Bug 225149 - file chooser search crashes
file chooser search crashes
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: gtk2 (Show other bugs)
6
i386 Linux
medium Severity high
: ---
: ---
Assigned To: Matthias Clasen
:
Depends On:
Blocks: FC6Update 236882
  Show dependency treegraph
 
Reported: 2007-01-29 09:04 EST by Rui Matos
Modified: 2007-11-30 17:11 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-04-17 08:45:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Rui Matos 2007-01-29 09:04:06 EST
Description of problem:
Since the update to gtk2-2.10.8-1.fc6 the file chooser displays a search
feature. When trying to use it in any give program it craches the whole process.

Version-Release number of selected component (if applicable):
gtk2-2.10.8-1.fc6

How reproducible:
Always

Steps to Reproduce:
1. open evince (for instance)
2. ctrl+O to open the filechoose
3. select Search on the left
4. write something into the search text entry and hit enter
5. crash
  
Actual results:
This is printed on the terminal evince was launched from:

*** glibc detected *** /usr/bin/evince: free(): invalid pointer: 0x09dd3708 ***
======= Backtrace: =========
/lib/libc.so.6[0xcf209d]
/lib/libc.so.6(cfree+0x90)[0xcf56f0]
/lib/libglib-2.0.so.0(g_free+0x31)[0x16c6e1]
/usr/lib/libgtk-x11-2.0.so.0[0x6a1afcc]
/lib/libgobject-2.0.so.0(g_object_unref+0x16c)[0x1ed0dc]
/usr/lib/libgtk-x11-2.0.so.0[0x6a9cae7]
/usr/lib/libgtk-x11-2.0.so.0[0x6aa10bb]
/lib/libgobject-2.0.so.0(g_cclosure_marshal_VOID__VOID+0x49)[0x1f80f9]
/lib/libgobject-2.0.so.0(g_closure_invoke+0x12b)[0x1ead9b]
/lib/libgobject-2.0.so.0[0x1fb433]
/lib/libgobject-2.0.so.0(g_signal_emitv+0x198)[0x1fccb8]
/usr/lib/libgtk-x11-2.0.so.0[0x6a3218b]
/usr/lib/libgtk-x11-2.0.so.0[0x6a32538]
/usr/lib/libgtk-x11-2.0.so.0[0x6a3270b]
/usr/lib/libgtk-x11-2.0.so.0(gtk_bindings_activate_event+0xd9)[0x6a32829]
/usr/lib/libgtk-x11-2.0.so.0[0x6c26808]
/usr/lib/libgtk-x11-2.0.so.0[0x6a8bc99]
/usr/lib/libgtk-x11-2.0.so.0[0x6b06a60]
/lib/libgobject-2.0.so.0[0x1e9589]
/lib/libgobject-2.0.so.0(g_closure_invoke+0x20d)[0x1eae7d]
/lib/libgobject-2.0.so.0[0x1fba83]
/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x68f)[0x1fc71f]
/lib/libgobject-2.0.so.0(g_signal_emit+0x29)[0x1fcb19]
/usr/lib/libgtk-x11-2.0.so.0[0x6c1b508]
/usr/lib/libgtk-x11-2.0.so.0(gtk_propagate_event+0x1ba)[0x6affe6a]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main_do_event+0x317)[0x6b01037]
