Bug 789733

Summary: [gtk themes] nm-applet crashes in KDE with oxygen-gtk theme (SIGSEGV)
Product: [Fedora] Fedora Reporter: carasin <carasin.berlogue>
Component: gtk3Assignee: Matthias Clasen <mclasen>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: dcbw, jklimes, mclasen, me, rdieter
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Unspecified   
Whiteboard: abrt_hash:f5398bf98c488dca3c96808e3f2d22ca5d56f728
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-20 15:52:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: event_log
none
File: pwd
none
File: backtrace
none
File: smolt_data
none
File: maps
none
File: dso_list none

Description carasin 2012-02-12 18:52:36 UTC
libreport version: 2.0.8
abrt_version:   2.0.7
backtrace_rating: 4
cmdline:        /usr/bin/nm-applet
crash_function: _gtk_style_context_coalesce_animation_areas
executable:     /usr/bin/nm-applet
kernel:         3.2.5-3.fc16.i686
pid:            2626
reason:         Process /usr/bin/nm-applet was killed by signal 11 (SIGSEGV)
time:           Вс. 12 февр. 2012 22:42:18
uid:            1000
username:       carasin

backtrace:      Text file, 52447 bytes
dso_list:       Text file, 7751 bytes
event_log:      Binary file, 1736 bytes
maps:           Text file, 23449 bytes
pwd:            Binary file, 32 bytes
smolt_data:     Binary file, 3518 bytes

comment:
:1. # yum install oxygen-gtk3
:2. $ mkdir ~/.config/gtk-3.0
:3. $ echo '[Settings]' > ~/.config/gtk-3.0/settings.ini
:4. $ echo 'gtk-theme-name = oxygen-gtk' >> ~/.config/gtk-3.0/settings.ini
:5. relogin to KDE 4
:6. $ nm-applet
:7. left click on the nm-applet icon (in the system tray) --> "Connect to Hidden Wireless Network..."
:8. nm-applet crashes with the following error:
:
:** (nm-applet:2512): CRITICAL **: nm_connection_need_secrets: assertion `connection != NULL' failed
:
:(nm-applet:2512): Gtk-CRITICAL **: gtk_widget_get_style_context: assertion `GTK_IS_WIDGET (widget)' failed
:Segmentation Fault (core dumped)

environ:
:XDG_VTNR=1
:SSH_AGENT_PID=1451
:XDG_SESSION_ID=1
:DM_CONTROL=/var/run/xdmctl
:HOSTNAME=berlogue
:IMSETTINGS_INTEGRATE_DESKTOP=yes
:XDG_MENU_PREFIX=kde4-
:SHELL=/bin/bash
:TERM=dumb
:XDG_SESSION_COOKIE=0162297b0ec7b2178fd952b20000000c-1329036634.395468-47916127
:XDM_MANAGED=method=classic
:HISTSIZE=1000
:GTK2_RC_FILES=/etc/gtk-2.0/gtkrc:/home/carasin/.gtkrc-2.0:/home/carasin/.gtkrc-2.0-kde4:/home/carasin/.kde/share/config/gtkrc-2.0
:GS_LIB=
:LD_PRELOAD=/usr/lib/freetype-infinality/libfreetype.so.6.8.0:
:KDE_FULL_SESSION=true
:'IMSETTINGS_MODULE=X compose table'
:USER=carasin
:SSH_AUTH_SOCK=/tmp/ssh-iQJQlENe1302/agent.1302
:DESKTOP_SESSION=kde-plasma
:PATH=/usr/lib/ccache:/usr/local/bin:/usr/bin:/bin:/usr/games:/usr/local/sbin:/usr/sbin:/sbin:/home/carasin/.local/bin:/home/carasin/bin
:MAIL=/var/spool/mail/carasin
:QT_IM_MODULE=xim
:PWD=/home/carasin
:XMODIFIERS=@im=none
:KDE_SESSION_UID=1000
:LANG=ru_RU.UTF-8
:KDE_IS_PRELINKED=1
:KDEDIRS=/usr
:SSH_ASKPASS=/usr/bin/ksshaskpass
:HISTCONTROL=ignoredups
:SHLVL=2
:XDG_SEAT=seat0
:HOME=/home/carasin
:KDE_SESSION_VERSION=4
:XCURSOR_THEME=Oxygen_White
:LOGNAME=carasin
:CVS_RSH=ssh
:XDG_DATA_DIRS=/usr/share/kde-settings/kde-profile/default/share:/usr/local/share:/usr/share
:DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-a0djwtEfA8,guid=8aece977fa3b0a9648e9f9d90000002e
:'LESSOPEN=||/usr/bin/lesspipe.sh %s'
:WINDOWPATH=1
:XDG_RUNTIME_DIR=/run/user/carasin
:DISPLAY=:0
:QT_PLUGIN_PATH=/home/carasin/.kde/lib/kde4/plugins/:/usr/lib/kde4/plugins/
:GTK_IM_MODULE=xim
:XAUTHORITY=/tmp/kde-carasin/xauth-1000-_0
:CCACHE_HASHDIR=
:_=/usr/libexec/kde4/start_kdeinit_wrapper
:KDE_MULTIHEAD=false
:SESSION_MANAGER=local/unix:@/tmp/.ICE-unix/1577,unix/unix:/tmp/.ICE-unix/1577
:GTK_RC_FILES=/etc/gtk/gtkrc:/home/carasin/.gtkrc:/home/carasin/.kde/share/config/gtkrc
:LANGUAGE=
:CUR_WIDTH=0
:DESKTOP_STARTUP_ID=berlogue;1329037960;907285;1615_TIME1372578

