1C1B423A: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:83)
==3757==    by 0x1C5B5C18: g_type_class_meta_marshal (gclosure.c:514)
==3757==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)

And another one that I think I've fixed with a patch I'll attach here:

==3757== 64 bytes in 1 blocks are definitely lost in loss record 12208 of 14935
==3757==    at 0x1B9057A8: realloc (vg_replace_malloc.c:378)
==3757==    by 0x1C66867D: g_realloc (gmem.c:170)
==3757==    by 0x1C67B24B: g_string_maybe_expand (gstring.c:239)
==3757==    by 0x1C67B6BA: g_string_insert_len (gstring.c:479)
==3757==    by 0x1C67B959: g_string_append (gstring.c:505)
==3757==    by 0x1BCDA19B: gnome_vfs_uri_to_string (gnome-vfs-uri.c:1207)
==3757==    by 0x1D77D5D3: gtk_file_system_gnome_vfs_get_parent
(gtkfilesystemgnomevfs.c:1206)
==3757==    by 0x1C176C8C: gtk_file_system_get_parent (gtkfilesystem.c:531)
==3757==    by 0x1C163C73: update_label_and_image (gtkfilechooserbutton.c:1825)
==3757==    by 0x1C164147: fs_bookmarks_changed_cb (gtkfilechooserbutton.c:1926)
==3757==    by 0x1C5C0EFC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==3757==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)
==3757==    by 0x1C5C4272: signal_emit_unlocked_R (gsignal.c:2488)
==3757==    by 0x1C5C5636: g_signal_emit_valist (gsignal.c:2247)
==3757==    by 0x1C5C87DC: g_signal_emit_by_name (gsignal.c:2315)
==3757==    by 0x1D77C8A4: gtk_file_system_gnome_vfs_remove_bookmark
(gtkfilesystemgnomevfs.c:1850)
==3757==    by 0x1C1773F8: gtk_file_system_remove_bookmark (gtkfilesystem.c:753)
==3757==    by 0x1C168934: remove_selected_bookmarks (gtkfilechooserdefault.c:2065)
==3757==    by 0x1C5C0EFC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==3757==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)
==3757==    by 0x1C5C4272: signal_emit_unlocked_R (gsignal.c:2488)
==3757==    by 0x1C5C5636: g_signal_emit_valist (gsignal.c:2247)
==3757==    by 0x1C5C59D6: g_signal_emit (gsignal.c:2291)
==3757==    by 0x1C10B7DE: gtk_button_clicked (gtkbutton.c:782)
==3757==    by 0x1C10CE14: gtk_real_button_released (gtkbutton.c:1294)
==3757==    by 0x1C5C0EFC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==3757==    by 0x1C5B5C18: g_type_class_meta_marshal (gclosure.c:514)
==3757==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)
==3757==    by 0x1C5C3B56: signal_emit_unlocked_R (gsignal.c:2418)
==3757==    by 0x1C5C5636: g_signal_emit_valist (gsignal.c:2247)

Created attachment 47417 [details] [review]
patch for leak in comment #3

The trace in comment #1 is originating in gtk_file_system_gnome_vfs_get_folder():

char *uri;
...

uri = make_uri_canonical (gtk_file_path_get_string (path));

....

This is g_free()'d in all cases where the function is returning early but at the
end we have this:

folder_vfs->system = system_vfs;
  folder_vfs->uri = uri; /* takes ownership */
  folder_vfs->types = types;
  folder_vfs->monitor = monitor;
  folder_vfs->async_handle = NULL;
  folder_vfs->children = g_hash_table_new_full (g_str_hash,
                                                g_str_equal,
                                                NULL,
                                                (GDestroyNotify) folder_child_free);

  g_hash_table_insert (system_vfs->folders, folder_vfs->uri, folder_vfs);

  return GTK_FILE_FOLDER (folder_vfs);
}

So folder_vfs->uri; needs to be free'd somewhere else, and I'm not sure where.

