GNOME Bugzilla – Bug 738537
Crash when opening a GtkMenu on right click (regression)
Last modified: 2018-04-15 00:08:03 UTC
Created attachment 288535 [details] Backtrace produced by GDB Hello, When using GTK 3.14(.2), Cairo-Dock crashes when we do a right click on the dock. When doing a right click, it tries to display a GtkMenu and then there is a crash. I don't have this crash when using GTK 3.12, only with GTK 3.14. == How to reproduce this bug == * Install GTK 3.14 * Install Cairo-Dock * Simply do a right click on the dock Best Regards, Matt
Hmm, I installed cairo-dock here and could not reproduce this crash
Hello Matthias, Thank you for your answer! I'll try to reproduce this crash after having compiled the latest version of GTK.
Created attachment 288548 [details] Backtrace produced by GDB (GTK 3.14.3) Unfortunately I still have this crash with GTK 3.14.3. I'll try to test with the development version.
I can confirm that I still have the crash with the development version. Note that it seems 'priv' in 'gtk_menu_position' function is still at the init state: $1 = {parent_menu_item = 0x0, old_active_menu_item = 0x0, accel_group = 0x0, accel_path = 0x0, position_func = 0x0, position_func_data = 0x0, position_func_data_destroy = 0x0, position_x = 0, position_y = 0, toggle_size = 0, accel_size = 0, toplevel = 0x0, tearoff_window = 0x0, tearoff_hbox = 0x0, tearoff_scrollbar = 0x0, tearoff_adjustment = 0x0, view_window = 0x0, bin_window = 0x0, scroll_offset = 0, saved_scroll_offset = 0, scroll_step = 0, scroll_timeout = 0, needs_destruction_ref = 0, torn_off = 0, tearoff_active = 0, scroll_fast = 0, upper_arrow_visible = 0, lower_arrow_visible = 0, upper_arrow_prelight = 0, lower_arrow_prelight = 0, have_position = 0, have_layout = 0, seen_item_enter = 0, ignore_button_release = 0, no_toggle_size = 0, drag_already_pressed = 0, drag_scroll_started = 0, heights = 0x0, heights_length = 0, requested_height = 0, initially_pushed_in = 0, monitor_num = -1, n_rows = 0, n_columns = 0, title = 0x0, lower_arrow_state = GTK_STATE_FLAG_NORMAL, upper_arrow_state = GTK_STATE_FLAG_NORMAL, navigation_x = 0, navigation_y = 0, navigation_width = 0, navigation_height = 0, navigation_timeout = 0, drag_start_y = -1, initial_drag_offset = 0}
Hello, I don't know if it's related but with GTK 3.14 when a do a right click on the dock, two POPUP are requested. I also see more DESTROY signals. Here is what I have with GTK 3.12: (the first value is a structure which is attached to the menu (g_object_set_data()) ; the second one is a value in this structure ; and the third one is the GtkMenu) INIT 0x2204d90 - 0x2225b60 (0x227c250) INIT 0x24ea130 - 0x230b1d0 (0x227c970) INIT 0x276af20 - 0x22c6ea0 (0x227c4b0) INIT 0x22b5dc0 - 0x22b55d0 (0x22bc400) INIT 0x273b3a0 - 0x2200c60 (0x22bc680) INIT 0x260fba0 - 0x21169b0 (0x227d7b0) INIT 0x3820260 - (nil) (0x227da10) INIT 0x384bce0 - (nil) (0x227dc70) INIT 0x384ceb0 - (nil) (0x227ded0) INIT 0x3855a70 - (nil) (0x384e2d0) INIT 0x3863dc0 - (nil) (0x384e530) INIT 0x386ce30 - (nil) (0x384e790) INIT 0x387de90 - (nil) (0x384e9f0) INIT 0x3892eb0 - (nil) (0x384ec50) INIT 0x389c5c0 - (nil) (0x384eeb0) INIT 0x389f6b0 - (nil) (0x384f110) INIT 0x38a8980 - (nil) (0x384f370) INIT 0x18cae90 - (nil) (0x384f5d0) INIT 0x38e7be0 - (nil) (0x384f830) INIT 0x38ec4d0 - (nil) (0x384fa90) INIT 0x38fcf30 - (nil) (0x384fcf0) INIT 0x388adc0 - (nil) (0x384ff50) INIT 0x39205b0 - (nil) (0x39222c0) INIT 0x256ef50 - 0x1f40270 (0x3900280) INIT 0x2b55010 - (nil) (0x39004e0) INIT 0x2bb7730 - (nil) (0x3900740) INIT 0x2b8bc50 - (nil) (0x39009a0) INIT 0x2b75560 - (nil) (0x3900c00) POPUP: 0x256ef50 - 0x1f40270 (0x3900280) INIT 0x2b71bf0 - (nil) (0x3900e60) And what I have