Bug 782487

Created attachment 555813 [details]
File: dso_list

Created attachment 555814 [details]
File: build_ids

Created attachment 555815 [details]
File: event_log

Created attachment 555816 [details]
File: maps

Created attachment 555817 [details]
File: backtrace

(In reply to comment #0)
> libreport version: 2.0.8
> abrt_version:   2.0.7
> backtrace_rating: 4
> cmdline:        gimp-2.6
> comment:        I converted a png image in jpeg image with default options

I'm not exactly sure when exactly this bug happens to you, but I guess it's at the time you attempt to save the converted image. Miguel, is this correct?

Anyway, this bug is very similar, if not the same, as bug #716325 for Fedora 15: The backtrace shows that you click a button (presumably "Ok" in the file dialog), and in response to it the file dialog window and its child widgets/components get destroyed:

... GimpFileDialog
==> GtkVBox
==> GtkFileChooserWidget
==> GtkFileChooserDefault
==> GtkVBox
==> GtkTable
==> GtkFileChooserEntry: sets its completion to NULL, original completion unref()ed
==> GtkEntryCompletion
==> GtkTreeView: removes a column
==> GAIL/accessibility: columns_changed() -> get_row_count() -> count_rows()
 => gtk_tree_model_iter_n_children()
 => gtk_tree_model_filter_iter_n_children()
 => gtk_tree_model_filter_build_level()
 => gtk_tree_model_filter_visible()
 => gtk_entry_completion_visible_func()
 => completion_match_func():

    # Tries to pull what I presume should be a file name from the
    # chooser_entry->completion_store tree model which at this point
    # contains garbage:

    ... gtkfilechooserentry.c, line 387 ...
    gtk_tree_model_get (GTK_TREE_MODEL (chooser_entry->completion_store), iter, DISPLAY_NAME_COLUMN, &name, -1);
    ...

    # --> name = 0x156d94 "\215d$\030[\303\215\266"

    # UTF8-normalize the file part of the entry and the name from above
    ... line 410 ...
    norm_file_part = g_utf8_normalize (chooser_entry->file_part, -1, G_NORMALIZE_ALL);
    norm_name = g_utf8_normalize (name, -1, G_NORMALIZE_ALL);
    ...

    # At this point, norm_name is NULL because name is not valid UTF8
    # (norm_file_part is, but I guess that's simply luck -- the ASCII
    # "start of heading" character doesn't look like a valid file name
    # to me) and g_utf8_normalize returns NULL on input which is not
    # valid UTF-8.

    ... line 427 ...
    result = (strncmp (norm_file_part, norm_name, strlen (norm_file_part)) == 0);
    ...
    # This ^^ calls __strncmp_sse4_2("\001", NULL, 1) which crashes
    # because one of the compared strings cannot be dereferenced.

My knowledge about gtk is limited, but I think that one of these ways or a combination of them would avoid crashing:

- don't call the whole accessibility stuff when widgets are destroyed
- catch NULL values that stem from garbage being UTF8-normalized (not sure if this is 100% effective -- the garbage could still be valid UTF8 and I have no idea what happens when the normalized garbage is compared subsequently)
- catch garbage before UTF8-normalization is attempted (how? perhaps rather:)
- explicitly set certain struct members to NULL so functions can check for this value before operating on garbage

Changing component to gtk2 -- Matthias, what do you think?

*** Bug 804338 has been marked as a duplicate of this bug. ***

Backtrace analysis found this bug to be similar to bug #716325, closing as duplicate.

Bugs which were found to be similar to this bug: 
  gimp: bug #804338
  gtk2: bug #716325
  inkscape: bug #806973, bug #807188

This comment is automatically generated.

*** This bug has been marked as a duplicate of bug 716325 ***