Bug 225149

Description of problem:
Since the update to gtk2-2.10.8-1.fc6 the file chooser displays a search
feature. When trying to use it in any give program it craches the whole process.

Version-Release number of selected component (if applicable):
gtk2-2.10.8-1.fc6

How reproducible:
Always

Steps to Reproduce:
1. open evince (for instance)
2. ctrl+O to open the filechoose
3. select Search on the left
4. write something into the search text entry and hit enter
5. crash
  
Actual results:
This is printed on the terminal evince was launched from:

*** glibc detected *** /usr/bin/evince: free(): invalid pointer: 0x09dd3708 ***
======= Backtrace: =========
/lib/libc.so.6[0xcf209d]
/lib/libc.so.6(cfree+0x90)[0xcf56f0]
/lib/libglib-2.0.so.0(g_free+0x31)[0x16c6e1]
/usr/lib/libgtk-x11-2.0.so.0[0x6a1afcc]
/lib/libgobject-2.0.so.0(g_object_unref+0x16c)[0x1ed0dc]
/usr/lib/libgtk-x11-2.0.so.0[0x6a9cae7]
/usr/lib/libgtk-x11-2.0.so.0[0x6aa10bb]
/lib/libgobject-2.0.so.0(g_cclosure_marshal_VOID__VOID+0x49)[0x1f80f9]
/lib/libgobject-2.0.so.0(g_closure_invoke+0x12b)[0x1ead9b]
/lib/libgobject-2.0.so.0[0x1fb433]
/lib/libgobject-2.0.so.0(g_signal_emitv+0x198)[0x1fccb8]
/usr/lib/libgtk-x11-2.0.so.0[0x6a3218b]
/usr/lib/libgtk-x11-2.0.so.0[0x6a32538]
/usr/lib/libgtk-x11-2.0.so.0[0x6a3270b]
/usr/lib/libgtk-x11-2.0.so.0(gtk_bindings_activate_event+0xd9)[0x6a32829]
/usr/lib/libgtk-x11-2.0.so.0[0x6c26808]
/usr/lib/libgtk-x11-2.0.so.0[0x6a8bc99]
/usr/lib/libgtk-x11-2.0.so.0[0x6b06a60]
/lib/libgobject-2.0.so.0[0x1e9589]
/lib/libgobject-2.0.so.0(g_closure_invoke+0x20d)[0x1eae7d]
/lib/libgobject-2.0.so.0[0x1fba83]
/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x68f)[0x1fc71f]
/lib/libgobject-2.0.so.0(g_signal_emit+0x29)[0x1fcb19]
/usr/lib/libgtk-x11-2.0.so.0[0x6c1b508]
/usr/lib/libgtk-x11-2.0.so.0(gtk_propagate_event+0x1ba)[0x6affe6a]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main_do_event+0x317)[0x6b01037]
/usr/lib/libgdk-x11-2.0.so.0[0x649812a]
/lib/libglib-2.0.so.0(g_main_context_dispatch+0x182)[0x165442]
/lib/libglib-2.0.so.0[0x16841f]
/lib/libglib-2.0.so.0(g_main_loop_run+0x1a9)[0x1687c9]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main+0xb4)[0x6b014b4]
/usr/bin/evince[0x807a6c0]
/lib/libc.so.6(__libc_start_main+0xdc)[0xca1f2c]
/usr/bin/evince[0x80574f1]
======= Memory map: ========
00101000-00114000 r-xp 00000000 03:03 426502     /lib/libpthread-2.5.so
00114000-00115000 r-xp 00012000 03:03 426502     /lib/libpthread-2.5.so
00115000-00116000 rwxp 00013000 03:03 426502     /lib/libpthread-2.5.so
00116000-00118000 rwxp 00116000 00:00 0 
00118000-00119000 r-xp 00000000 03:03 1611965   
/usr/lib/gtk-2.0/2.10.0/immodules/im-cedilla.so
00119000-0011a000 rwxp 00000000 03:03 1611965   
/usr/lib/gtk-2.0/2.10.0/immodules/im-cedilla.so
0011a000-0012c000 r-xp 00000000 03:03 1448202    /usr/lib/libz.so.1.2.3
0012c000-0012d000 rwxp 00011000 03:03 1448202    /usr/lib/libz.so.1.2.3
0012f000-00136000 r-xp 00000000 03:03 426503     /lib/librt-2.5.so
00136000-00137000 r-xp 00006000 03:03 426503     /lib/librt-2.5.so
00137000-00138000 rwxp 00007000 03:03 426503     /lib/librt-2.5.so
0013a000-001d7000 r-xp 00000000 03:03 426170     /lib/libglib-2.0.so.0.1200.9
001d7000-001d8000 rwxp 0009d000 03:03 426170     /lib/libglib-2.0.so.0.1200.9
001da000-001df000 r-xp 00000000 03:03 1448193    /usr/lib/libXdmcp.so.6.0.0
001df000-001e0000 rwxp 00004000 03:03 1448193    /usr/lib/libXdmcp.so.6.0.0
001e2000-00220000 r-xp 00000000 03:03 426504     /lib/libgobject-2.0.so.0.1200.9
00220000-00221000 rwxp 0003e000 03:03 426504     /lib/libgobject-2.0.so.0.1200.9
00223000-00232000 r-xp 00000000 03:03 1448210    /usr/lib/libXext.so.6.4.0
00232000-00233000 rwxp 0000e000 03:03 1448210    /usr/lib/libXext.so.6.4.0
00235000-00237000 r-xp 00000000 03:03 426505     /lib/libgmodule-2.0.so.0.1200.9
00237000-00238000 rwxp 00002000 03:03 426505     /lib/libgmodule-2.0.so.0.1200.9
00238000-00239000 r-xp 00000000 03:03 1966286    /usr/lib/gconv/ISO8859-1.so
00239000-0023b000 rwxp 00000000 03:03 1966286    /usr/lib/gconv/ISO8859-1.so
0023b000-0025a000 r-xp 00000000 03:03 426510     /lib/libexpat.so.0.5.0
0025a000-0025c000 rwxp 0001e000 03:03 426510     /lib/libexpat.so.0.5.0
0025e000-00283000 r-xp 00000000 03:03 1448205    /usr/lib/l


