Bug 313463 – Crash when closing gnumeric (`<invalid>' in cast to `GtkAdjustment)

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 313463 - Crash when closing gnumeric (`<invalid>' in cast to `GtkAdjustment)


Summary:	Crash when closing gnumeric (`<invalid>' in cast to `GtkAdjustment)


Status:	RESOLVED FIXED

Product:	Gnumeric
Classification:	Applications
Component:	General
Version:	git master
Hardware:	Other All

Importance:	Normal normal
Target Milestone:	---
Assigned To:	Jody Goldberg
QA Contact:	Jody Goldberg

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2005-08-14 14:06 UTC by Emmanuel Pacaud
Modified:	2005-08-15 17:50 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
it was a reference problem (711 bytes, patch) 2005-08-15 15:33 UTC, Jean Bréfort	none	Details \| Review

Description Emmanuel Pacaud 2005-08-14 14:06:52 UTC

insert a default xy graph.
open guru for this graph.
Add a title.
Close gnumeric, ignore unsaved changes -> crash.

Here's the backtrace:

(lt-gnumeric:28362): GLib-GObject-WARNING **: invalid uninstantiatable type
`<invalid>' in cast to `GtkAdjustment'

(lt-gnumeric:28362): GLib-GObject-WARNING **: invalid uninstantiatable type
`<invalid>' in cast to `GtkAdjustment'

Program received signal SIGSEGV, Segmentation fault.

+ Trace 62434

Thread NaN (LWP 28362)

#0 scg_scrollbar_config
at sheet-control-gui.c line 421
#1 sc_scrollbar_config
at sheet-control.c line 100
#2 sheet_scrollbar_config
at sheet.c line 4325
#3 sheet_objects_max_extent
at sheet-object.c line 153
#4 sheet_object_clear_sheet
at sheet-object.c line 391
#5 sheet_destroy_contents
at sheet.c line 3108
#6 workbook_dispose
at workbook.c line 106
#7 IA__g_object_unref
at gobject.c line 1674
#8 wbcg_close_if_user_permits
at workbook-control-gui.c line 1332
#9 cb_file_quit
at wbcg-actions.c line 172
#10 IA__g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#11 IA__g_closure_invoke
at gclosure.c line 492
#12 signal_emit_unlocked_R
at gsignal.c line 2485
#13 IA__g_signal_emit_valist
at gsignal.c line 2244
#14 IA__g_signal_emit
at gsignal.c line 2288
#15 _gtk_action_emit_activate
at gtkaction.c line 1038
#16 IA__gtk_action_activate
at gtkaction.c line 1065
#17 IA__g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#18 IA__g_closure_invoke
at gclosure.c line 492
#19 signal_emit_unlocked_R
at gsignal.c line 2485
#20 IA__g_signal_emit_valist
at gsignal.c line 2244
#21 IA__g_signal_emit
at gsignal.c line 2288
#22 IA__gtk_widget_activate
at gtkwidget.c line 3766
#23 IA__gtk_menu_shell_activate_item
at gtkmenushell.c line 1057
#24 gtk_menu_shell_button_release
at gtkmenushell.c line 663
#25 gtk_menu_button_release
at gtkmenu.c line 2571
#26 _gtk_marshal_BOOLEAN__BOXED
at gtkmarshalers.c line 83
#27 g_type_class_meta_marshal
at gclosure.c line 569
#28 IA__g_closure_invoke
at gclosure.c line 492
#29 signal_emit_unlocked_R
at gsignal.c line 2523
#30 IA__g_signal_emit_valist
at gsignal.c line 2254
#31 IA__g_signal_emit
at gsignal.c line 2288
#32 gtk_widget_event_internal
at gtkwidget.c line 3735
#33 IA__gtk_propagate_event
at gtkmain.c line 2157
#34 IA__gtk_main_do_event
at gtkmain.c line 1395
#35 gdk_event_dispatch
at gdkevents-x11.c line 2291
#36 IA__g_main_context_dispatch
at gmain.c line 1934
#37 g_main_context_iterate
at gmain.c line 2565
#38 IA__g_main_loop_run
at gmain.c line 2769
#39 bonobo_main
from /usr/lib/libbonobo-2.so.0
#40 main
at main-application.c line 425

Comment 1 Jean Bréfort 2005-08-14 14:50:26 UTC

Displaying any property page with a data allocator leads to the same segfault.
This does not occur in abiword where the allocator is just a GtkEntry.

Comment 2 Jean Bréfort 2005-08-15 15:33:26 UTC

Created attachment 50725 [details] [review]
it was a reference problem

Each time we do something like:
g_object_get (o1, "some-object" &o2, NULL);
we must call
g_object_unref (o2);
Otherwise the ref_count of the object will grow.

Comment 3 Morten Welinder 2005-08-15 16:06:41 UTC

Please apply.

That now makes it quite clear that something is leaking.  I think
text_layout_init keeps a ref to "gui" in state->text_layout_gui
but nothing unrefs that.

Comment 4 Morten Welinder 2005-08-15 17:50:45 UTC

Fixed in cvs.  (Well, leak is not, but we'll get to that one way or another.)