Bug 512743 – Applications with lists crash in libgail

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 512743 - Applications with lists crash in libgail


Summary:	Applications with lists crash in libgail


Status:	RESOLVED FIXED

Product:	atk
Classification:	Platform
Component:	gail
Version:	1.20.x
Hardware:	Other All

Importance:	High critical
Target Milestone:	---
Assigned To:	Li Yuan
QA Contact:	Li Yuan

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2008-01-29 09:15 UTC by Dan Sanders
Modified:	2008-12-12 06:12 UTC

See Also:
GNOME target:	---
GNOME version:	2.19/2.20

Attachments
patch (775 bytes, patch) 2008-12-12 06:05 UTC, Li Yuan	committed	Details \| Review

Description Dan Sanders 2008-01-29 09:15:34 UTC

Steps to reproduce:
1. Run Streamtuner
2. Select Google Stations
3. Click on a folder


Stack trace:

+ Trace 187164

#0 __kernel_vsyscall
#1 raise
from /lib/libc.so.6
#2 abort
from /lib/libc.so.6
#3 g_logv
from /usr/lib/libglib-2.0.so.0
#4 g_log
from /usr/lib/libglib-2.0.so.0
#5 g_assert_warning
from /usr/lib/libglib-2.0.so.0
#6 traverse_cells
from /usr/lib/gtk-2.0/modules/libgail.so
#7 g_cclosure_marshal_VOID__VOID
from /usr/lib/libgobject-2.0.so.0
#8 g_closure_invoke
from /usr/lib/libgobject-2.0.so.0
#9 signal_emit_unlocked_R
from /usr/lib/libgobject-2.0.so.0
#10 g_signal_emit_valist
from /usr/lib/libgobject-2.0.so.0
#11 g_signal_emit
from /usr/lib/libgobject-2.0.so.0
#12 gtk_adjustment_value_changed
from /usr/lib/libgtk-x11-2.0.so.0
#13 gtk_adjustment_set_value
from /usr/lib/libgtk-x11-2.0.so.0
#14 gtk_tree_view_top_row_to_dy
from /usr/lib/libgtk-x11-2.0.so.0
#15 gtk_tree_view_size_allocate
from /usr/lib/libgtk-x11-2.0.so.0
#16 g_cclosure_marshal_VOID__BOXED
from /usr/lib/libgobject-2.0.so.0
#17 g_type_class_meta_marshal
from /usr/lib/libgobject-2.0.so.0
#18 g_closure_invoke
from /usr/lib/libgobject-2.0.so.0
#19 signal_emit_unlocked_R
from /usr/lib/libgobject-2.0.so.0
#20 g_signal_emit_valist
from /usr/lib/libgobject-2.0.so.0
#21 g_signal_emit
from /usr/lib/libgobject-2.0.so.0
#22 gtk_widget_size_allocate
from /usr/lib/libgtk-x11-2.0.so.0


Other information:
Also affects gajim, likely other applications. Prints this message in the console:

** ERROR **: file gailtreeview.c: line 3755 (traverse_cells): assertion failed: (row_path != NULL)
aborting...

Comment 1 Jeff Cai 2008-02-22 08:35:16 UTC

When I run streamtuner at Ubuntu 7.10, it crashes in libpython2.5.so. Which platform did you run on?

Comment 2 Dan Sanders 2008-02-22 09:51:29 UTC

Gentoo ~x86.

Comment 3 Li Yuan 2008-03-17 02:58:58 UTC

Found another crash when try to reproduce the crash (I can reproduce the crash in bugs' description too):

+ Trace 192640

#0 raise
from /lib/libc.so.6
#1 abort
from /lib/libc.so.6
#2 IA__g_assertion_message
#3 IA__g_assertion_message_expr
#4 gtk_tree_store_get_path
at gtktreestore.c line 531
#5 IA__gtk_tree_store_set_valist
at gtktreestore.c line 1055
#6 IA__gtk_tree_store_set
at gtktreestore.c line 1082
#7 ??
#8 IA__g_cclosure_marshal_VOID__PARAM
at gmarshal.c line 531
#9 IA__g_closure_invoke
at gclosure.c line 490
#10 signal_emit_unlocked_R
at gsignal.c line 2440
#11 IA__g_signal_emit_valist
at gsignal.c line 2199
#12 IA__g_signal_emit
at gsignal.c line 2243
#13 g_object_dispatch_properties_changed
at gobject.c line 563
#14 g_object_notify_dispatcher
at gobject.c line 245
#15 g_object_notify_queue_thaw
at gobjectnotifyqueue.c line 123
#16 IA__g_object_set_valist
at gobject.c line 1136
#17 IA__g_object_set
at gobject.c line 1212
#18 ??
#19 st_thread_cleanup
#20 ??
#21 ??
#22 g_thread_create_proxy
at gthread.c line 635
#23 start_thread
from /lib/libpthread.so.0
#24 clone
from /lib/libc.so.6
#25 ??

