After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 710751 - Invalid read in toolbar_content_remove
Invalid read in toolbar_content_remove
Status: RESOLVED OBSOLETE
Product: eog
Classification: Core
Component: image viewer
3.8.x
Other Linux
: Normal normal
: ---
Assigned To: EOG Maintainers
EOG Maintainers
Depends on:
Blocks:
 
 
Reported: 2013-10-23 19:38 UTC by Sebastien Bacher
Modified: 2015-03-27 22:33 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Sebastien Bacher 2013-10-23 19:38:46 UTC
Using eog 3.8.2, going to edit->toolbar and doing an icon dnd from the dialog to the eog main window is enough to trigger those valgrind errors

==21269== Invalid read of size 4
==21269==    at 0x4ECF217: g_type_check_instance (gtype.c:4080)
==21269==    by 0x4EC43BC: g_signal_handlers_disconnect_matched (gsignal.c:2878)
==21269==    by 0x46A9096: toolbar_content_remove (gtktoolbar.c:3315)
==21269==    by 0x46A9487: gtk_toolbar_stop_sliding (gtktoolbar.c:1389)
==21269==    by 0x46A9DA3: toolbar_content_new_tool_item (gtktoolbar.c:3297)
==21269==    by 0x809E9D2: item_added_cb (egg-editable-toolbar.c:1247)
==21269==    by 0x80A3A54: _egg_marshal_VOID__INT_INT (eggmarshalers.c:93)
==21269==    by 0x4EAB8AD: g_closure_invoke (gclosure.c:777)
==21269==    by 0x4EBDDF8: signal_emit_unlocked_R (gsignal.c:3586)
==21269==    by 0x4EC5752: g_signal_emit_valist (gsignal.c:3330)
==21269==    by 0x4EC59E2: g_signal_emit (gsignal.c:3386)
==21269==    by 0x80A0AE0: impl_add_item (egg-toolbars-model.c:425)
==21269==    by 0x80A1566: egg_toolbars_model_add_item (egg-toolbars-model.c:438)
==21269==    by 0x809DE2F: toolbar_drag_data_received_cb (egg-editable-toolbar.c:737)
==21269==    by 0x45CB2E9: _gtk_marshal_VOID__OBJECT_INT_INT_BOXED_UINT_UINT (gtkmarshalers.c:5276)
==21269==    by 0x4EAB8AD: g_closure_invoke (gclosure.c:777)
==21269==    by 0x4EBDDF8: signal_emit_unlocked_R (gsignal.c:3586)
==21269==    by 0x4EC5752: g_signal_emit_valist (gsignal.c:3330)
==21269==    by 0x4EC5EA0: g_signal_emit_by_name (gsignal.c:3426)
==21269==    by 0x4729D17: gtk_drag_selection_received (gtkdnd.c:1922)
==21269==    by 0x45C8F74: _gtk_marshal_VOID__BOXED_UINT (gtkmarshalers.c:3268)
==21269==    by 0x4EAB8AD: g_closure_invoke (gclosure.c:777)
==21269==    by 0x4EBDDF8: signal_emit_unlocked_R (gsignal.c:3586)
==21269==    by 0x4EC5752: g_signal_emit_valist (gsignal.c:3330)
==21269==    by 0x4EC5EA0: g_signal_emit_by_name (gsignal.c:3426)
==21269==    by 0x46395ED: gtk_selection_retrieval_report (gtkselection.c:2983)
==21269==    by 0x463B38B: gtk_selection_convert (gtkselection.c:1114)
==21269==    by 0x4729942: gtk_drag_get_data (gtkdnd.c:1135)
==21269==    by 0x809CFD0: toolbar_drag_drop_cb (egg-editable-toolbar.c:762)
==21269==    by 0x45C5D42: _gtk_marshal_BOOLEAN__OBJECT_INT_INT_UINT (gtkmarshalers.c:808)
==21269==    by 0x4EAB8AD: g_closure_invoke (gclosure.c:777)
==21269==    by 0x4EBDDF8: signal_emit_unlocked_R (gsignal.c:3586)
==21269==    by 0x4EC547E: g_signal_emit_valist (gsignal.c:3340)
==21269==    by 0x4EC5EA0: g_signal_emit_by_name (gsignal.c:3426)
==21269==    by 0x472B9AA: gtk_drag_dest_drop (gtkdnd.c:2426)
==21269==    by 0x472B5EC: _gtk_drag_dest_handle_event (gtkdnd.c:2004)
==21269==    by 0x45C4C0B: gtk_main_do_event (gtkmain.c:1745)
==21269==    by 0x496626B: _gdk_event_emit (gdkevents.c:69)
==21269==    by 0x49923A1: gdk_event_source_dispatch (gdkeventsource.c:364)
==21269==  Address 0x13749880 is 176 bytes inside a block of size 212 free'd
==21269==    at 0x402AC38: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==21269==    by 0x4F3C5CF: g_free (gmem.c:197)
==21269==    by 0x4F530CA: g_slice_free1 (gslice.c:1124)
==21269==    by 0x4ECDB50: g_type_free_instance (gtype.c:1932)
==21269==    by 0x4EB008F: g_object_unref (gobject.c:3210)
==21269==    by 0x4714838: gtk_widget_unparent (gtkwidget.c:4072)
Comment 1 Sebastien Bacher 2013-10-23 19:41:45 UTC
That's likely what causes the segfault reported on https://bugs.launchpad.net/eog/+bug/1208405

"#0  g_type_check_instance (type_instance=type_instance@entry=0x2bb5dc0) at /build/buildd/glib2.0-2.37.3/./gobject/gtype.c:4082
No locals.
  • #1 g_signal_handlers_disconnect_matched
  • #2 toolbar_content_remove
    at /build/buildd/gtk+3.0-3.8.2/./gtk/gtktoolbar.c line 3315
  • #3 gtk_toolbar_stop_sliding
    at /build/buildd/gtk+3.0-3.8.2/./gtk/gtktoolbar.c line 1389
  • #4 toolbar_content_new_tool_item
    at /build/buildd/gtk+3.0-3.8.2/./gtk/gtktoolbar.c line 3297
  • #5 gtk_toolbar_insert
    at /build/buildd/gtk+3.0-3.8.2/./gtk/gtktoolbar.c line 2810
  • #6 item_added_cb
    at egg-editable-toolbar.c line 1247
  • #7 g_closure_invoke
    at /build/buildd/glib2.0-2.37.3/./gobject/gclosure.c line 777
  • #8 signal_emit_unlocked_R
    at /build/buildd/glib2.0-2.37.3/./gobject/gsignal.c line 3582
  • #9 g_signal_emit_valist
    at /build/buildd/glib2.0-2.37.3/./gobject/gsignal.c line 3326

Comment 2 Felix Riemann 2015-03-27 22:33:28 UTC
The (long unmaintained) editable toolbar is gone from eog now (3.16).
---
Thanks for taking the time to report this.
However, you are using a version that is too old and not supported anymore by GNOME developers. GNOME developers are no longer working on that version, so unfortunately there will not be any bug fixes by GNOME developers for the version that you use.

By upgrading to a newer version of GNOME you could receive bug fixes and new functionality. You may need to upgrade your Linux distribution to obtain a newer version of GNOME.

Please feel free to reopen this bug report if the problem still occurs with a recent version of GNOME, or feel free to report this bug in the bug tracking system of your Linux distribution if your distribution still supports the version that you are using.