dconf-editor-0.18.0-2.fc20.x86_64

(This may or may not be the same as the now-closed abrt bug 892740.)

Discovered this while cleaning/rearranging some applet config entries (in particular, renaming from the auto-generated object_NNN to more easily findable names.)

Using the MATE Desktop, though as I understand it dconf is itself non-specific.

1) gsettings set org.mate.panel.object:/org/mate/panel/objects/crash_test/ position 50
2) dconf-editor &
3) [navigate far enough to open /org/mate/panel/objects and make its sub-keys visible by clicking the arrows. There should be a crash_test sub-key visible. But *don't* click on it yet, leave focus where it starts, on /apps, or on any other key.]
4) gsettings reset-recursively org.mate.panel.object:/org/mate/panel/objects/crash_test/
5) [now click on crash_test. dconf-editor immediately segfaults.]

Alternatively, in step (3), do click on crash_test to give it the focus. Now dconf-editor will crash as soon as step (4) is executed.

The same crash occurs when adding those keys "normally", by choosing "Add to Panel..." and "Remove From Panel" from mate-panel rather than using gsettings.

Backtrace is:

#0  key_get_value (self=<optimized out>) at dconf-model.c:1005
#1  0x000000000040be1e in key_get_type_string (self=0x19185f0) at dconf-model.c:925
#2  0x0000000000415f3d in key_value_renderer_set_key (self=0x12aa570, value=<optimized out>) at dconf-view.c:1348
#3  0x0000003008018b81 in object_set_property (nqueue=0x18ed7b0, value=0x7fffd6ea94d0, pspec=0x18b3930, object=0x12aa570) at gobject.c:1366
#4  g_object_set_property (object=object@entry=0x12aa570, property_name=<optimized out>, value=value@entry=0x7fffd6ea94d0) at gobject.c:2328
#5  0x000000301c2e2f47 in apply_cell_attributes (renderer=0x12aa570, info=0x18ba240, data=0x7fffd6ea9570) at gtkcellarea.c:1274
#6  0x0000003004c39310 in g_hash_table_foreach (hash_table=0x18b55e0 = {...}, func=func@entry=0x301c2e2e60 <apply_cell_attributes>, user_data=user_data@entry=0x7fffd6ea9570) at ghash.c:1526
#7  0x000000301c2e2e0b in gtk_cell_area_real_apply_attributes (area=<optimized out>, tree_model=0x19203a0, iter=0x1594060, is_expander=<optimized out>, is_expanded=<optimized out>) at gtkcellarea.c:1310
#8  0x000000301c2e847f in gtk_cell_area_box_apply_attributes (area=<optimized out>, tree_model=<optimized out>, iter=<optimized out>, is_expander=<optimized out>, is_expanded=<optimized out>)
    at gtkcellareabox.c:1310
#9  0x000000301c3b2700 in _gtk_marshal_VOID__OBJECT_BOXED_BOOLEAN_BOOLEANv (closure=0x18b1fb0, return_value=<optimized out>, instance=<optimized out>, args=<optimized out>, 
    marshal_data=0x301c2e8460 <gtk_cell_area_box_apply_attributes>, n_params=<optimized out>, param_types=0x18af2b0) at gtkmarshalers.c:4960
#10 0x00000030080104c7 in _g_closure_invoke_va (closure=closure@entry=0x18b1fb0, return_value=return_value@entry=0x0, instance=instance@entry=0x132ce30, args=args@entry=0x7fffd6ea9820, n_params=4, 
    param_types=0x18af2b0) at gclosure.c:840
#11 0x0000003008029749 in g_signal_emit_valist (instance=0x132ce30, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7fffd6ea9820) at gsignal.c:3238
#12 0x000000300802a3af in g_signal_emit (instance=instance@entry=0x132ce30, signal_id=<optimized out>, detail=detail@entry=0) at gsignal.c:3386
#13 0x000000301c2e4954 in gtk_cell_area_apply_attributes (area=0x132ce30, tree_model=0x19203a0, iter=iter@entry=0x7fffd6ea9ac0, is_expander=0, is_expanded=0) at gtkcellarea.c:2359
#14 0x000000301c4d4739 in gtk_tree_view_column_cell_set_cell_data (tree_column=tree_column@entry=0x18b2260, tree_model=<optimized out>, iter=iter@entry=0x7fffd6ea9ac0, is_expander=<optimized out>, 
    is_expanded=<optimized out>) at gtktreeviewcolumn.c:2862
#15 0x000000301c4bc08f in validate_row (tree_view=tree_view@entry=0x18a67a0, tree=0x17cc740, node=0x1947390, iter=iter@entry=0x7fffd6ea9ac0, path=path@entry=0x18ed550) at gtktreeview.c:6173
#16 0x000000301c4c0c22 in validate_visible_area (tree_view=0x18a67a0) at gtktreeview.c:6388
#17 do_presize_handler (tree_view=0x18a67a0) at gtktreeview.c:6829
#18 0x000000301c4c0d29 in presize_handler_callback (widget=<optimized out>, clock=<optimized out>, unused=<optimized out>) at gtktreeview.c:6858
#19 0x000000301c4e8394 in gtk_widget_on_frame_clock_update (frame_clock=0x131b540, widget=0x18a67a0) at gtkwidget.c:4774
#20 0x00000030080104c7 in _g_closure_invoke_va (closure=closure@entry=0x19463d0, return_value=return_value@entry=0x0, instance=instance@entry=0x131b540, args=args@entry=0x7fffd6ea9dd8, n_params=0, 
    param_types=0x0) at gclosure.c:840
#21 0x0000003008029749 in g_signal_emit_valist (instance=instance@entry=0x131b540, signal_id=signal_id@entry=152, detail=detail@entry=0, var_args=var_args@entry=0x7fffd6ea9dd8) at gsignal.c:3238
#22 0x000000300802a8f8 in g_signal_emit_by_name (instance=instance@entry=0x131b540, detailed_signal=detailed_signal@entry=0x301a08b4ec "update") at gsignal.c:3426
#23 0x000000301a02df54 in gdk_frame_clock_paint_idle (data=0x131b540) at gdkframeclockidle.c:380
#24 0x000000301a020328 in gdk_threads_dispatch (data=0x181a5a0, data@entry=<error reading variable: value has been optimized out>) at gdk.c:804
#25 0x0000003004c49e43 in g_timeout_dispatch (source=source@entry=0x1937a50, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4451
#26 0x0000003004c492a6 in g_main_dispatch (context=0x12a7130) at gmain.c:3066
#27 g_main_context_dispatch (context=context@entry=0x12a7130) at gmain.c:3642
#28 0x0000003004c49628 in g_main_context_iterate (context=context@entry=0x12a7130, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3713
#29 0x0000003004c496dc in g_main_context_iteration (context=0x12a7130, context@entry=0x0, may_block=may_block@entry=1) at gmain.c:3774
#30 0x000000300a49c954 in g_application_run (application=application@entry=0x12a2160, argc=argc@entry=1, argv=argv@entry=0x7fffd6eaa218) at gapplication.c:1635
#31 0x000000000040a405 in configuration_editor_main (args=0x7fffd6eaa218, args_length1=1) at dconf-editor.c:2020
#32 0x0000003000821d65 in __libc_start_main (main=0x407930 <main>, argc=1, argv=0x7fffd6eaa218, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffd6eaa208)
    at libc-start.c:285
#33 0x0000000000407985 in _start ()