/usr/lib/libgdk-x11-2.0.so.0[0x649812a]
/lib/libglib-2.0.so.0(g_main_context_dispatch+0x182)[0x165442]
/lib/libglib-2.0.so.0[0x16841f]
/lib/libglib-2.0.so.0(g_main_loop_run+0x1a9)[0x1687c9]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main+0xb4)[0x6b014b4]
/usr/bin/evince[0x807a6c0]
/lib/libc.so.6(__libc_start_main+0xdc)[0xca1f2c]
/usr/bin/evince[0x80574f1]
======= Memory map: ========
00101000-00114000 r-xp 00000000 03:03 426502     /lib/libpthread-2.5.so
00114000-00115000 r-xp 00012000 03:03 426502     /lib/libpthread-2.5.so
00115000-00116000 rwxp 00013000 03:03 426502     /lib/libpthread-2.5.so
00116000-00118000 rwxp 00116000 00:00 0 
00118000-00119000 r-xp 00000000 03:03 1611965   
/usr/lib/gtk-2.0/2.10.0/immodules/im-cedilla.so
00119000-0011a000 rwxp 00000000 03:03 1611965   
/usr/lib/gtk-2.0/2.10.0/immodules/im-cedilla.so
0011a000-0012c000 r-xp 00000000 03:03 1448202    /usr/lib/libz.so.1.2.3
0012c000-0012d000 rwxp 00011000 03:03 1448202    /usr/lib/libz.so.1.2.3
0012f000-00136000 r-xp 00000000 03:03 426503     /lib/librt-2.5.so
00136000-00137000 r-xp 00006000 03:03 426503     /lib/librt-2.5.so
00137000-00138000 rwxp 00007000 03:03 426503     /lib/librt-2.5.so
0013a000-001d7000 r-xp 00000000 03:03 426170     /lib/libglib-2.0.so.0.1200.9
001d7000-001d8000 rwxp 0009d000 03:03 426170     /lib/libglib-2.0.so.0.1200.9
001da000-001df000 r-xp 00000000 03:03 1448193    /usr/lib/libXdmcp.so.6.0.0
001df000-001e0000 rwxp 00004000 03:03 1448193    /usr/lib/libXdmcp.so.6.0.0
001e2000-00220000 r-xp 00000000 03:03 426504     /lib/libgobject-2.0.so.0.1200.9
00220000-00221000 rwxp 0003e000 03:03 426504     /lib/libgobject-2.0.so.0.1200.9
00223000-00232000 r-xp 00000000 03:03 1448210    /usr/lib/libXext.so.6.4.0
00232000-00233000 rwxp 0000e000 03:03 1448210    /usr/lib/libXext.so.6.4.0
00235000-00237000 r-xp 00000000 03:03 426505     /lib/libgmodule-2.0.so.0.1200.9
00237000-00238000 rwxp 00002000 03:03 426505     /lib/libgmodule-2.0.so.0.1200.9
00238000-00239000 r-xp 00000000 03:03 1966286    /usr/lib/gconv/ISO8859-1.so
00239000-0023b000 rwxp 00000000 03:03 1966286    /usr/lib/gconv/ISO8859-1.so
0023b000-0025a000 r-xp 00000000 03:03 426510     /lib/libexpat.so.0.5.0
0025a000-0025c000 rwxp 0001e000 03:03 426510     /lib/libexpat.so.0.5.0
0025e000-00283000 r-xp 00000000 03:03 1448205    /usr/lib/l