gconf_subtree:
: disable-disconnected-notifications = true
: suppress-wireless-networks-available = true
: disable-connected-notifications = true
: stamp = 3
: disable-wifi-create = false

var_log_messages:
:Feb 12 22:42:18 berlogue kernel: [35524.171451] nm-applet[2626]: segfault at c ip 4fe8e507 sp bfacdb70 error 4 in libgtk-3.so.0.200.3[4fca7000+475000]
:Feb 12 22:42:18 berlogue abrt[12619]: Saved core dump of pid 2626 (/usr/bin/nm-applet) to /var/spool/abrt/ccpp-2012-02-12-22:42:18-2626 (42467328 bytes)

xsession_errors:
:** (nm-applet:1682): CRITICAL **: nm_connection_need_secrets: assertion `connection != NULL' failed
:(nm-applet:1682): Gtk-CRITICAL **: gtk_widget_get_style_context: assertion `GTK_IS_WIDGET (widget)' failed
:** (nm-applet:2293): CRITICAL **: nm_connection_need_secrets: assertion `connection != NULL' failed
:(nm-applet:2293): Gtk-CRITICAL **: gtk_widget_get_style_context: assertion `GTK_IS_WIDGET (widget)' failed
:Applet::itemPositionChanged: trying to move non-existant task: file:///home/carasin/nm-applet-error-abrt.log — Krusader
:Applet::itemPositionChanged: trying to move non-existant task: nm-applet-error-abrt.log — KWrite
:Applet::itemPositionChanged: trying to move non-existant task: file:///home/carasin/nm-applet-error-abrt.log — Krusader
:Applet::itemPositionChanged: trying to move non-existant task: nm-applet-error-abrt_1.log — KWrite
:Opera(2410)/kio (KDirModel) KDirModelPrivate::_k_slotDeleteItems: No node found for item that was just removed: KUrl("file:///home/carasin/nm-applet-error-abrt.log") 
:** (nm-applet:2626): CRITICAL **: nm_connection_need_secrets: assertion `connection != NULL' failed
:(nm-applet:2626): Gtk-CRITICAL **: gtk_widget_get_style_context: assertion `GTK_IS_WIDGET (widget)' failed
:Applet::itemPositionChanged: trying to move non-existant task: Process /usr/bin/nm-applet was killed by signal 11 (SIGSEGV) - abrt-applet
:Applet::itemPositionChanged: trying to move non-existant task: file:///home/carasin/nm-applet-error-abrt.log — Krusader

Comment 1 carasin 2012-02-12 18:52:40 UTC
Created attachment 561246 [details]
File: event_log

Comment 2 carasin 2012-02-12 18:52:42 UTC
Created attachment 561247 [details]
File: pwd

Comment 3 carasin 2012-02-12 18:52:45 UTC
Created attachment 561248 [details]
File: backtrace

Comment 4 carasin 2012-02-12 18:52:47 UTC
Created attachment 561249 [details]
File: smolt_data

Comment 5 carasin 2012-02-12 18:52:49 UTC
Created attachment 561250 [details]
File: maps

Comment 6 carasin 2012-02-12 18:52:51 UTC
Created attachment 561251 [details]
File: dso_list

Comment 7 Alexei Panov 2012-02-12 19:05:00 UTC
I be want to say additional information.
This bug is affected only if nm-applet used in KDE.
In gnome, xfce this bug is not affected.

Comment 8 carasin 2012-02-12 19:17:26 UTC
I would not be so sure. Perhaps, it should be tested in different DE with GTK3 theme Oxygen-GTK3,- for example, in XFCE & GNOME 3. It seems to me that trouble is in the missing icon files somewhere at the path /usr/share/icons/*

Comment 9 carasin 2012-02-12 19:22:40 UTC
I would not be so sure. Perhaps, it should be tested in different DE with GTK3 theme Oxygen-GTK3,- for example, in XFCE & GNOME 3. It seems to me that trouble is in the missing icon files somewhere at the path /usr/share/icons/*

Comment 10 Jirka Klimes 2012-02-14 15:42:43 UTC
carasin, thanks for the reproducer in the description!

