Bug 355263 – gail_container_ref_child assertion failure

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 355263 - gail_container_ref_child assertion failure


Summary:	gail_container_ref_child assertion failure


Status:	RESOLVED FIXED

Product:	atk
Classification:	Platform
Component:	gail
Version:	git master
Hardware:	Other Linux

Importance:	Normal major
Target Milestone:	---
Assigned To:	bill.haneman
QA Contact:	bill.haneman

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2006-09-10 11:11 UTC by Christian Persch
Modified:	2006-09-25 16:37 UTC

See Also:
GNOME target:	---
GNOME version:	2.15/2.16

Attachments
patch to prevent emission of child-removed for objects no longer present in the container. (1.10 KB, patch) 2006-09-25 14:10 UTC, bill.haneman	committed	Details \| Review

Description Christian Persch 2006-09-10 11:11:48 UTC

Xchat-gnome/atk/gtk+/at-spi/gail/libgail-gnome/at-poke cvs HEAD.

Steps to reproduce:
0) Start xchat-gnome
1) At-poke xchat-gnome
2) Close xchat-gnome

Results: crash/critical warning on console:
** (xchat-gnome:10543): CRITICAL **: gail_container_ref_child: assertion `(i >= 0)' failed

Trace:

+ Trace 72037

#0 g_log
at gmessages.c line 516
#1 g_return_if_fail_warning
at gmessages.c line 532
#2 gail_container_ref_child
at gailcontainer.c line 146
#3 atk_object_ref_accessible_child
at atkobject.c line 668
#4 spi_atk_bridge_signal_listener
at bridge.c line 1036
#5 signal_emit_unlocked_R
at gsignal.c line 2404
#6 g_signal_emit_valist
at gsignal.c line 2197
#7 g_signal_emit_by_name
at gsignal.c line 2265
#8 gail_container_real_remove_gtk
at gailcontainer.c line 248
#9 gail_container_remove_gtk
at gailcontainer.c line 192
#10 g_cclosure_marshal_VOID__OBJECT
at gmarshal.c line 636
#11 g_closure_invoke
at gclosure.c line 490
#12 signal_emit_unlocked_R
at gsignal.c line 2438
#13 g_signal_emit_valist
at gsignal.c line 2197
#14 g_signal_emit
at gsignal.c line 2241
#15 gtk_container_remove
at gtkcontainer.c line 991
#16 gtk_widget_dispose
at gtkwidget.c line 6865
#17 g_object_run_dispose
at gobject.c line 570
#18 gtk_object_destroy
at gtkobject.c line 403
#19 gtk_widget_destroy
at gtkwidget.c line 2158
#20 gtk_paned_forall
at gtkpaned.c line 1064
#21 gtk_container_foreach
at gtkcontainer.c line 1288
#22 gtk_container_destroy
at gtkcontainer.c line 825
#23 g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#24 g_type_class_meta_marshal
at gclosure.c line 567
#25 g_closure_invoke
at gclosure.c line 490
#26 signal_emit_unlocked_R
at gsignal.c line 2554
#27 g_signal_emit_valist
at gsignal.c line 2197
#28 g_signal_emit
at gsignal.c line 2241
#29 gtk_object_dispose
at gtkobject.c line 418
#30 gtk_widget_dispose
at gtkwidget.c line 6873
#31 g_object_run_dispose
at gobject.c line 570
#32 gtk_object_destroy
at gtkobject.c line 403
#33 gtk_widget_destroy
at gtkwidget.c line 2158
#34 gtk_box_forall
at gtkbox.c line 670
#35 gtk_container_foreach
at gtkcontainer.c line 1288
#36 gtk_container_destroy
at gtkcontainer.c line 825
#37 g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#38 g_type_class_meta_marshal
at gclosure.c line 567
#39 g_closure_invoke
at gclosure.c line 490
#40 signal_emit_unlocked_R
at gsignal.c line 2554
#41 g_signal_emit_valist
at gsignal.c line 2197
#42 g_signal_emit
at gsignal.c line 2241
#43 gtk_object_dispose
at gtkobject.c line 418
#44 gtk_widget_dispose
at gtkwidget.c line 6873
#45 g_object_run_dispose
at gobject.c line 570
#46 gtk_object_destroy
at gtkobject.c line 403
#47 gtk_widget_destroy
at gtkwidget.c line 2158
#48 gtk_bin_forall
at gtkbin.c line 133
#49 gtk_container_foreach
at gtkcontainer.c line 1288
#50 gtk_container_destroy
at gtkcontainer.c line 825
#51 gtk_window_destroy
at gtkwindow.c line 3954
#52 g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#53 g_type_class_meta_marshal
at gclosure.c line 567
#54 g_closure_invoke
at gclosure.c line 490
#55 signal_emit_unlocked_R
at gsignal.c line 2554
#56 g_signal_emit_valist
at gsignal.c line 2197
#57 g_signal_emit
at gsignal.c line 2241
#58 gtk_object_dispose
at gtkobject.c line 418
#59 gtk_widget_dispose
at gtkwidget.c line 6873
#60 gtk_window_dispose
at gtkwindow.c line 1794
#61 g_object_run_dispose
at gobject.c line 570
#62 gtk_object_destroy
at gtkobject.c line 403
#63 gtk_widget_destroy
at gtkwidget.c line 2158
#64 gtk_main_do_event
at gtkmain.c line 1358
#65 gdk_event_dispatch
at gdkevents-x11.c line 2320
#66 g_main_context_dispatch
at gmain.c line 2045
#67 g_main_context_iterate
at gmain.c line 2677
#68 g_main_loop_run
at gmain.c line 2881
#69 gtk_main
at gtkmain.c line 1001
#70 fe_main
at ../../../src/fe-gnome/fe-gnome.c line 198
#71 main
at ../../../src/common/xchat.c line 1050