Additional info:
Some gdb output:

$ gdb evince
(gdb) r
[ crash, the output above and then: ]
(gdb) thread apply all bt

Thread 2 (Thread -1210672240 (LWP 3021)):
#0  0x00b69402 in __kernel_vsyscall ()
#1  0x0010a1a6 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x0805a6b3 in g_cclosure_marshal_VOID__VOID () at gmarshal.c:56
#3  0x0018329f in g_thread_create_proxy (data=0x9c5bed0) at gthread.c:591
#4  0x001063db in start_thread () from /lib/libpthread.so.0
#5  0x00d5926e in clone () from /lib/libc.so.6

Thread 1 (Thread -1208571216 (LWP 3018)):
#0  0x00b69402 in __kernel_vsyscall ()
#1  0x00cb4d40 in raise () from /lib/libc.so.6
#2  0x00cb6591 in abort () from /lib/libc.so.6
#3  0x00cea33b in __libc_message () from /lib/libc.so.6
#4  0x00cf209d in _int_free () from /lib/libc.so.6
#5  0x00cf56f0 in free () from /lib/libc.so.6
#6  0x0016c6e1 in IA__g_free (mem=0xdc6120) at gmem.c:187
#7  0x06a1afcc in finalize (object=0x9dd36f0) at gtksearchenginesimple.c:80
#8  0x001ed0dc in IA__g_object_unref (_object=0x9dd36f0) at gobject.c:1788
#9  0x06a9cae7 in search_stop_searching (impl=0x9e0c028) at
gtkfilechooserdefault.c:8407
#10 0x06aa10bb in search_entry_activate_cb (entry=0x9cd62a0, data=0x9e0c028)
    at gtkfilechooserdefault.c:8527
#11 0x001f80f9 in IA__g_cclosure_marshal_VOID__VOID (closure=0x9ee5168,
return_value=0xbfb8d408, 
    n_param_values=1, param_values=0x9ed8138, invocation_hint=0xbfb8d2bc,
marshal_data=0x6aa1080)
    at gmarshal.c:77
#12 0x001ead9b in IA__g_closure_invoke (closure=0x9ee5168, return_value=0xbfb8d408, 
    n_param_values=1, param_values=0x9ed8138, invocation_hint=0xbfb8d2bc) at
gclosure.c:490
#13 0x001fb433 in signal_emit_unlocked_R (node=0x9ccd858, detail=0,
instance=0x9cd62a0, 
    emission_return=0xbfb8d408, instance_and_params=0x9ed8138) at gsignal.c:2440
#14 0x001fccb8 in IA__g_signal_emitv (instance_and_params=0x9ed8138,
signal_id=166, detail=0, 
    return_value=0xbfb8d408) at gsignal.c:2111
#15 0x06a3218b in gtk_binding_entry_activate (entry=0x9ccfb20, object=0x9cd62a0)
    at gtkbindings.c:535
#16 0x06a32538 in binding_match_activate (pspec_list=<value optimized out>,
object=0x9cd62a0, 
    path_length=8, path=0x9c64c20 "GtkEntry", path_reversed=0x9ed79e0 "yrtnEktG")
    at gtkbindings.c:955
#17 0x06a3270b in gtk_bindings_activate_list (object=0x9cd62a0,
entries=0x9ed34c8, is_release=0)
    at gtkbindings.c:1089
#18 0x06a32829 in IA__gtk_bindings_activate_event (object=0x9cd62a0,
event=0x9df7648)
    at gtkbindings.c:1166
#19 0x06c26808 in gtk_widget_real_key_press_event (widget=0x9cd62a0,
event=0x9df7648)
    at gtkwidget.c:3659
#20 0x06a8bc99 in gtk_entry_key_press (widget=0x9cd62a0, event=0x9df7648) at
gtkentry.c:2044
#21 0x06b06a60 in _gtk_marshal_BOOLEAN__BOXED (closure=0x9c5a580,
return_value=0xbfb8d6d0, 
    n_param_values=2, param_values=0xbfb8d7ac, invocation_hint=0xbfb8d6bc, 
    marshal_data=0x6a8bc10) at gtkmarshalers.c:84
#22 0x001e9589 in g_type_class_meta_marshal (closure=0x9c5a580,
return_value=0xbfb8d6d0, 
    n_param_values=2, param_values=0xbfb8d7ac, invocation_hint=0xbfb8d6bc,