I am able to reproduce the crash under KDE with your steps. Reloading of KDE is not necessary, just editing ~/.config/gtk-3.0/settings.ini and starting
nm-applet:
1. yum install oxygen-gtk3
2. put
[Settings]
gtk-theme-name = oxygen-gtk
  into ~/.config/gtk-3.0/settings.ini
3. nm-applet
4. left click on the nm-applet icon (in the system tray) --> "Connect to
Hidden Wireless Network..."
5. nm-applet crashes

I've run the applet in gdb and found that the crash happens in gtkwidget.c:_gtk_widget_draw_internal().

Last two lines there are:
1) context = gtk_widget_get_style_context (widget);
2) _gtk_style_context_coalesce_animation_areas (context, widget);
But (1) return NULL and (2) crashes trying to access it.

The NULL is returned because the 'widget' has been freed before in g_emit_signal():
(gdb) s
_gtk_widget_draw_internal (clip_to_size=1, cr=0x3c1f8a7860, widget=0x10307e0 [GtkToggleButton]) at gtkwidget.c:5722
5722          g_signal_emit (widget, widget_signals[DRAW],
(gdb) p widget
$1 = 0x10307e0 [GtkToggleButton]
(gdb) p *widget
$2 = {parent_instance = {g_type_instance = {g_class = 0x1048c10}, ref_count = 2, qdata = 0x0}, priv = 0x1030820}
(gdb) watch *0x10307e0
Hardware watchpoint 4: *0x10307e0
(gdb) c
Continuing.
[Thread 0x7fffba7fc700 (LWP 16816) exited]
Hardware watchpoint 4: *0x10307e0

Old value = 17075216
New value = 0
g_type_free_instance (instance=0x10307e0) at gtype.c:1935
1935      memset (instance, 0xaa, type_total_instance_size_I (node));
(gdb) bt
#0  g_type_free_instance (instance=0x10307e0) at gtype.c:1935
#1  0x00000032322319d3 in g_value_unset (value=0x7fffbc004730) at gvalue.c:276
#2  0x00000032322261cb in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=<optimized out>) at gsignal.c:3063
#3  0x0000003232226352 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3090
#4  0x00000030a268e1da in _gtk_widget_draw_internal (clip_to_size=1, cr=0x3c1f8a7860, widget=0x10307e0) at gtkwidget.c:5722
#5  _gtk_widget_draw_internal (widget=0x10307e0, cr=0x3c1f8a7860, clip_to_size=<optimized out>) at gtkwidget.c:5698
#6  0x00000030a24ce62e in gtk_container_propagate_draw (container=<optimized out>, child=0x10307e0, cr=0x3c1f8a7860) at gtkcontainer.c:3342
#7  0x00000030a24c321f in gtk_combo_box_draw (widget=0x10432e0 [GtkComboBox], cr=0x3c1f8a7860) at gtkcombobox.c:2772
#8  0x00000030a2552848 in _gtk_marshal_BOOLEAN__BOXED (closure=0x67afd0, return_value=0x7fffffffbba0, n_param_values=<optimized out>, param_values=0x164b320, invocation_hint=<optimized out>, 
    marshal_data=<optimized out>) at gtkmarshalers.c:85
#9  0x00000030a267ca60 in gtk_widget_draw_marshaller (closure=0x67afd0, return_value=0x7fffffffbba0, n_param_values=2, param_values=0x164b320, invocation_hint=<optimized out>, marshal_data=<optimized out>)
    at gtkwidget.c:819

I'm not sure why the widget is freed, but it definitely depends on the oxygen theme. Having searched further, I discovered that line
-GtkComboBox-appears-as-list: 1;
in /usr/share/themes/oxygen-gtk/gtk-3.0/gtk.css causes the problem. If the line is removed or the value is changed to 0, the crash doesn't appear.

So, either there is a bug in glib/gtk theming or rather oxygen theme is at fault.

Some links:
https://projects.kde.org/projects/playground/artwork/oxygen-gtk/repository
https://bugs.kde.org/show_bug.cgi?id=261971

similar bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=749768
https://bugzilla.redhat.com/show_bug.cgi?id=706461

I'm moving the bug to gtk3 so that someone with the knowledge could look at the problem.

Comment 11 carasin 2012-02-14 19:01:41 UTC
Jirka Klimes, thanks for your work and workaround.

Awaiting the further solution to this problem.

Comment 12 abrt-bot 2012-03-20 15:52:15 UTC
Backtrace analysis found this bug to be similar to bug #799637, closing as duplicate.

This comment is automatically generated.

*** This bug has been marked as a duplicate of bug 799637 ***