Hmm. looks like the patch I attached is causing problems. Now I see this:

==3812== Invalid read of size 1
==3812==    at 0x1C6788DB: g_strdup (gstrfuncs.c:90)
==3812==    by 0x1BCDC40E: gnome_vfs_make_uri_canonical (gnome-vfs-utils.c:1669)
==3812==    by 0x1CD43765: make_uri_canonical (gtkfilesystemgnomevfs.c:724)
==3812==    by 0x1CD4572E: gtk_file_system_gnome_vfs_get_folder
(gtkfilesystemgnomevfs.c:778)
==3812==    by 0x1C176653: gtk_file_system_get_folder (gtkfilesystem.c:327)
==3812==    by 0x1C167808: check_is_folder (gtkfilechooserdefault.c:1192)
==3812==    by 0x1C16791C: shortcuts_insert_path (gtkfilechooserdefault.c:1227)
==3812==    by 0x1C16D8CE: gtk_file_chooser_default_constructor
(gtkfilechooserdefault.c:1285)
==3812==    by 0x1C5BADD7: g_object_newv (gobject.c:942)
==3812==    by 0x1C5BB93E: g_object_new_valist (gobject.c:1026)
==3812==    by 0x1C5BBA5D: g_object_new (gobject.c:823)
==3812==    by 0x1C16E8C3: _gtk_file_chooser_default_new
(gtkfilechooserdefault.c:6148)
==3812==    by 0x1C16F9C6: gtk_file_chooser_widget_constructor
(gtkfilechooserwidget.c:156)
==3812==    by 0x1C5BADD7: g_object_newv (gobject.c:942)
==3812==    by 0x1C5BB8E8: g_object_new_valist (gobject.c:985)
==3812==    by 0x1C5BBA5D: g_object_new (gobject.c:823)
==3812==    by 0x1C16547B: gtk_file_chooser_dialog_constructor
(gtkfilechooserdialog.c:390)
==3812==    by 0x1C5BADD7: g_object_newv (gobject.c:942)
==3812==    by 0x1C5BB93E: g_object_new_valist (gobject.c:1026)
==3812==    by 0x1C5BBA5D: g_object_new (gobject.c:823)
==3812==    by 0x1C1656D8: gtk_file_chooser_dialog_new_valist
(gtkfilechooserdialog.c:580)
==3812==    by 0x1C165744: gtk_file_chooser_dialog_new (gtkfilechooserdialog.c:625)
==3812==    by 0x1B9508F1: browse_clicked (gnome-file-entry.c:632)
==3812==    by 0x1C5C0EFC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==3812==    by 0x1C5B5C18: g_type_class_meta_marshal (gclosure.c:514)
==3812==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)
==3812==    by 0x1C5C4456: signal_emit_unlocked_R (gsignal.c:2526)
==3812==    by 0x1C5C5636: g_signal_emit_valist (gsignal.c:2247)
==3812==    by 0x1C5C59D6: g_signal_emit (gsignal.c:2291)
==3812==    by 0x1B94FA56: browse_clicked_signal (gnome-file-entry.c:713)
==3812==  Address 0x1D879550 is 0 bytes inside a block of size 16 free'd
==3812==    at 0x1B904EF7: free (vg_replace_malloc.c:306)
==3812==    by 0x1C6686FD: g_free (gmem.c:187)
==3812==    by 0x1CD455E0: gtk_file_system_gnome_vfs_get_parent
(gtkfilesystemgnomevfs.c:1209)
==3812==    by 0x1C176C8C: gtk_file_system_get_parent (gtkfilesystem.c:531)
==3812==    by 0x1CD45713: gtk_file_system_gnome_vfs_get_folder
(gtkfilesystemgnomevfs.c:764)
==3812==    by 0x1C176653: gtk_file_system_get_folder (gtkfilesystem.c:327)
==3812==    by 0x1C167808: check_is_folder (gtkfilechooserdefault.c:1192)
==3812==    by 0x1C16791C: shortcuts_insert_path (gtkfilechooserdefault.c:1227)
==3812==    by 0x1C16D8CE: gtk_file_chooser_default_constructor
(gtkfilechooserdefault.c:1285)
==3812==    by 0x1C5BADD7: g_object_newv (gobject.c:942)
==3812==    by 0x1C5BB93E: g_object_new_valist (gobject.c:1026)
==3812==    by 0x1C5BBA5D: g_object_new (gobject.c:823)
==3812==    by 0x1C16E8C3: _gtk_file_chooser_default_new
(gtkfilechooserdefault.c:6148)
==3812==    by 0x1C16F9C6: gtk_file_chooser_widget_constructor
(gtkfilechooserwidget.c:156)
==3812==    by 0x1C5BADD7: g_object_newv (gobject.c:942)
==3812==    by 0x1C5BB8E8: g_object_new_valist (gobject.c:985)
==3812==    by 0x1C5BBA5D: g_object_new (gobject.c:823)
==3812==    by 0x1C16547B: gtk_file_chooser_dialog_constructor
(gtkfilechooserdialog.c:390)
==3812==    by 0x1C5BADD7: g_object_newv (gobject.c:942)
==3812==    by 0x1C5BB93E: g_object_new_valist (gobject.c:1026)
==3812==    by 0x1C5BBA5D: g_object_new (gobject.c:823)
==3812==    by 0x1C1656D8: gtk_file_chooser_dialog_new_valist
(gtkfilechooserdialog.c:580)
==3812==    by 0x1C165744: gtk_file_chooser_dialog_new (gtkfilechooserdialog.c:625)
==3812==    by 0x1B9508F1: browse_clicked (gnome-file-entry.c:632)
==3812==    by 0x1C5C0EFC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==3812==    by 0x1C5B5C18: g_type_class_meta_marshal (gclosure.c:514)
==3812==    by 0x1C5B60EB: g_closure_invoke (gclosure.c:437)
==3812==    by 0x1C5C4456: signal_emit_unlocked_R (gsignal.c:2526)
==3812==    by 0x1C5C5636: g_signal_emit_valist (gsignal.c:2247)
==3812==    by 0x1C5C59D6: g_signal_emit (gsignal.c:2291)