Additional info:
Some gdb output:

$ gdb evince
(gdb) r
[ crash, the output above and then: ]
(gdb) thread apply all bt

Thread 2 (Thread -1210672240 (LWP 3021)):
#0  0x00b69402 in __kernel_vsyscall ()
#1  0x0010a1a6 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x0805a6b3 in g_cclosure_marshal_VOID__VOID () at gmarshal.c:56
#3  0x0018329f in g_thread_create_proxy (data=0x9c5bed0) at gthread.c:591
#4  0x001063db in start_thread () from /lib/libpthread.so.0
#5  0x00d5926e in clone () from /lib/libc.so.6

Thread 1 (Thread -1208571216 (LWP 3018)):
#0  0x00b69402 in __kernel_vsyscall ()
#1  0x00cb4d40 in raise () from /lib/libc.so.6
#2  0x00cb6591 in abort () from /lib/libc.so.6
#3  0x00cea33b in __libc_message () from /lib/libc.so.6
#4  0x00cf209d in _int_free () from /lib/libc.so.6
#5  0x00cf56f0 in free () from /lib/libc.so.6
#6  0x0016c6e1 in IA__g_free (mem=0xdc6120) at gmem.c:187
#7  0x06a1afcc in finalize (object=0x9dd36f0) at gtksearchenginesimple.c:80
#8  0x001ed0dc in IA__g_object_unref (_object=0x9dd36f0) at gobject.c:1788
#9  0x06a9cae7 in search_stop_searching (impl=0x9e0c028) at
gtkfilechooserdefault.c:8407
#10 0x06aa10bb in search_entry_activate_cb (entry=0x9cd62a0, data=0x9e0c028)
    at gtkfilechooserdefault.c:8527
#11 0x001f80f9 in IA__g_cclosure_marshal_VOID__VOID (closure=0x9ee5168,
return_value=0xbfb8d408, 
    n_param_values=1, param_values=0x9ed8138, invocation_hint=0xbfb8d2bc,
marshal_data=0x6aa1080)
    at gmarshal.c:77
#12 0x001ead9b in IA__g_closure_invoke (closure=0x9ee5168, return_value=0xbfb8d408, 
    n_param_values=1, param_values=0x9ed8138, invocation_hint=0xbfb8d2bc) at
gclosure.c:490
#13 0x001fb433 in signal_emit_unlocked_R (node=0x9ccd858, detail=0,
instance=0x9cd62a0, 
    emission_return=0xbfb8d408, instance_and_params=0x9ed8138) at gsignal.c:2440
#14 0x001fccb8 in IA__g_signal_emitv (instance_and_params=0x9ed8138,
signal_id=166, detail=0, 
    return_value=0xbfb8d408) at gsignal.c:2111
#15 0x06a3218b in gtk_binding_entry_activate (entry=0x9ccfb20, object=0x9cd62a0)
    at gtkbindings.c:535
#16 0x06a32538 in binding_match_activate (pspec_list=<value optimized out>,
object=0x9cd62a0, 
    path_length=8, path=0x9c64c20 "GtkEntry", path_reversed=0x9ed79e0 "yrtnEktG")
    at gtkbindings.c:955
#17 0x06a3270b in gtk_bindings_activate_list (object=0x9cd62a0,
entries=0x9ed34c8, is_release=0)
    at gtkbindings.c:1089
#18 0x06a32829 in IA__gtk_bindings_activate_event (object=0x9cd62a0,
event=0x9df7648)
    at gtkbindings.c:1166
#19 0x06c26808 in gtk_widget_real_key_press_event (widget=0x9cd62a0,
event=0x9df7648)
    at gtkwidget.c:3659
#20 0x06a8bc99 in gtk_entry_key_press (widget=0x9cd62a0, event=0x9df7648) at
gtkentry.c:2044
#21 0x06b06a60 in _gtk_marshal_BOOLEAN__BOXED (closure=0x9c5a580,
return_value=0xbfb8d6d0, 
    n_param_values=2, param_values=0xbfb8d7ac, invocation_hint=0xbfb8d6bc, 
    marshal_data=0x6a8bc10) at gtkmarshalers.c:84
#22 0x001e9589 in g_type_class_meta_marshal (closure=0x9c5a580,
return_value=0xbfb8d6d0, 
