GNOME Bugzilla – Bug 512313
crash in IA__gtk_tree_model_get_valist
Last modified: 2013-01-04 21:26:22 UTC
Version: 2.20.3 What were you doing when the application crashed? I was adding and categorizing a bookmark. Distribution: Debian lenny/sid Gnome Release: 2.20.3 2008-01-12 (Debian) BugBuddy Version: 2.20.1 System: Linux 2.6.23.12-cfs-v24.1 #1 SMP PREEMPT Wed Dec 26 00:11:13 CET 2007 x86_64 X Vendor: The X.Org Foundation X Vendor Release: 10400090 Selinux: No Accessibility: Disabled GTK+ Theme: MurrinaNeoM Icon Theme: Tango Memory status: size: 555937792 vsize: 555937792 resident: 70459392 share: 30941184 rss: 70459392 rss_rlim: 18446744073709551615 CPU usage: start_time: 1201390991 rtime: 123 utime: 108 stime: 15 cutime:0 cstime: 0 timeout: 0 it_real_value: 0 frequency: 100 Backtrace was generated from '/usr/bin/epiphany-gecko' Using host libthread_db library "/lib/libthread_db.so.1". [Thread debugging using libthread_db enabled] [New Thread 0x2b139713dd50 (LWP 10925)] [New Thread 0x42804950 (LWP 10930)] [New Thread 0x42003950 (LWP 10929)] [New Thread 0x41001950 (LWP 10927)] [New Thread 0x40800950 (LWP 10926)] 0x00002b139109934f in waitpid () from /lib/libpthread.so.0
+ Trace 186922
Thread 1 (Thread 0x2b139713dd50 (LWP 10925))
----------- .xsession-errors (5296 sec old) --------------------- Throttle level is 20 Initializing gnome-mount extension seahorse nautilus module initialized system-config-printer-applet: failed to start NewPrinterNotification service ** Message: failed to load session from /home/bjoern/.nautilus/saved-session-740QXT ERROR:dbus.connection:Exception in handler for D-Bus signal: Traceback (most recent call last): File "/var/lib/python-support/python2.4/dbus/connection.py", line 214, in maybe_handle_message self._handler(*args, **kwargs) TypeError: evolution_new_mail_callback() takes at most 2 arguments (3 given) ERROR:dbus.connection:Exception in handler for D-Bus signal: Traceback (most recent call last): File "/var/lib/python-support/python2.4/dbus/connection.py", line 214, in maybe_handle_message self._handler(*args, **kwargs) TypeError: evolution_new_mail_callback() takes at most 2 arguments (3 given) --------------------------------------------------
Thanks for the bug report. It looks like something goes wrong inside GTK+.
Can't reproduce, we already got a newer release. Please try to reproduce there and let us know if it still happens.
*** Bug 528994 has been marked as a duplicate of this bug. ***
Confirming that this is still happening in gtk 2.12.9. => reopening.
What is at the basis of this bug is a reentrancy issue; while GtkTreeView is handling a button press via gtk_tree_view_button_press(), epiphany is modifying the underlying GtkTreeModel. When a node is clicked we toggle the toggle cell renderer, this yields update_list() in ephy-topics-palette.c. update_lists() not only adds nodes, but sometimes removes them. In case you click the last non-checked check box, the row for the separator is probably removed in the middle of GtkTreeView's handling of the button press event. We need the node later on to update the cursor position. This calls is_separator() with an invalid node, which epiphany passes (without checking) to gtk_tree_model_get(). At this moment we do not and will not support such manipulations of the GtkTreeModel from the callbacks that only indicate a toggle or editing operation has been done. Reassigning to the epiphany component.
Peter, you wrote this code so I'm putting you in CC.
*** Bug 540420 has been marked as a duplicate of this bug. ***
*** Bug 541486 has been marked as a duplicate of this bug. ***
*** Bug 541499 has been marked as a duplicate of this bug. ***
*** Bug 549622 has been marked as a duplicate of this bug. ***
Created attachment 117630 [details] [review] [PATCH] Check if the iter is valid in is_separator. Otherwise we can make GTK+ crash when is_separator tries to get data from the model using an invalid iter, closes: #512313. --- src/bookmarks/ephy-topics-palette.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-)
Diego: that patch doesn't seem right for fixing this bug, given Kris' comment 5.
Judging from Kris' comment, you probably want to defer any model manipulation to an idle
@Diego, do you have a status on this bug?
*** Bug 566413 has been marked as a duplicate of this bug. ***
Still here in 2.24.2.1 with gtk+ 2.14.5.
Reality check.
Still valid with 2.27.5.
Is this bug still valid in epiphany 3.0 or 3.2 ?
Can't reproduce in epiphany-browser 3.3.90-0ubuntu2, please, close this report
As per last comment.