Man, this is convoluted :-/

gtk_file_path_new_steal() just takes the path without copying it I guess so the
patch is wrong...

Yeah, gtk_file_path_new_steal() takes the path without copying it.  GtkFilePath
is an opaque type which only gets munged by the actual file system
implementation.  When using the VFS backend, GtkFilePaths are actually strings
with URIs.  steal() is in effect just a cast to (char *).

Are you sure the other leaks are still there?  The line numbers in your valgrind
logs don't correspond to the latest sources from 2.10.  In particular, stuff
around get_folder() and get_parent() changed a bit since then.

I built both gtk+ and libgnomeui from CVS using jhbuild recently as in within
the last week. Doing a new build using glib/gtk/pango HEAD now. We'll see how
that plays out.

I'm still seeing tons of these:

==6663== 96 bytes in 4 blocks are definitely lost in loss record 9071 of 9968
==6663==    at 0x1B909C61: realloc (vg_replace_malloc.c:196)
==6663==    by 0x1C120055: g_realloc (gmem.c:170)
==6663==    by 0x1C132F13: g_string_maybe_expand (gstring.c:260)
==6663==    by 0x1C133382: g_string_insert_len (gstring.c:500)
==6663==    by 0x1C133621: g_string_append (gstring.c:526)
==6663==    by 0x1BAB719B: gnome_vfs_uri_to_string (gnome-vfs-uri.c:1207)
==6663==    by 0x1BAB825C: gnome_vfs_make_uri_canonical_old (gnome-vfs-utils.c:685)
==6663==    by 0x1BAB95D3: gnome_vfs_make_uri_canonical (gnome-vfs-utils.c:1806)
==6663==    by 0x1CD657F1: make_uri_canonical (gtkfilesystemgnomevfs.c:724)
==6663==    by 0x1CD67746: gtk_file_system_gnome_vfs_get_folder
(gtkfilesystemgnomevfs.c:755)
==6663==    by 0x1BCAB9B7: gtk_file_system_get_folder (gtkfilesystem.c:327)
==6663==    by 0x1BC95515: filter_model_visible_func (gtkfilechooserbutton.c:1571)
==6663==    by 0x1BDA0908: gtk_tree_model_filter_visible (gtktreemodelfilter.c:689)

Created attachment 47712 [details] [review]
a patch

Here is an untested patch for libgnomeui. Does it help ?

Going to test this now.

Yes, this takes care of the remaining file chooser leaks that I saw earlier
today. Great stuff.

