After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 506769 - GtkCellRendererCombo fails for 2.12.3 under Windows
GtkCellRendererCombo fails for 2.12.3 under Windows
Status: RESOLVED FIXED
Product: gtk+
Classification: Platform
Component: Backend: Win32
2.12.x
Other All
: Normal critical
: ---
Assigned To: Cody Russell
gtk-bugs
: 503326 512707 515415 516228 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2008-01-02 01:08 UTC by Czirkos Zoltan
Modified: 2008-03-06 15:57 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
The test case mentioned in the text. (9.02 KB, text/plain)
2008-01-02 20:11 UTC, Czirkos Zoltan 		  Details
Proposed solution (909 bytes, patch)
2008-01-10 20:47 UTC, Cody Russell 		committed Details | Review

Description Czirkos Zoltan 2008-01-02 01:08:17 UTC 
Steps to reproduce:
The tree view/editable example in the gtk-demo program can be used to reproduce the bug. Open the example, click on any row in the Number column to open the RendererCombo. Select a number and click. Close the window: the application will crash.

GTK+ 2.12.3 fails, also in mingw environment and also using the gtk-win sourceforge runtime. GTK+ 2.12.1 works correctly. I could not reproduce the bug in Linux.

http://jutas.eet.bme.hu/~cirix/renderer_combo.c is a small modification of the gtk-demo example mentioned above, it was used to create the trace. The segmentation violation happens in gtk_widget_destroy(window), after clicking the quit button.

Stack trace:
Program received signal SIGSEGV, Segmentation fault.
0x77c378c0 in _libmsvcrt_a_iname ()
(gdb) bt

+ Trace 183750

  • #0 _libmsvcrt_a_iname
  • #1 _libmsvcrt_a_iname
  • #2 _libmsvcrt_a_iname
  • #3 _libmsvcrt_a_iname
  • #4 _libmsvcrt_a_iname
  • #5 _libmsvcrt_a_iname
  • #6 _libmsvcrt_a_iname
  • #7 _libmsvcrt_a_iname
  • #8 _libuser32_a_iname
  • #9 _libuser32_a_iname
  • #10 _libuser32_a_iname
  • #11 _libmsvcrt_a_iname
  • #12 _libmsvcrt_a_iname
  • #13 _libmsvcrt_a_iname
  • #14 _libmsvcrt_a_iname
  • #15 _libmsvcrt_a_iname
  • #16 _libmsvcrt_a_iname
  • #17 _libmsvcrt_a_iname
  • #18 _libmsvcrt_a_iname
  • #19 main
    at renderer_combo.c line 360 


Other information:
gcc:
Configured with: ../gcc/configure --with-gcc --with-gnu-ld --with-gnu-as --host=mingw32 --target=mingw32 --prefix=/mingw --enable-threads --disable-nls --enable-languages=c,c++,f77,ada,objc,java --disable-win32-registry --disable-shared --enable-sjlj-exceptions --enable-libgcj --disable-java-awt --without-x --enable-java-gc=boehm --disable-libgcj-debug --enable-interpreter --enable-hash-synchronization --enable-libstdcxx-debug
Thread model: win32
gcc version 3.4.2 (mingw-special)



gtk+:
http://www.gimp.org/~tml/gimp/win32/downloads.html, 2.12.3 fails

http://sourceforge.net/projects/gtk-win/ 2.12.3 fails,
2.12.1 works
Comment 1 Czirkos Zoltan 2008-01-02 20:11:09 UTC 
Created attachment 102009 [details]
The test case mentioned in the text.

The source is almost the same as the editable tree view example in gtk-demo.
Comment 2 Tor Lillqvist 2008-01-03 11:48:47 UTC 
Cody, this seems to be caused by your code in _gdk_windowing_window_destroy(), in the loop "Remove all our transient children" the GdkWindow pointer from the transient_children list seems to point to bogus data. 

(Wild guess: Already freed data? Some reference counting problem? Should the GdkWindows in the transient_children list be refed when put on the list and unrefed when taken off it?)