marshal_data=0xcc)
    at gclosure.c:567
#23 0x001eae7d in IA__g_closure_invoke (closure=0x9c5a580, return_value=0xbfb8d6d0, 
    n_param_values=2, param_values=0xbfb8d7ac, invocation_hint=0xbfb8d6bc) at
gclosure.c:490
#24 0x001fba83 in signal_emit_unlocked_R (node=0x9c5a500, detail=0,
instance=0x9cd62a0, 
    emission_return=0xbfb8d96c, instance_and_params=0xbfb8d7ac) at gsignal.c:2478
#25 0x001fc71f in IA__g_signal_emit_valist (instance=0x9cd62a0, signal_id=58,
detail=0, 
    var_args=<value optimized out>) at gsignal.c:2209
#26 0x001fcb19 in IA__g_signal_emit (instance=0x9cd62a0, signal_id=58, detail=0)
    at gsignal.c:2243
#27 0x06c1b508 in gtk_widget_event_internal (widget=0x9cd62a0, event=0x9df7648)
    at gtkwidget.c:3915
#28 0x06c2b607 in IA__gtk_window_propagate_key_event (window=0x9e07800,
event=0x9df7648)
    at gtkwindow.c:4671
#29 0x06c2e67c in gtk_window_key_press_event (widget=0x9e07800, event=0x9df7648)
    at gtkwindow.c:4701
#30 0x06b06a60 in _gtk_marshal_BOOLEAN__BOXED (closure=0x9c5a580,
return_value=0xbfb8dbf0, 
    n_param_values=2, param_values=0xbfb8dccc, invocation_hint=0xbfb8dbdc, 
    marshal_data=0x6c2e630) at gtkmarshalers.c:84
#31 0x001e9589 in g_type_class_meta_marshal (closure=0x9c5a580,
return_value=0xbfb8dbf0, 
    n_param_values=2, param_values=0xbfb8dccc, invocation_hint=0xbfb8dbdc,
marshal_data=0xcc)
    at gclosure.c:567
#32 0x001ead9b in IA__g_closure_invoke (closure=0x9c5a580, return_value=0xbfb8dbf0, 
    n_param_values=2, param_values=0xbfb8dccc, invocation_hint=0xbfb8dbdc) at
gclosure.c:490
#33 0x001fba83 in signal_emit_unlocked_R (node=0x9c5a500, detail=0,
instance=0x9e07800, 
    emission_return=0xbfb8de8c, instance_and_params=0xbfb8dccc) at gsignal.c:2478
#34 0x001fc71f in IA__g_signal_emit_valist (instance=0x9e07800, signal_id=58,
detail=0, 
    var_args=<value optimized out>) at gsignal.c:2209
---Type <return> to continue, or q <return> to quit---
#35 0x001fcb19 in IA__g_signal_emit (instance=0x9e07800, signal_id=58, detail=0)
    at gsignal.c:2243
#36 0x06c1b508 in gtk_widget_event_internal (widget=0x9e07800, event=0x9df7648)
    at gtkwidget.c:3915
#37 0x06affe6a in IA__gtk_propagate_event (widget=0x9e07800, event=0x9df7648) at
gtkmain.c:2309
#38 0x06b01037 in IA__gtk_main_do_event (event=0x9df7648) at gtkmain.c:1569
#39 0x0649812a in gdk_event_dispatch (source=0x9c4f008, callback=0, user_data=0x0)
    at gdkevents-x11.c:2318
#40 0x00165442 in IA__g_main_context_dispatch (context=0x9c4f050) at gmain.c:2045
#41 0x0016841f in g_main_context_iterate (context=0x9c4f050, block=1,
dispatch=1, self=0x9c31f08)
    at gmain.c:2677
#42 0x001687c9 in IA__g_main_loop_run (loop=0x9dd9480) at gmain.c:2881
#43 0x06b014b4 in IA__gtk_main () at gtkmain.c:1148
#44 0x0807a6c0 in g_cclosure_marshal_VOID__VOID () at gmarshal.c:56
#45 0x00ca1f2c in __libc_start_main () from /lib/libc.so.6
#46 0x080574f1 in g_cclosure_marshal_VOID__VOID () at gmarshal.c:56
Comment 1 Stefan Becker 2007-02-23 03:03:15 EST
Also openoffice.org print requester crashes with latest gtk2. See