    n_param_values=2, param_values=0xbfb8d7ac, invocation_hint=0xbfb8d6bc,
marshal_data=0xcc)
    at gclosure.c:567
#23 0x001eae7d in IA__g_closure_invoke (closure=0x9c5a580, return_value=0xbfb8d6d0, 
    n_param_values=2, param_values=0xbfb8d7ac, invocation_hint=0xbfb8d6bc) at
gclosure.c:490
#24 0x001fba83 in signal_emit_unlocked_R (node=0x9c5a500, detail=0,
instance=0x9cd62a0, 
    emission_return=0xbfb8d96c, instance_and_params=0xbfb8d7ac) at gsignal.c:2478
#25 0x001fc71f in IA__g_signal_emit_valist (instance=0x9cd62a0, signal_id=58,
detail=0, 
    var_args=<value optimized out>) at gsignal.c:2209
#26 0x001fcb19 in IA__g_signal_emit (instance=0x9cd62a0, signal_id=58, detail=0)
    at gsignal.c:2243
#27 0x06c1b508 in gtk_widget_event_internal (widget=0x9cd62a0, event=0x9df7648)
    at gtkwidget.c:3915
#28 0x06c2b607 in IA__gtk_window_propagate_key_event (window=0x9e07800,
event=0x9df7648)
    at gtkwindow.c:4671
#29 0x06c2e67c in gtk_window_key_press_event (widget=0x9e07800, event=0x9df7648)
    at gtkwindow.c:4701
#30 0x06b06a60 in _gtk_marshal_BOOLEAN__BOXED (closure=0x9c5a580,
return_value=0xbfb8dbf0, 
    n_param_values=2, param_values=0xbfb8dccc, invocation_hint=0xbfb8dbdc, 
    marshal_data=0x6c2e630) at gtkmarshalers.c:84
#31 0x001e9589 in g_type_class_meta_marshal (closure=0x9c5a580,
return_value=0xbfb8dbf0, 
    n_param_values=2, param_values=0xbfb8dccc, invocation_hint=0xbfb8dbdc,
marshal_data=0xcc)
    at gclosure.c:567
#32 0x001ead9b in IA__g_closure_invoke (closure=0x9c5a580, return_value=0xbfb8dbf0, 
    n_param_values=2, param_values=0xbfb8dccc, invocation_hint=0xbfb8dbdc) at
gclosure.c:490
#33 0x001fba83 in signal_emit_unlocked_R (node=0x9c5a500, detail=0,
instance=0x9e07800, 
    emission_return=0xbfb8de8c, instance_and_params=0xbfb8dccc) at gsignal.c:2478
#34 0x001fc71f in IA__g_signal_emit_valist (instance=0x9e07800, signal_id=58,
detail=0, 
    var_args=<value optimized out>) at gsignal.c:2209
---Type <return> to continue, or q <return> to quit---
#35 0x001fcb19 in IA__g_signal_emit (instance=0x9e07800, signal_id=58, detail=0)
    at gsignal.c:2243
#36 0x06c1b508 in gtk_widget_event_internal (widget=0x9e07800, event=0x9df7648)
    at gtkwidget.c:3915
#37 0x06affe6a in IA__gtk_propagate_event (widget=0x9e07800, event=0x9df7648) at
gtkmain.c:2309
#38 0x06b01037 in IA__gtk_main_do_event (event=0x9df7648) at gtkmain.c:1569
#39 0x0649812a in gdk_event_dispatch (source=0x9c4f008, callback=0, user_data=0x0)
    at gdkevents-x11.c:2318
#40 0x00165442 in IA__g_main_context_dispatch (context=0x9c4f050) at gmain.c:2045
#41 0x0016841f in g_main_context_iterate (context=0x9c4f050, block=1,
dispatch=1, self=0x9c31f08)
    at gmain.c:2677
#42 0x001687c9 in IA__g_main_loop_run (loop=0x9dd9480) at gmain.c:2881
#43 0x06b014b4 in IA__gtk_main () at gtkmain.c:1148
#44 0x0807a6c0 in g_cclosure_marshal_VOID__VOID () at gmarshal.c:56
#45 0x00ca1f2c in __libc_start_main () from /lib/libc.so.6
#46 0x080574f1 in g_cclosure_marshal_VOID__VOID () at gmarshal.c:56