Created attachment 47721 [details] [review]
revised patch

Going to test this one today too

The latest patch seems to cause crashes here:

==15756== Invalid read of size 1
==15756==    at 0x1C1A6E93: g_str_hash (gstring.c:98)
==15756==    by 0x1C182947: g_hash_table_remove (ghash.c:193)
==15756==    by 0x1F039ABC: gtk_file_folder_gnome_vfs_dispose
(gtkfilesystemgnomevfs.c:2051)
==15756==    by 0x1C136755: g_object_unref (gobject.c:565)
==15756==    by 0x1C181DF6: g_hash_node_destroy (ghash.c:690)
==15756==    by 0x1C18299F: g_hash_table_remove (ghash.c:393)
==15756==    by 0x1F039ABC: gtk_file_folder_gnome_vfs_dispose
(gtkfilesystemgnomevfs.c:2051)
==15756==    by 0x1C136755: g_object_unref (gobject.c:565)
==15756==    by 0x1BC743DC: check_is_folder (gtkfilechooserdefault.c:1213)
==15756==    by 0x1BC744E1: shortcuts_insert_path (gtkfilechooserdefault.c:1244)
==15756==    by 0x1BC7B891: gtk_file_chooser_default_constructor
(gtkfilechooserdefault.c:1302)
==15756==    by 0x1C139861: g_object_newv (gobject.c:949)
==15756==    by 0x1C13A3EA: g_object_new_valist (gobject.c:1033)
==15756==    by 0x1C13A509: g_object_new (gobject.c:830)
==15756==    by 0x1BC7CD97: _gtk_file_chooser_default_new
(gtkfilechooserdefault.c:6487)
==15756==    by 0x1BC7E154: gtk_file_chooser_widget_constructor
(gtkfilechooserwidget.c:156)
==15756==    by 0x1C139861: g_object_newv (gobject.c:949)
==15756==    by 0x1C13A394: g_object_new_valist (gobject.c:992)
==15756==    by 0x1C13A509: g_object_new (gobject.c:830)
==15756==    by 0x1BC718DD: gtk_file_chooser_dialog_constructor
(gtkfilechooserdialog.c:390)
==15756==    by 0x1C139861: g_object_newv (gobject.c:949)
==15756==    by 0x1C13A3EA: g_object_new_valist (gobject.c:1033)
==15756==    by 0x1C13A509: g_object_new (gobject.c:830)
==15756==    by 0x805AA64: eog_file_selection_new (eog-file-selection.c:423)
==15756==    by 0x8053DDC: verb_FolderOpen_cb (eog-window.c:429)
==15756==    by 0x1C1404AC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==15756==    by 0x1C1342FB: g_closure_invoke (gclosure.c:437)
==15756==    by 0x1C143A7E: signal_emit_unlocked_R (gsignal.c:2488)
==15756==    by 0x1C14505A: g_signal_emit_valist (gsignal.c:2247)
==15756==    by 0x1C1453E2: g_signal_emit (gsignal.c:2291)
==15756==  Address 0x1DC1E8A8 is 0 bytes inside a block of size 32 free'd
==15756==    at 0x1B904EF7: free (vg_replace_malloc.c:300)
==15756==    by 0x1C1940D5: g_free (gmem.c:187)
==15756==    by 0x1C181DE7: g_hash_node_destroy (ghash.c:688)
==15756==    by 0x1C18299F: g_hash_table_remove (ghash.c:393)
==15756==    by 0x1F039ABC: gtk_file_folder_gnome_vfs_dispose
(gtkfilesystemgnomevfs.c:2051)
==15756==    by 0x1C136755: g_object_unref (gobject.c:565)
==15756==    by 0x1BC743DC: check_is_folder (gtkfilechooserdefault.c:1213)
==15756==    by 0x1BC744E1: shortcuts_insert_path (gtkfilechooserdefault.c:1244)
==15756==    by 0x1BC7B891: gtk_file_chooser_default_constructor
(gtkfilechooserdefault.c:1302)
==15756==    by 0x1C139861: g_object_newv (gobject.c:949)
==15756==    by 0x1C13A3EA: g_object_new_valist (gobject.c:1033)
==15756==    by 0x1C13A509: g_object_new (gobject.c:830)
==15756==    by 0x1BC7CD97: _gtk_file_chooser_default_new
(gtkfilechooserdefault.c:6487)
==15756==    by 0x1BC7E154: gtk_file_chooser_widget_constructor
(gtkfilechooserwidget.c:156)
==15756==    by 0x1C139861: g_object_newv (gobject.c:949)
==15756==    by 0x1C13A394: g_object_new_valist (gobject.c:992)
==15756==    by 0x1C13A509: g_object_new (gobject.c:830)
==15756==    by 0x1BC718DD: gtk_file_chooser_dialog_constructor
(gtkfilechooserdialog.c:390)
==15756==    by 0x1C139861: g_object_newv (gobject.c:949)
==15756==    by 0x1C13A3EA: g_object_new_valist (gobject.c:1033)
==15756==    by 0x1C13A509: g_object_new (gobject.c:830)
==15756==    by 0x805AA64: eog_file_selection_new (eog-file-selection.c:423)
==15756==    by 0x8053DDC: verb_FolderOpen_cb (eog-window.c:429)
==15756==    by 0x1C1404AC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==15756==    by 0x1C1342FB: g_closure_invoke (gclosure.c:437)
==15756==    by 0x1C143A7E: signal_emit_unlocked_R (gsignal.c:2488)
==15756==    by 0x1C14505A: g_signal_emit_valist (gsignal.c:2247)

