After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 741511 - Critical message: NULL is passed to g_object_unref() in spi_atk_state_to_dbus_array()
Critical message: NULL is passed to g_object_unref() in spi_atk_state_to_dbus...
Status: RESOLVED FIXED
Product: gtk+
Classification: Platform
Component: Accessibility
3.15.x
Other Linux
: Normal normal
: ---
Assigned To: gtk-bugs
gtk-bugs
Depends on:
Blocks:
 
 
Reported: 2014-12-14 14:59 UTC by Sébastien Wilmet
Modified: 2015-02-28 19:00 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Fix critical message with g_object_unref() (897 bytes, patch)
2014-12-14 15:01 UTC, Sébastien Wilmet
none Details | Review
Patch to gtktextviewaccessible.c (1.16 KB, patch)
2015-02-28 14:11 UTC, Peter Bloomfield
committed Details | Review

Description Sébastien Wilmet 2014-12-14 14:59:44 UTC
- Open a file with gedit
- Select some text and copy it (Ctrl+C)
- Quit gedit

I have this critical message:

> GLib-GObject-CRITICAL **: g_object_unref: assertion 'G_IS_OBJECT (object)' failed

The backtrace:

(gdb) bt
  • #0 _g_log_abort
    at gmessages.c line 315
  • #1 g_logv
    at gmessages.c line 1041
  • #2 g_log
    at gmessages.c line 1079
  • #3 g_return_if_fail_warning
  • #4 g_object_unref
    at gobject.c line 3067
  • #5 spi_atk_state_to_dbus_array
    at accessible-stateset.c line 184
  • #6 impl_GetState
    at accessible-adaptor.c line 443
  • #7 handle_other
    at droute.c line 553
  • #8 handle_message
    at droute.c line 600
  • #9 _dbus_object_tree_dispatch_and_unlock
    at dbus-object-tree.c line 1018
  • #10 dbus_connection_dispatch
    at dbus-connection.c line 4691
  • #11 message_queue_dispatch
    at atspi-gmain.c line 89
  • #12 g_main_dispatch
    at gmain.c line 3122
  • #13 g_main_context_dispatch
    at gmain.c line 3737
  • #14 g_main_context_iterate
    at gmain.c line 3808
  • #15 g_main_loop_run
    at gmain.c line 4002
  • #16 gtk_clipboard_real_store
    at gtkclipboard.c line 2148
  • #17 gtk_clipboard_store
    at gtkclipboard.c line 2111
  • #18 _gtk_clipboard_store_all
    at gtkclipboard.c line 2184
  • #19 gtk_application_shutdown
    at gtkapplication.c line 617
  • #20 gedit_app_shutdown
    at gedit/gedit-app.c line 1195
  • #21 g_cclosure_marshal_VOID__VOIDv
    at gmarshal.c line 115
  • #22 g_type_class_meta_marshalv
    at gclosure.c line 988
  • #23 _g_closure_invoke_va
    at gclosure.c line 831
  • #24 g_signal_emit_valist
    at gsignal.c line 3201
  • #25 g_signal_emit
    at gsignal.c line 3348
  • #26 g_application_run
    at gapplication.c line 2296
  • #27 main
    at gedit/gedit.c line 135

So g_object_unref() is called with NULL in the spi_atk_state_to_dbus_array() function.

I'll attach a patch that fixes the bug, but I'm not sure if it's normal if the AtkStateSet is NULL.
Comment 1 Sébastien Wilmet 2014-12-14 15:01:41 UTC
Created attachment 292695 [details] [review]
Fix critical message with g_object_unref()

The AtkStateSet can be NULL.
Comment 2 Alejandro Piñeiro Iglesias (IRC: infapi00) 2014-12-15 16:57:14 UTC
(In reply to comment #0)

> I'll attach a patch that fixes the bug, but I'm not sure if it's normal if the
> AtkStateSet is NULL.

In theory it shouldn't, as you should get at least return an empty StateSet. Even if the accessible refers to an object that doesn't exist anymore, the accessible should return an AtkStateSet (and in this case it is a non-empty StateSet, as it should include ATK_STATE_DEFUNCT).

Right now, the default atk_object_ref_state_set creates a new empty state set. So each time you get a newly created state set. Most ATK implementors calls always the parent ref_state_set, just adding more states to the set.

Looking at gtk (as gedit is a gtk application), only one widget implementation of ref_state_set doesn't call atkobject ref_state_set or creates a new ref_state_set. This is gtkiconviewaccessible: 
https://git.gnome.org/browse/gtk+/tree/gtk/a11y/gtkiconviewaccessible.c#n816

If the cached state set is null, it just returns null. And looking at the code, that only happens if the object was finalized. So that means that it doesn't handle the DEFUNCT state.

So I think that it would be good to confirm that the widget involved is this, and if it is the case, as is just one widget, move the bug there.
Comment 3 Sébastien Wilmet 2014-12-26 20:00:53 UTC
Thanks for the information. But I don't have time to investigate this further, I just made the trivial patch if the problem was there.
Comment 4 Peter Bloomfield 2015-02-26 15:41:39 UTC
(In reply to Alejandro Piñeiro Iglesias (IRC: infapi00) from comment #2)

I'm getting the same critical message in an app that uses GtkTextView (actually GtkSourceView, but that doesn't seem to be related). In gtk_text_view_accessible_ref_state_set I see:

  widget = gtk_accessible_get_widget (GTK_ACCESSIBLE (accessible));
  if (widget == NULL)
    return NULL;

and that's how I'm getting a NULL AtkStateSet; gtk_button_accessible_ref_state_set does the same thing, also gtk_check_menu_item_accessible_ref_state_set, gtk_expander_accessible_ref_state_set, gtk_toggle_button_accessible_ref_state_set, and gtk_window_accessible_ref_state_set, in addition to the gtkiconviewaccessible noted in comment 2. 

Should bugs be filed against all of them? Is the correct action to use the parent's vfunc to create the AtkStateSet, as in gtk_color_swatch_accessible_ref_state_set, or atk_state_set_new, as in gtk_cell_accessible_ref_state_set? And should each widget set ATK_STATE_DEFUNCT if its widget is NULL?

If returning a NULL AtkStateSet is a programming error, shouldn't spi_atk_state_to_dbus_array g_return_if_fail(set != NULL)?
Comment 5 Peter Bloomfield 2015-02-28 14:11:52 UTC
Created attachment 298158 [details] [review]
Patch to gtktextviewaccessible.c

Fix gtk_text_view_accessible_ref_state_set to return an AtkStateSet with ATK_STATE_DEFUNCT instead of NULL when its GtkWidget is NULL.
Comment 6 Matthias Clasen 2015-02-28 18:56:10 UTC
Review of attachment 298158 [details] [review]:

thanks