GNOME Bugzilla – Bug 672381
invalid uninstantiatable type `<invalid>' in cast to `FolksIndividual'
Last modified: 2012-03-19 13:44:48 UTC
I was trying to reproduce bug #670523 with folks master + the patch from https://bugzilla.gnome.org/show_bug.cgi?id=670523#c7: - Start empathy and empathy-chat - Send a message to a contact - Disconnect and reconnect the CM used to send the message - empathy-chat crashed GLib-GObject-WARNING **: invalid uninstantiatable type `<invalid>' in cast to `FolksIndividual'
+ Trace 229911
arg_data = 0x0, description = 0x0, arg_description = 0x0}} debug_sender = 0x829720 error = 0x0 presence_mgr = 0x82c0b0 theme_mgr = 0x745640 retval = 0 individual_mgr = 0x7119c0 __PRETTY_FUNCTION__ = "main"
I reproduced it in valgrind: ==15182== Invalid read of size 8 ==15182== at 0x703C0D8: g_type_check_instance_cast (gtype.c:3994) ==15182== by 0x537EA55: folks_persona_get_individual (persona.vala:154) ==15182== by 0x53611B7: _folks_individual_disconnect_from_persona (individual.vala:1625) ==15182== by 0x5364A14: _folks_individual_set_personas (individual.vala:1969) ==15182== by 0x536633A: folks_individual_set_personas (individual.vala:799) ==15182== by 0x53727AE: _folks_individual_aggregator_personas_changed_cb (individual-aggregator.vala:1345) ==15182== by 0x536C69A: __folks_individual_aggregator_personas_changed_cb_folks_persona_store_personas_changed (individual-aggregator.vala:758) ==15182== by 0x5380621: g_cclosure_user_marshal_VOID__OBJECT_OBJECT_STRING_OBJECT_ENUM (persona-store.vala:281) ==15182== by 0x7015F0F: g_closure_invoke (gclosure.c:777) ==15182== by 0x7033567: signal_emit_unlocked_R (gsignal.c:3547) ==15182== by 0x70327BB: g_signal_emit_valist (gsignal.c:3295) ==15182== by 0x7032E8C: g_signal_emit_by_name (gsignal.c:3389) ==15182== by 0x537F9CC: _folks_persona_store_emit_personas_changed (persona-store.vala:395) ==15182== by 0x50FBFF7: _tpf_persona_store_notify_connection_cb (tpf-persona-store.vala:862) ==15182== by 0x50F9E1D: __tpf_persona_store_notify_connection_cb_g_object_notify (tpf-persona-store.vala:641) ==15182== by 0x701A46C: g_cclosure_marshal_VOID__PARAM (gmarshal.c:1042) ==15182== by 0x7015F0F: g_closure_invoke (gclosure.c:777) ==15182== by 0x7033567: signal_emit_unlocked_R (gsignal.c:3547) ==15182== by 0x70327BB: g_signal_emit_valist (gsignal.c:3295) ==15182== by 0x7032D2E: g_signal_emit (gsignal.c:3352) ==15182== Address 0x19cb8a30 is 0 bytes inside a block of size 320 free'd ==15182== at 0x4A0662E: free (vg_replace_malloc.c:366) ==15182== by 0x72BB782: standard_free (gmem.c:98) ==15182== by 0x72BB92B: g_free (gmem.c:252) ==15182== by 0x72D32EA: g_slice_free1 (gslice.c:1111) ==15182== by 0x7038584: g_type_free_instance (gtype.c:1937) ==15182== by 0x7022418: g_object_unref (gobject.c:3031) ==15182== by 0x44DAC3: dispose (empathy-individual-menu.c:881) ==15182== by 0x70222AB: g_object_unref (gobject.c:2981) ==15182== by 0x5FFE33F: gtk_menu_detach (gtkmenu.c:1299) ==15182== by 0x600DC57: gtk_menu_item_set_submenu (gtkmenuitem.c:1228) ==15182== by 0x430AC3: chat_window_contact_menu_update (empathy-chat-window.c:593) ==15182== by 0x431014: chat_window_update (empathy-chat-window.c:774) ==15182== by 0x4317B2: chat_window_update_chat_tab_full (empathy-chat-window.c:964) ==15182== by 0x4317E0: chat_window_update_chat_tab (empathy-chat-window.c:973) ==15182== by 