The only filechooser related patch I have is this:

diff -u -p -r1.35 gtkfilechooserbutton.c
--- gtk/gtkfilechooserbutton.c  13 Jun 2005 13:50:49 -0000      1.35
+++ gtk/gtkfilechooserbutton.c  21 Jun 2005 12:55:53 -0000
@@ -1490,7 +1490,7 @@ model_update_current_folder (GtkFileChoo
                      ICON_COLUMN, pixbuf,
                      DISPLAY_NAME_COLUMN, display_name,
                      TYPE_COLUMN, ROW_TYPE_CURRENT_FOLDER,
-                     DATA_COLUMN, gtk_file_path_copy (path),
+                     DATA_COLUMN, path,
                      -1);
   if (pixbuf)
     g_object_unref (pixbuf);

and I don't think that comes into play here at all.

Created attachment 48096 [details] [review]
new version

Can you try this one ?

*** Bug 167516 has been marked as a duplicate of this bug. ***

I see this with the latest patch:

==21369== Invalid read of size 4
==21369==    at 0x1C0B05D0: g_object_unref (gobject.c:1687)
==21369==    by 0x1CC42D5A: unref_at_idle (gtkfilesystemgnomevfs.c:2174)
==21369==    by 0x1C109043: g_idle_dispatch (gmain.c:3812)
==21369==    by 0x1C106EA1: g_main_context_dispatch (gmain.c:1933)
==21369==    by 0x1C109C71: g_main_context_iterate (gmain.c:2564)
==21369==    by 0x1C10A172: g_main_loop_run (gmain.c:2768) ==21369==    by
0x1BC3DAC5: gtk_dialog_run (gtkdialog.c:1019)
==21369==    by 0x8053EEC: verb_FileOpen_cb (eog-window.c:403)
==21369==    by 0x1C0BA4AC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==21369==    by 0x1C0AE2FB: g_closure_invoke (gclosure.c:437)
==21369==    by 0x1C0BDA7E: signal_emit_unlocked_R (gsignal.c:2488)
==21369==    by 0x1C0BF05A: g_signal_emit_valist (gsignal.c:2247)
==21369==  Address 0x1C6DF780 is 0 bytes inside a block of size 40 free'd
==21369==    at 0x1B909743: free (vg_replace_malloc.c:152)
==21369==    by 0x1C10D0D5: g_free (gmem.c:187)
==21369==    by 0x1C0CBD19: g_type_free_instance (gtype.c:1636)
==21369==    by 0x1C0B073E: g_object_unref (gobject.c:588)
==21369==    by 0x1CC42D5A: unref_at_idle (gtkfilesystemgnomevfs.c:2174)
==21369==    by 0x1C109043: g_idle_dispatch (gmain.c:3812)
==21369==    by 0x1C106EA1: g_main_context_dispatch (gmain.c:1933)
==21369==    by 0x1C109C71: g_main_context_iterate (gmain.c:2564)
==21369==    by 0x1C10A172: g_main_loop_run (gmain.c:2768)
==21369==    by 0x1BC3DAC5: gtk_dialog_run (gtkdialog.c:1019)
==21369==    by 0x8053EEC: verb_FileOpen_cb (eog-window.c:403)
==21369==    by 0x1C0BA4AC: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)

The patch in comment #10 is the one that works here. Is it ok to commit that one?

Commited the working patch on stable and HEAD.