GNOME Bugzilla – Bug 496546
Tooltips may crashe because a window is destroyed
Last modified: 2007-12-17 22:52:34 UTC
Steps to reproduce: Not sure exactly, somehow trigger a tooltip timeout and then destroy the window. I do not have a foolproof way to reproduce it. First I had noticed it in gnome-screensaver, but also have been able to reproduce it with the "Add"/"Remove" button in the gedit file open dialog somehow. The trick seems to be to hover over the button and then press escape so the window is destroyed. Stack trace: Sorry, not able to reproduce it right now (and did when I reproduced it). So here the details that I remember: The crash occurs in gtk_tooltip_show_tooltip for the if (!GDK_IS_WINDOW (window)) test. gtk_tooltip_show_tooltip is called from tooltip_popup_timeout. Other information: I think what is needed is to at least use weak references on the GdkWindow for last_window instead of just storing a pointer. It may also be a good idea to somehow check if the window is still visible (though not sure if that is needed).
Created attachment 99050 [details] [review] Use weak references I wrote this when I stumbled over it. However has not had any testing as I am currently not able to reproduce this reliably and I am not sure if this is the correct thing to do.
Ah, here a stack trace, just got the crash again. (gdb) bt
+ Trace 177910
Sounds about right to me. Kris, any comment ?
As this happens every once in a while to me when unlocking the screensaver, I am now compiling a GTK version with the patch applied. This is not an ideal test, but lets see if I see the crash again in the next week or so.
Putting on my list.
Okay, analyzed the situation. I think this bug usually does not turn up because: A) A key press event that will later destroy a window is still handled by the tooltips code, causing it the hide the tooltip. B) If so, the GDK_IS_WINDOW() in gtk_tooltip_show_tooltip() usually handles things good enough. I realized that last_window can point to a totally bogus pointer in some cases after the "old" last_window was destroyed. GDK_IS_WINDOW() can still crash then, while I was silently assuming that it wouldn't (very stupid assumption from my part). The weak pointer magic will set this pointer to NULL, avoiding issues. I committed your patch with minor changes on trunk in r19189.
Can we get the fix on the stable branch too, please ?
(In reply to comment #7) > Can we get the fix on the stable branch too, please ? > done.