Bug 736599 – Regression: Nautilus crashes reliably when used with Orca

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 736599 - Regression: Nautilus crashes reliably when used with Orca


Summary:	Regression: Nautilus crashes reliably when used with Orca


Status:	RESOLVED FIXED

Product:	nautilus
Classification:	Core
Component:	Crashers
Version:	3.13.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	Nautilus Maintainers
QA Contact:	Nautilus Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2014-09-13 02:20 UTC by Joanmarie Diggs (IRC: joanie)
Modified:	2014-09-13 04:12 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Joanmarie Diggs (IRC: joanie) 2014-09-13 02:20:14 UTC

Steps to reproduce:
1. Launch the attached accessible event listener in a terminal
2. Launch nautilus
3. Arrow in icon view to change the selected item

Expected result: Nautilus would not crash
Actual result: Nautilus reliably crashes. See below.

Git bisect says:

  ecc8fdbca6acb446ffa89a6fea31616b77a4224a is the first bad commit
  commit ecc8fdbca6acb446ffa89a6fea31616b77a4224a
  Author: Cosimo Cecchi <cosimoc@gnome.org>
  Date:   Sat Aug 30 18:43:41 2014 -0700

      canvas-container: remove duplicated code



$ ./selection.py &
$ gdb nautilus

object:selection-changed(0, 0, 0)
	source: [table | ]
	host_application: [application | nautilus]
nSelectedChildren: 1
0. [table cell | ]

object:selection-changed(0, 0, 0)
	source: [layered pane | Icon View]
	host_application: [application | nautilus]
nSelectedChildren: 1

Program received signal SIGSEGV, Segmentation fault.
g_type_check_instance_cast (type_instance=0x2, iface_type=iface_type@entry=80) at gtype.c:4008
4008	      if (type_instance->g_class)

(gdb) bt

+ Trace 234088

#0 g_type_check_instance_cast
at gtype.c line 4008
#1 nautilus_canvas_container_accessible_ref_selection
at nautilus-canvas-container.c line 7787
#2 impl_GetSelectedChild
at selection-adaptor.c line 69
#3 handle_other
at droute.c line 553
#4 handle_message
at droute.c line 600
#5 _dbus_object_tree_dispatch_and_unlock
from /lib64/libdbus-1.so.3
#6 dbus_connection_dispatch
from /lib64/libdbus-1.so.3
#7 message_queue_dispatch
at atspi-gmain.c line 89
#8 g_main_dispatch
at gmain.c line 3064
#9 g_main_context_dispatch
at gmain.c line 3663
#10 g_main_context_iterate
at gmain.c line 3734
#11 g_main_context_iteration
at gmain.c line 3795
#12 g_application_run
at gapplication.c line 2282
#13 main
at nautilus-main.c line 103

Comment 1 Cosimo Cecchi 2014-09-13 03:25:42 UTC

Thanks for the report, I just pushed a fix for this to git master.

Comment 2 Joanmarie Diggs (IRC: joanie) 2014-09-13 04:12:47 UTC

Thanks for the quick (and verified) fix. :)