with GTK 3.14 with almost the same actions and just before a crash: INIT 0xa263c0 - 0x9c8a90 (0xa162b0) INIT 0xa08960 - (nil) (0xa16530) INIT 0xa2fa40 - (nil) (0xa167b0) INIT 0xa33a90 - (nil) (0xa16a30) INIT 0xa382c0 - (nil) (0xa16cb0) INIT 0xa407a0 - (nil) (0xa16f30) DESTROY: 0xa407a0 - (nil) (0xa16f30) INIT 0xa408f0 - (nil) (0xa171b0) INIT 0xa46a00 - (nil) (0xa17430) DESTROY: 0xa46a00 - (nil) (0xa17430) INIT 0xa45780 - (nil) (0xa17430) INIT 0xa4da50 - (nil) (0xa16f30) INIT 0xa57170 - (nil) (0xa176b0) INIT 0xa31610 - (nil) (0xa17930) INIT 0xa66210 - (nil) (0xa17bb0) INIT 0xa74540 - (nil) (0xa17e30) INIT 0xaaf490 - (nil) (0xab0400) INIT 0xab5cc0 - (nil) (0xab0680) g_object_unref: assertion 'G_IS_OBJECT (object)' failed INIT 0xad29a0 - (nil) (0xad03a0) INIT 0xae9650 - 0x996740 (0xab0900) g_object_unref: assertion 'G_IS_OBJECT (object)' failed INIT 0xaf4920 - (nil) (0xab0b80) INIT 0xb06fc0 - (nil) (0xab0e00) g_object_unref: assertion 'G_IS_OBJECT (object)' failed INIT 0x924ca0 - (nil) (0xab1080) INIT 0x99b220 - (nil) (0xab1300) g_object_unref: assertion 'G_IS_OBJECT (object)' failed g_object_unref: assertion 'G_IS_OBJECT (object)' failed g_object_unref: assertion 'G_IS_OBJECT (object)' failed INIT 0xb3d8c0 - (nil) (0xab1580) g_object_unref: assertion 'G_IS_OBJECT (object)' failed DESTROY: 0xae9650 - 0x996740 (0xab0900) DESTROY: 0xaf4920 - (nil) (0xab0b80) DESTROY: 0xb06fc0 - (nil) (0xab0e00) DESTROY: 0x924ca0 - (nil) (0xab1080) DESTROY: 0x99b220 - (nil) (0xab1300) DESTROY: 0xb3d8c0 - (nil) (0xab1580) INIT 0xb3d8c0 - 0x996740 (0xab1080) g_object_unref: assertion 'G_IS_OBJECT (object)' failed INIT 0xb46970 - (nil) (0xab1300) INIT 0xaf63c0 - (nil) (0xab0b80) g_object_unref: assertion 'G_IS_OBJECT (object)' failed INIT 0xb3d740 - (nil) (0xab0e00) INIT 0xaf74c0 - (nil) (0xab1580) g_object_unref: assertion 'G_IS_OBJECT (object)' failed g_object_unref: assertion 'G_IS_OBJECT (object)' failed g_object_unref: assertion 'G_IS_OBJECT (object)' failed INIT 0x925ab0 - (nil) (0xab1800) g_object_unref: assertion 'G_IS_OBJECT (object)' failed POPUP: 0xb3d8c0 - 0x996740 (0xab1080) POPUP: 0xae9650 - 0x7ffff62e5823 (0xab0900) Here I had a crash because the second value (0x7ffff62e5823) was wrong. We can see that there are two POPUP: INIT 0xae9650 - 0x996740 (0xab0900) ==> PARAM 1, MENU 1, ICON OK (...) INIT 0xb3d8c0 - (nil) (0xab1580) ==> PARAM 2, MENU 2 (...) INIT 0x924ca0 - (nil) (0xab1080) ==> PARAM 3, MENU 3 (...) DESTROY: 0xae9650 - 0x996740 (0xab0900) ==> PARAM 1, MENU 1, ICON OK (...) DESTROY: 0x924ca0 - (nil) (0xab1080) ==> PARAM 4, MENU 3 (...) DESTROY: 0xb3d8c0 - (nil) (0xab1580) ==> PARAM 2, MENU 2 INIT 0xb3d8c0 - 0x996740 (0xab1080) ==> PARAM 2, MENU 3, ICON OK (...) POPUP: 0xb3d8c0 - 0x996740 (0xab1080) ==> PARAM 2, MENU 3, ICON OK POPUP: 0xae9650 - 0x7ffff62e5823 (0xab0900) ==> PARAM 1, MENU 1, ICON KO But for the second POPUP, we can see that a DESTROY signal has been sent before the POPUP and this is why the icon is corrupted. Note that with this new version of GTK, we can also see a lot of: g_object_unref: assertion 'G_IS_OBJECT (object)' failed
PS: for Cairo-Dock, I now remove data (g_object_steal_data) linked the menu when receiving the 'destroy' signal. But it's strange to receive a destroy signal just before a (second) popup. I can do more tests if you want ;-)
Is this still an issue for you?
As announced a while ago, we are migrating to gitlab, and bugs that haven't seen activity in the last year or so will be not be migrated, but closed out in bugzilla. If this bug is still relevant to you, you can open a new issue describing the symptoms and how to reproduce it with gtk 3.22.x or master in gitlab: https://gitlab.gnome.org/GNOME/gtk/issues/new