0x4318DB: chat_window_chat_notify_cb (empathy-chat-window.c:1005) ==15182== by 0x701A46C: g_cclosure_marshal_VOID__PARAM (gmarshal.c:1042) ==15182== by 0x7015F0F: g_closure_invoke (gclosure.c:777) ==15182== by 0x7033567: signal_emit_unlocked_R (gsignal.c:3547) ==15182== by 0x70327BB: g_signal_emit_valist (gsignal.c:3295) ==15182== by 0x7032D2E: g_signal_emit (gsignal.c:3352) ==15182== GLib-GObject-WARNING **: invalid unclassed pointer in cast to `FolksIndividual' ==15182== Invalid read of size 8 ==15182== at 0x53662CE: folks_individual_get_personas (individual.vala:798) ==15182== by 0x537EA5D: folks_persona_get_individual (persona.vala:154) ==15182== by 0x53611B7: _folks_individual_disconnect_from_persona (individual.vala:1625) ==15182== by 0x5364A14: _folks_individual_set_personas (individual.vala:1969) ==15182== by 0x536633A: folks_individual_set_personas (individual.vala:799) ==15182== by 0x53727AE: _folks_individual_aggregator_personas_changed_cb (individual-aggregator.vala:1345) ==15182== by 0x536C69A: __folks_individual_aggregator_personas_changed_cb_folks_persona_store_personas_changed (individual-aggregator.vala:758) ==15182== by 0x5380621: g_cclosure_user_marshal_VOID__OBJECT_OBJECT_STRING_OBJECT_ENUM (persona-store.vala:281) ==15182== by 0x7015F0F: g_closure_invoke (gclosure.c:777) ==15182== by 0x7033567: signal_emit_unlocked_R (gsignal.c:3547) ==15182== by 0x70327BB: g_signal_emit_valist (gsignal.c:3295) ==15182== by 0x7032E8C: g_signal_emit_by_name (gsignal.c:3389) ==15182== by 0x537F9CC: _folks_persona_store_emit_personas_changed (persona-store.vala:395) ==15182== by 0x50FBFF7: _tpf_persona_store_notify_connection_cb (tpf-persona-store.vala:862) ==15182== by 0x50F9E1D: __tpf_persona_store_notify_connection_cb_g_object_notify (tpf-persona-store.vala:641) ==15182== by 0x701A46C: g_cclosure_marshal_VOID__PARAM (gmarshal.c:1042) ==15182== by 0x7015F0F: g_closure_invoke (gclosure.c:777) ==15182== by 0x7033567: signal_emit_unlocked_R (gsignal.c:3547) ==15182== by 0x70327BB: g_signal_emit_valist (gsignal.c:3295) ==15182== by 0x7032D2E: g_signal_emit (gsignal.c:3352) ==15182== Address 0x19cb8a48 is 24 bytes inside a block of size 320 free'd ==15182== at 0x4A0662E: free (vg_replace_malloc.c:366) ==15182== by 0x72BB782: standard_free (gmem.c:98) ==15182== by 0x72BB92B: g_free (gmem.c:252) ==15182== by 0x72D32EA: g_slice_free1 (gslice.c:1111) ==15182== by 0x7038584: g_type_free_instance (gtype.c:1937) ==15182== by 0x7022418: g_object_unref (gobject.c:3031) ==15182== by 0x44DAC3: dispose (empathy-individual-menu.c:881) ==15182== by 0x70222AB: g_object_unref (gobject.c:2981) ==15182== by 0x5FFE33F: gtk_menu_detach (gtkmenu.c:1299) ==15182== by 0x600DC57: gtk_menu_item_set_submenu (gtkmenuitem.c:1228) ==15182== by 0x430AC3: chat_window_contact_menu_update (empathy-chat-window.c:593) ==15182== by 0x431014: chat_window_update (empathy-chat-window.c:774) ==15182== by 0x4317B2: chat_window_update_chat_tab_full (empathy-chat-window.c:964) ==15182== by 0x4317E0: chat_window_update_chat_tab (empathy-chat-window.c:973) ==15182== by 0x4318DB: chat_window_chat_notify_cb (empathy-chat-window.c:1005) ==15182== by 0x701A46C: g_cclosure_marshal_VOID__PARAM (gmarshal.c:1042) ==15182== by 0x7015F0F: g_closure_invoke (gclosure.c:777) ==15182== by 0x7033567: signal_emit_unlocked_R (gsignal.c:3547) ==15182== by 0x70327BB: g_signal_emit_valist (gsignal.c:3295) ==15182== by 0x7032D2E: g_signal_emit (gsignal.c:3352) ==15182== ==15182== Invalid read of size 8 ==15182== at 0x53662D2: folks_individual_get_personas (individual.vala:798) ==15182== by 0x537EA5D: folks_persona_get_individual (persona.vala:154) ==15182== by 0x53611B7: _folks_individual_disconnect_from_persona (individual.vala:1625) ==15182== by 0x5364A14: _folks_individual_set_personas (individual.vala:1969) ==15182== by 0x536633A: folks_individual_set_personas (individual.vala:799) ==15182== by 0x53727AE: _folks_individual_aggregator_personas_changed_cb (individual-aggregator.vala:1345) ==15182== by 0x536C69A: __folks_individual_aggregator_personas_changed_cb_folks_persona_store_personas_changed (individual-aggregator.vala:758) ==15182== by 0x5380621: g_cclosure_user_marshal_VOID__OBJECT_OBJECT_STRING_OBJECT_ENUM (persona-store.vala:281) ==15182== by 0x7015F0F: g_closure_invoke (gclosure.c:777) ==15182== by 0x7033567: signal_emit_unlocked_R (gsignal.c:3547) ==15182== by 0x70327BB: g_signal_emit_valist (gsignal.c:3295) ==15182== by 0x7032E8C: g_signal_emit_by_name (gsignal.c:3389) ==15182== by 0x537F9CC: _folks_persona_store_emit_personas_changed (persona-store.vala:395) ==15182== by 0x50FBFF7: _tpf_persona_store_notify_connection_cb (tpf-persona-store.vala:862) ==15182== by 0x50F9E1D: __tpf_persona_store_notify_connection_cb_g_object_notify (tpf-persona-store.vala:641) ==15182== by 0x701A46C: g_cclosure_marshal_VOID__PARAM (gmarshal.c:1042) ==15182== by 0x7015F0F: g_closure_invoke (gclosure.c:777) ==15182== by 0x7033567: signal_emit_unlocked_R (gsignal.c:3547) ==15182== by 0x70327BB: g_signal_emit_valist (gsignal.c:3295) ==15182== by 0x7032D2E: g_signal_emit (gsignal.c:3352) ==15182== Address 0x8 is not stack'd, malloc'd or (recently) free'd
To be more precise, it crashes because persona's self->priv->_individual is pointing to a destroyed individual. The individual is destroyed in dispose (object=0xb667a0) at empathy-individual-menu.c:881 but this menu doesn't seem to steal a reference so that's probably another place which unref a reference it doesn't own. :\
Created attachment 210088 [details] [review] Persona: make sure to NULL-ify the individual when it's destroyed
Review of attachment 210088 [details] [review]: ::: folks/persona.vala @@ +170,3 @@ + if (value != null) + value.weak_ref (this._individual_weak_notify_cb); Needs a corresponding weak_unref() call. Also, please put braces around the body of the if-block (even though it's only one line).
Created attachment 210089 [details] [review] Persona: make sure to NULL-ify the individual when it's destroyed
Review of attachment 210089 [details] [review]: Looks good to me. Please commit to master with the modification below. ::: folks/persona.vala @@ +348,3 @@ + { + this._individual.weak_unref (this._individual_weak_notify_cb); + } Might be tidier to just have this.individual = null here, then all the weak_[ref|unref]() stuff stays inside the individual property.
Created attachment 210091 [details] [review] Persona: make sure to NULL-ify the individual when it's destroyed
Review of attachment 210091 [details] [review]: Make it so!
Attachment 210091 [details] pushed as 11b837a - Persona: make sure to NULL-ify the individual when it's destroyed