Comment 4 Li Yuan 2008-12-05 06:55:31 UTC

The full trace I got:
(gdb) p row_path
$1 = (GtkTreePath *) 0x0
(gdb) p cell_info->cell_row_ref
$2 = (GtkTreeRowReference *) 0x898bbc8
(gdb) p *cell_info->cell_row_ref
$3 = {proxy = 0x89d9b98, model = 0x89d9b98, path = 0x0}
(gdb) bt

+ Trace 210498

#0 traverse_cells
at gailtreeview.c line 3754
#1 gail_tree_view_size_allocate_gtk
at gailtreeview.c line 2360
#2 IA__g_cclosure_marshal_VOID__BOXED
at gmarshal.c line 566
#3 IA__g_closure_invoke
at gclosure.c line 767
#4 signal_emit_unlocked_R
at gsignal.c line 3244
#5 IA__g_signal_emit_valist
at gsignal.c line 2977
#6 IA__g_signal_emit
at gsignal.c line 3034
#7 IA__gtk_widget_size_allocate
at gtkwidget.c line 3877
#8 gtk_scrolled_window_size_allocate
at gtkscrolledwindow.c line 1362
#9 IA__g_cclosure_marshal_VOID__BOXED
at gmarshal.c line 566
#10 g_type_class_meta_marshal
at gclosure.c line 878
#11 IA__g_closure_invoke
at gclosure.c line 767
#12 signal_emit_unlocked_R
at gsignal.c line 3174
#13 IA__g_signal_emit_valist
at gsignal.c line 2977
#14 IA__g_signal_emit
at gsignal.c line 3034
#15 IA__gtk_widget_size_allocate
at gtkwidget.c line 3877
#16 gtk_paned_size_allocate
at gtkpaned.c line 945
#17 IA__g_cclosure_marshal_VOID__BOXED
at gmarshal.c line 566
#18 g_type_class_meta_marshal
at gclosure.c line 878
#19 IA__g_closure_invoke
at gclosure.c line 767
#20 signal_emit_unlocked_R
at gsignal.c line 3174
#21 IA__g_signal_emit_valist
at gsignal.c line 2977
#22 IA__g_signal_emit
at gsignal.c line 3034
#23 IA__gtk_widget_size_allocate
at gtkwidget.c line 3877
#24 gtk_notebook_size_allocate
#25 IA__g_cclosure_marshal_VOID__BOXED
at gmarshal.c line 566
#26 g_type_class_meta_marshal
at gclosure.c line 878
#27 IA__g_closure_invoke
at gclosure.c line 767
#28 signal_emit_unlocked_R
at gsignal.c line 3174
#29 IA__g_signal_emit_valist
at gsignal.c line 2977
#30 IA__g_signal_emit
at gsignal.c line 3034
#31 IA__gtk_widget_size_allocate
at gtkwidget.c line 3877
#32 gtk_box_size_allocate
at gtkbox.c line 500
#33 IA__g_cclosure_marshal_VOID__BOXED
at gmarshal.c line 566
#34 g_type_class_meta_marshal
at gclosure.c line 878
#35 IA__g_closure_invoke
at gclosure.c line 767
#36 signal_emit_unlocked_R
at gsignal.c line 3174
#37 IA__g_signal_emit_valist
at gsignal.c line 2977
#38 IA__g_signal_emit
at gsignal.c line 3034
#39 IA__gtk_widget_size_allocate
at gtkwidget.c line 3877
#40 gtk_window_size_allocate
at gtkwindow.c line 4887
#41 IA__g_cclosure_marshal_VOID__BOXED
at gmarshal.c line 566
#42 g_type_class_meta_marshal
at gclosure.c line 878
#43 IA__g_closure_invoke
at gclosure.c line 767
#44 signal_emit_unlocked_R
at gsignal.c line 3174
#45 IA__g_signal_emit_valist
at gsignal.c line 2977
#46 IA__g_signal_emit
at gsignal.c line 3034
#47 IA__gtk_widget_size_allocate
at gtkwidget.c line 3877
#48 IA__gtk_container_resize_children
#49 gtk_window_move_resize
at gtkwindow.c line 6291
#50 gtk_window_check_resize
at gtkwindow.c line 5304
#51 IA__g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#52 g_type_class_meta_marshal
at gclosure.c line 878
#53 IA__g_closure_invoke
at gclosure.c line 767
#54 signal_emit_unlocked_R
at gsignal.c line 3282
#55 IA__g_signal_emit_valist
at gsignal.c line 2977
#56 IA__g_signal_emit
at gsignal.c line 3034
#57 IA__gtk_container_check_resize
at gtkcontainer.c line 1388
#58 gtk_container_idle_sizer
at gtkcontainer.c line 1314
#59 gdk_threads_dispatch
at gdk.c line 474
#60 g_idle_dispatch
at gmain.c line 3924
#61 g_main_dispatch
at gmain.c line 1814
#62 IA__g_main_context_dispatch
at gmain.c line 2367
#63 g_main_context_iterate
at gmain.c line 2448
#64 IA__g_main_loop_run
at gmain.c line 2656
#65 IA__gtk_main
at gtkmain.c line 1200
#66 main

Comment 5 Li Yuan 2008-12-05 06:56:22 UTC

Probably because the treeview in GUI has been refreshed and our cache need to be update.

Comment 6 Li Yuan 2008-12-12 06:02:43 UTC

Turns out this is a multi-thread issue. gail_cell_add_state sometime emits a signal to at-spi-registryd and causes the thread is scheduled. So clean_cell_info get no chance to complete its job.

Comment 7 Li Yuan 2008-12-12 06:05:34 UTC

Created attachment 124488 [details] [review]
patch

Comment 8 Li Yuan 2008-12-12 06:12:49 UTC

2008-12-12  Li Yuan  <li.yuan@sun.com>

        * gailtreeview.c: Bug #512743.
        (gail_tree_view_changed_gtk): Clean cell before go through the info
        list, for "changed" signal could come before a "row-deleted".
        (clean_cell_info):
        Prevent the thread to be scheduled before clean_cell_info
        finish its job.