GNOME Bugzilla – Bug 674236
Extra ref in e_action_combo_box_set_action()
Last modified: 2013-02-19 12:19:26 UTC
Moving this from a downstream bug report: https://bugzilla.redhat.com/show_bug.cgi?id=812923 [abrt] evolution-3.2.3-2.fc16: message_list_set_hidedeleted: Process /usr/bin/evolution was killed by signal 11 (SIGSEGV) libreport version: 2.0.8 abrt_version: 2.0.7 backtrace_rating: 4 cmdline: evolution comment: Enabled viewing of deleted messages. crash_function: message_list_set_hidedeleted executable: /usr/bin/evolution kernel: 3.3.1-5.fc16.x86_64 reason: Process /usr/bin/evolution was killed by signal 11 (SIGSEGV) time: Mon 16 Apr 2012 16:03:03 BST xsession_errors: :(evolution:2506): evolution-module-mail-CRITICAL **: e_mail_shell_content_get_mail_view: assertion `E_IS_MAIL_SHELL_CONTENT (mail_shell_content)' failed :(evolution:2506): evolution-mail-CRITICAL **: e_mail_reader_get_message_list: assertion `E_IS_MAIL_READER (reader)' failed Core was generated by `evolution'. Program terminated with signal 11, Segmentation fault.
+ Trace 230071
Thread 2 (Thread 0x7f3df40f8700 (LWP 2507))
Thread 1 (Thread 0x7f3dfb216980 (LWP 2506))
Just got it too, in git master. I had opened another mail window, which is currently closed, and I only picked View->Deleted. I was in calendar too. No related warning shown on console.
+ Trace 231508
Thread 1 (Thread 0x7f36ed440a00 (LWP 19473))
I see the GtkAction is leaked, or not freed, when the shell window is closed, even the action_group in which the action is stored is properly freed, but I cannot figure out from where the one reference is left on the action.
I'm moving this to gtk+, because I can reproduce it there, within gtk3-demo->Builder demo too.
Created attachment 236631 [details] gtk test patch This is a test patch, which adds debugging into gtk3-demo->Builder demo (and fixes possible memory leak of the GtkBuilder pointer as well). Steps: a) Patch the demo, compile it, and run gtk3-demo b) invoke the Builder demo. It'll print approximately this on console: > 0x1812cf0: weak_reffing builder at 1 ref_count > 0x173d330: weak_reffing window at 2 ref_count > 0x1805b30: weak_reffing action_about at 4 ref_count c) do not do anything in the demo itself, just close the window by clicking the "x" button in windows title (or by File->Quit) Console will have new messages: > 0x1812cf0 builder_pointer_gone: builder > count_about_action_refs: has refs: 4 > 0x173d330 builder_pointer_gone: window > count_about_action_refs: has refs: 1 And the last line shows the problem. Each pointer which is shown at b) with "weak_reffing" is supposed to be also printed in c) as "builder_pointer_gone", but the "action_about" is not printed as such, it's left with one reference, basically leaking and flying nowhere. The problem in evolution is that the action is invoked on a GSettings change, and the action has a pointer for a freed widget (window/view/...), but the GSettings object still notifies about changes for this action.
Hmmm, that's a terrible example though, it still uses GtkUIManager. Do you use a GtkBuilder created UIManager in evolution ? A normal reference cycle for a GtkAction built by builder would be: o GtkBuilder creates the object with a ref count of 1 o GtkBuilder creates a GtkActivatable widget which refers to the said action via it's 'related-action' property, making the action ref count 2 o GtkBuilder is destroyed, destroying it's internal hash table releases a reference to every built object, so the action ref count falls back to 1 o The top level window(s) is/are destroyed, releasing any references that any GtkActivatable widgets might have to their actions, hence disposing the actions.
FWIW, I've tried adding similar debugging to the ui_manager.c demo and nothing was leaked. It's my suspicion that the uimanager <ui> parsing code...
As we spoke about this on IRC, I added checks for the uimanager and its action_group, and the uimanager is properly freed, while the action_group is left with one reference (it holds the action, if I unref that one reference on my own, then also the action is freed as expected). I checked also evolution's .ui files and none of them has GtkUIManager, nor GtkAction in them, and if I recall correctly then the GtkUIManager used by each EShellWindow instance is properly freed. I hope it helps.
Created attachment 236743 [details] [review] proposed gtk patch (partial) for gtk+; Partial patch, it fixes the builder.c test, but not evolution itself. Note the removed ref is not needed, because gtk_ui_manager_insert_action_group() refs the action group on its own.
I'm moving this back to evolution, because the issue is different from gtk (though it seemed like it's the same thing). I opened bug #694162 for the gtk issue.
Created attachment 236756 [details] [review] evo patch for evolution; All the issue was due to extra reference being added in e_action_combo_box_set_action(), which leaked the group and all its actions.
Created commit 685e763 in evo master (3.7.91+) Created commit ccee9cb in evo gnome-3-6 (3.6.4+)