Bug 765018 – Segfault in gtk_css_gadget_get_visible

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 765018 - Segfault in gtk_css_gadget_get_visible


Summary:	Segfault in gtk_css_gadget_get_visible


Status:	RESOLVED NOTGNOME

Product:	gtk+
Classification:	Platform
Component:	.General
Version:	3.20.x
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	---
Assigned To:	gtk-bugs
QA Contact:	gtk-bugs

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2016-04-13 21:34 UTC by Alex Băluț
Modified:	2016-04-17 00:45 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Alex Băluț 2016-04-13 21:34:36 UTC

Pitivi segfaults when using GTK 3.20:

(gdb) bt

+ Trace 236178

#0 gtk_css_gadget_get_visible
at gtkcssgadget.c line 357
#1 gtk_css_gadget_draw
at gtkcssgadget.c line 828
#2 gtk_box_draw
at gtkbox.c line 457
#3 ffi_call_unix64
from /usr/lib/libffi.so.6
#4 ffi_call
from /usr/lib/libffi.so.6
#5 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#6 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#7 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#8 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#9 PyObject_Call
at Objects/abstract.c line 2165
#10 do_call
at Python/ceval.c line 4887
#11 call_function
at Python/ceval.c line 4683
#12 PyEval_EvalFrameEx
at Python/ceval.c line 3185
#13 _PyEval_EvalCodeWithName
at Python/ceval.c line 3966
#14 PyEval_EvalCodeEx
at Python/ceval.c line 3987
#15 function_call
at Objects/funcobject.c line 632
#16 PyObject_Call
at Objects/abstract.c line 2165
#17 PyEval_CallObjectWithKeywords
at Python/ceval.c line 4530
#18 PyObject_CallObject
at Objects/abstract.c line 2091
#19 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#20 ffi_closure_unix64_inner
from /usr/lib/libffi.so.6
#21 ffi_closure_unix64
from /usr/lib/libffi.so.6
#22 gtk_widget_draw_internal
at gtkwidget.c line 6989
#23 gtk_container_propagate_draw
at gtkcontainer.c line 3838
#24 gtk_container_draw
at gtkcontainer.c line 3658
#25 gtk_box_draw_contents
at gtkbox.c line 448
#26 gtk_css_custom_gadget_draw
at gtkcsscustomgadget.c line 159
#27 gtk_css_gadget_draw
at gtkcssgadget.c line 877
#28 gtk_box_draw
at gtkbox.c line 457
#29 gtk_widget_draw_internal
at gtkwidget.c line 6989
#30 gtk_container_propagate_draw
at gtkcontainer.c line 3838
#31 gtk_container_draw
at gtkcontainer.c line 3658
#32 gtk_box_draw_contents
at gtkbox.c line 448
#33 gtk_css_custom_gadget_draw
at gtkcsscustomgadget.c line 159
#34 gtk_css_gadget_draw
at gtkcssgadget.c line 877
#35 gtk_box_draw
at gtkbox.c line 457
#36 gtk_widget_draw_internal
at gtkwidget.c line 6989
#37 gtk_container_propagate_draw
at gtkcontainer.c line 3838
#38 gtk_container_draw
at gtkcontainer.c line 3658
#39 gtk_layout_draw
at gtklayout.c line 1043
#40 gtk_widget_draw_internal
at gtkwidget.c line 6989
#41 gtk_container_propagate_draw
at gtkcontainer.c line 3838
#42 gtk_container_draw
at gtkcontainer.c line 3658
#43 gtk_box_draw_contents
at gtkbox.c line 448
#44 gtk_css_custom_gadget_draw
at gtkcsscustomgadget.c line 159
#45 gtk_css_gadget_draw
at gtkcssgadget.c line 877
#46 gtk_box_draw
at gtkbox.c line 457
#47 gtk_widget_draw_internal
at gtkwidget.c line 6989
#48 gtk_container_propagate_draw
at gtkcontainer.c line 3838
#49 gtk_container_draw
at gtkcontainer.c line 3658
#50 gtk_event_box_draw
at gtkeventbox.c line 619
#51 ffi_call_unix64
from /usr/lib/libffi.so.6
#52 ffi_call
from /usr/lib/libffi.so.6
#53 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#54 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#55 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#56 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#57 PyObject_Call
at Objects/abstract.c line 2165
#58 do_call
at Python/ceval.c line 4887
#59 call_function
at Python/ceval.c line 4683
#60 PyEval_EvalFrameEx
at Python/ceval.c line 3185
#61 _PyEval_EvalCodeWithName
at Python/ceval.c line 3966
#62 PyEval_EvalCodeEx
at Python/ceval.c line 3987
#63 function_call
at Objects/funcobject.c line 632
#64 PyObject_Call
at Objects/abstract.c line 2165
#65 PyEval_CallObjectWithKeywords
at Python/ceval.c line 4530
#66 PyObject_CallObject
at Objects/abstract.c line 2091
#67 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#68 ffi_closure_unix64_inner