Comment 1 bill.haneman 2006-09-12 18:08:51 UTC

VERY weird:

+ Trace 72200

#2 gail_container_ref_child
at gailcontainer.c line 146
#3 atk_object_ref_accessible_child
at atkobject.c line 668


Note that the param is '0' in #3 but has become '-1' when passed to gailcontainer.c...  But how did that happen?

atk_object_ref_accessible_child:

  klass = ATK_OBJECT_GET_CLASS (accessible);
  if (klass->ref_child)
    return (klass->ref_child) (accessible, i);
  else
    return NULL;

Something's amiss with this stack trace I suspect, or... ????

Reducing to 'major' severity since it's crash-on-exit.

Comment 2 Christian Persch 2006-09-12 18:25:36 UTC

It seems at-poking is unecessary, just doing start xchat-gnome + quit is enough to trigger the warnings.

I think the value of |i| in frame 3 is just gdb not having the info since it's just passed around from frame 4. In frame 4 the value is -1:

+ Trace 72203

#4 spi_atk_bridge_signal_listener
at bridge.c line 1036
#8 gail_container_real_remove_gtk
at gailcontainer.c line 248

243         }
244       gail_container = GAIL_CONTAINER (atk_parent);
245       index = g_list_index (gail_container->children, widget);
246       g_list_free (gail_container->children);
247       gail_container->children = gtk_container_get_children (container);
248       g_signal_emit_by_name (atk_parent, "children_changed::remove",
249                              index, atk_child, NULL);
250
251       return 1;
252     }
(gdb) p index
$11 = -1

That means that the child wasn't found in the gail_container->children list.

The widget in question is the menubar, btw:

(gdb) p gtk_widget_get_name (widget)
$13 = (const gchar *) 0x84118e8 "menubar"

Comment 3 bill.haneman 2006-09-12 18:53:55 UTC

The gail_container->children list comes from a call to gtk_container_get_children.  

That suggests that either gtk_container_remove is getting called more than once for the widget, or that gail is attempting to remove the widget twice (perhaps due to acting on two different signal types here), OR gtk had already removed the widget from its container list the last time it was refreshed by gail.  That last possibility smells like a race condition...

Comment 4 bill.haneman 2006-09-25 14:10:51 UTC

Created attachment 73373 [details] [review]
patch to prevent emission of child-removed for objects no longer present in the container.

This patch should solve the problem, but I wonder if it is suppressing emission of a notification that should be given?

Comment 5 bill.haneman 2006-09-25 14:15:49 UTC

Since this is happening on exit I think it's reasonable and correct to omit the "children-changed:delete" events.  Committing to CVS HEAD.

Comment 6 Christian Persch 2006-09-25 16:37:56 UTC

I confirm that this removed the critical warning on closing xchat-gnome with a11y enabled. Thanks!