Backtrace from a not-quite-recent build of gtk-2-12:

+ Trace 183900

  • #0 strlen
    from C:\WINDOWS\system32\msvcrt.dll
  • #1 _g_gnulib_vasnprintf
    at vasnprintf.c line 579
  • #2 _g_gnulib_vasprintf
    at printf.c line 144
  • #3 g_vasprintf
    at gprintf.c line 307
  • #4 g_strdup_vprintf
    at gstrfuncs.c line 217
  • #5 g_logv
    at gmessages.c line 472
  • #6 g_log
    at gmessages.c line 517
  • #7 g_type_check_instance_cast
    at gtype.c line 3160
  • #8 _gdk_windowing_window_destroy
    at gdkwindow-win32.c line 852
  • #9 _gdk_window_destroy_hierarchy
    at gdkwindow.c line 442
  • #10 gdk_window_destroy
    at gdkwindow.c line 487
  • #11 gtk_widget_real_unrealize
    at gtkwidget.c line 8009
  • #12 gtk_window_unrealize
    at gtkwindow.c line 4686
  • #13 g_cclosure_marshal_VOID__VOID
    at gmarshal.c line 77
  • #14 g_type_class_meta_marshal
    at gclosure.c line 567
  • #15 g_closure_invoke
    at gclosure.c line 490
  • #16 signal_emit_unlocked_R
    at gsignal.c line 2478
  • #17 g_signal_emit_valist
    at gsignal.c line 2199
  • #18 g_signal_emit
    at gsignal.c line 2243
  • #19 gtk_widget_unrealize
    at gtkwidget.c line 3307
  • #20 gtk_widget_dispose
    at gtkwidget.c line 7849
  • #21 gtk_window_dispose
    at gtkwindow.c line 1968
  • #22 g_object_run_dispose
    at gobject.c line 573
  • #23 gtk_object_destroy
    at gtkobject.c line 403
  • #24 gtk_widget_destroy
    at gtkwidget.c line 2886
  • #25 main
    at 506769.c line 360 






Comment 3


Cody Russell





          2008-01-10 19:59:07 UTC
        



"The tree view/editable example in the gtk-demo program can be used to reproduce
the bug. Open the example, click on any row in the Number column to open the
RendererCombo. Select a number and click. Close the window: the application
will crash."

I downloaded Tor's build of 2.12.3 and I am unable to reproduce these steps.  It works as expected.  I also built the demo program and tested it, and I can't reproduce using that either.

I'll look through the stack trace and see if I can figure out anything useful though.






Comment 4


Cody Russell





          2008-01-10 20:19:08 UTC
        



Okay, Tor discovered that this doesn't reproduce using ms-windows theme engine, but it does otherwise.






Comment 5


Cody Russell





          2008-01-10 20:47:08 UTC
        



Created attachment 102541 [details] [review]
Proposed solution

Ref and unref window and parent when we set transient_for.






Comment 6


Cody Russell





          2008-01-10 21:00:15 UTC
        



Fixed in trunk and gtk-2-12 branch.






Comment 7


Tor Lillqvist





          2008-01-29 12:14:54 UTC
        



*** Bug 503326 has been marked as a duplicate of this bug. ***






Comment 8


Tor Lillqvist





          2008-02-11 16:47:16 UTC
        



*** Bug 515415 has been marked as a duplicate of this bug. ***






Comment 9


Michael Schumacher





          2008-02-18 13:51:38 UTC
        



*** Bug 512707 has been marked as a duplicate of this bug. ***






Comment 10


weskaggs





          2008-02-19 16:56:21 UTC
        



*** Bug 516228 has been marked as a duplicate of this bug. ***






Comment 11


Tor Lillqvist





          2008-03-06 15:57:30 UTC
        



another easy way to reproduce this bug (in 2.12.5) is to open gtk-demo's "Entry Completion", right-click and choose (just for example) the Cyrillic input method, type a few characters, and close the dialog. And this happens also with the ms-windows theme engine.