from /usr/lib/libffi.so.6
#69 ffi_closure_unix64
from /usr/lib/libffi.so.6
#70 gtk_widget_draw_internal
at gtkwidget.c line 6989
#71 gtk_container_propagate_draw
at gtkcontainer.c line 3838
#72 gtk_container_draw
at gtkcontainer.c line 3658
#73 gtk_grid_render
at gtkgrid.c line 1716
#74 gtk_css_custom_gadget_draw
at gtkcsscustomgadget.c line 159
#75 gtk_css_gadget_draw
at gtkcssgadget.c line 877
#76 gtk_grid_draw
at gtkgrid.c line 1725
#77 gtk_widget_draw_internal
at gtkwidget.c line 6989
#78 gtk_container_propagate_draw
at gtkcontainer.c line 3838
#79 gtk_paned_render
at gtkpaned.c line 1832
#80 gtk_css_custom_gadget_draw
at gtkcsscustomgadget.c line 159
#81 gtk_css_gadget_draw
at gtkcssgadget.c line 877
#82 gtk_paned_draw
at gtkpaned.c line 1782
#83 gtk_widget_draw_internal
at gtkwidget.c line 6989
#84 gtk_container_propagate_draw
at gtkcontainer.c line 3838
#85 gtk_container_draw
at gtkcontainer.c line 3658
#86 gtk_window_draw
at gtkwindow.c line 10207
#87 gtk_widget_draw_internal
at gtkwidget.c line 6989
#88 gtk_widget_send_expose
at gtkwidget.c line 7527
#89 gtk_main_do_event
at gtkmain.c line 1795
#90 _gdk_event_emit
at gdkevents.c line 73
#91 _gdk_window_process_updates_recurse_helper
at gdkwindow.c line 3587
#92 _gdk_window_process_updates_recurse
at gdkwindow.c line 3644
#93 gdk_window_impl_process_updates_recurse
at gdkwindowimpl.c line 46
#94 gdk_window_process_updates_internal
at gdkwindow.c line 3733
#95 gdk_window_process_updates_with_mode
at gdkwindow.c line 3934
#96 gdk_window_paint_on_clock
at gdkwindow.c line 11289
#97 ??
from /usr/lib/libgobject-2.0.so.0
#98 g_signal_emit_valist
from /usr/lib/libgobject-2.0.so.0
#99 g_signal_emit_by_name
from /usr/lib/libgobject-2.0.so.0
#100 gdk_frame_clock_paint_idle
at gdkframeclockidle.c line 430
#101 gdk_threads_dispatch
at gdk.c line 720
#102 ??
from /usr/lib/libglib-2.0.so.0
#103 g_main_context_dispatch
from /usr/lib/libglib-2.0.so.0
#104 ??
from /usr/lib/libglib-2.0.so.0
#105 g_main_context_iteration
from /usr/lib/libglib-2.0.so.0
#106 g_application_run
from /usr/lib/libgio-2.0.so.0
#107 ffi_call_unix64
from /usr/lib/libffi.so.6
#108 ffi_call
from /usr/lib/libffi.so.6
#109 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#110 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#111 ??
from /usr/lib/python3.5/site-packages/gi/_gi.cpython-35m-x86_64-linux-gnu.so
#112 PyObject_Call
at Objects/abstract.c line 2165
#113 do_call
at Python/ceval.c line 4887
#114 call_function
at Python/ceval.c line 4683
#115 PyEval_EvalFrameEx
at Python/ceval.c line 3185
#116 fast_function
at Python/ceval.c line 4754
#117 call_function
at Python/ceval.c line 4681
#118 PyEval_EvalFrameEx
at Python/ceval.c line 3185
#119 _PyEval_EvalCodeWithName
at Python/ceval.c line 3966
#120 PyEval_EvalCodeEx
at Python/ceval.c line 3987
#121 PyEval_EvalCode
at Python/ceval.c line 777
#122 run_mod
at Python/pythonrun.c line 970
#123 PyRun_FileExFlags
at Python/pythonrun.c line 923
#124 PyRun_SimpleFileExFlags
at Python/pythonrun.c line 396
#125 PyRun_AnyFileExFlags
at Python/pythonrun.c line 80
#126 run_file
at Modules/main.c line 318
#127 Py_Main
at Modules/main.c line 768
#128 main
at ./Programs/python.c line 69

Comment 1 Alex Băluț 2016-04-14 11:48:31 UTC

Seems a Gtk.Layout containing an empty Gtk.Box at some point causes this segfault. See https://phabricator.freedesktop.org/T7373#86205

Comment 2 Matthias Clasen 2016-04-14 19:41:08 UTC

The only place where box->priv->gadget is cleared is in dispose(). So, either the python code here manages to call draw() on a disposed widget somehow, or there is some memory corruption causing the gadget pointer to be cleared.

Comment 3 Matthias Clasen 2016-04-14 19:43:55 UTC

would be good to catch this in a debugger and see what the widget in question looks like at that point

Comment 4 Alex Băluț 2016-04-16 21:31:50 UTC

The problem was that Layer is a subclass of Gtk.EventBox and the Layer.do_draw method was calling Gtk.Box.do_draw(self, cr) instead of calling Gtk.EventBox.do_draw(self, cr). 

We ended up removing the method, it was not doing anything and was just a relic from the previous timeline implementation: https://git.gnome.org/browse/pitivi/commit/?id=62e5a852f905847e98cc653bc9e06fc8b57ab899