  <http://www.openoffice.org/issues/show_bug.cgi?id=74496>

The crash disappears after downgrading to gtk2-2.10.4-10.fc6.
Comment 2 Matthias Clasen 2007-04-03 14:45:42 EDT
Update in testing now.
Comment 3 Fedora Update System 2007-04-03 17:37:23 EDT
gtk2-2.10.8-3.fc6 has been pushed for fc6, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.
Comment 4 Stefan Becker 2007-04-05 02:31:37 EDT
Openoffice print requester still crashes with gtk2-2.10.8-3.fc6.
Comment 5 Rui Matos 2007-04-06 12:24:46 EDT
Now this may by another bug but I still can make it crash although the procedure
is different now. It only crashes if I write something on the search text entry
and then hit enter repeatedly. BTW, I don't have either tracker or beagle installed.

Versions:
gtk2-2.10.8-3.fc6
evince-0.6.0-6.fc6

Output:
$ gdb evince 
GNU gdb Red Hat Linux (6.5-15.fc6rh)
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...Using host libthread_db
library "/lib/libthread_db.so.1".

(gdb) r
Starting program: /usr/bin/evince 
[Thread debugging using libthread_db enabled]
[New Thread -1208211744 (LWP 13693)]
[New Thread -1210311792 (LWP 13696)]
[New Thread -1232766064 (LWP 13697)]
[New Thread -1243255920 (LWP 13698)]
[New Thread -1253745776 (LWP 13699)]
[Thread -1232766064 (LWP 13697) exited]
[Thread -1243255920 (LWP 13698) exited]
[Thread -1253745776 (LWP 13699) exited]
[New Thread -1253745776 (LWP 13700)]
[Thread -1253745776 (LWP 13700) exited]
[New Thread -1253745776 (LWP 13701)]
[Thread -1253745776 (LWP 13701) exited]
[New Thread -1253745776 (LWP 13704)]
[New Thread -1243255920 (LWP 13705)]

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_finished: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed
[New Thread -1232766064 (LWP 13706)]
[New Thread -1264354416 (LWP 13707)]

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_finished: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_finished: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed
[Thread -1232766064 (LWP 13706) exited]
[Thread -1264354416 (LWP 13707) exited]
[Thread -1253745776 (LWP 13704) exited]
[Thread -1243255920 (LWP 13705) exited]
[New Thread -1253745776 (LWP 13708)]
[New Thread -1264354416 (LWP 13709)]

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_finished: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed
[New Thread -1232766064 (LWP 13710)]
[New Thread -1243255920 (LWP 13711)]

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_hits_added: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed

(evince:13693): Gtk-CRITICAL **: _gtk_search_engine_finished: assertion
`GTK_IS_SEARCH_ENGINE (engine)' failed
[Thread -1253745776 (LWP 13708) exited]
[Thread -1264354416 (LWP 13709) exited]
[Thread -1243255920 (LWP 13711) exited]
[Thread -1232766064 (LWP 13710) exited]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208211744 (LWP 13693)]
0x04e12c1c in search_thread_done_idle (user_data=0x9401b98) at
gtksearchenginesimple.c:133
133           data->engine->priv->active_search = NULL;
(gdb) 
(gdb) 
(gdb) 
(gdb) list
128       data = user_data;
129       
130       if (!data->cancelled) 
131         {
132           _gtk_search_engine_finished (GTK_SEARCH_ENGINE (data->engine));
133           data->engine->priv->active_search = NULL;
134         }
135       
136       search_thread_data_free (data);
137       
(gdb) print data
$1 = 0
(gdb) thread apply all bt

Thread 2 (Thread -1210311792 (LWP 13696)):
#0  0x00ee9402 in __kernel_vsyscall ()
#1  0x0010a1a6 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0x0805a6b3 in ev_render_thread (data=0x0) at ev-job-queue.c:179
#3  0x0038e29f in g_thread_create_proxy (data=0x81feed0) at gthread.c:591
#4  0x001063db in start_thread () from /lib/libpthread.so.0
#5  0x00d5926e in clone () from /lib/libc.so.6

Thread 1 (Thread -1208211744 (LWP 13693)):
#0  0x04e12c1c in search_thread_done_idle (user_data=0x9401b98) at
gtksearchenginesimple.c:133
#1  0x0036e6e1 in g_idle_dispatch (source=0x8eebd08, callback=0,
user_data=0x9401b98)
    at gmain.c:3928
#2  0x00370442 in IA__g_main_context_dispatch (context=0x81f2060) at gmain.c:2045
#3  0x0037341f in g_main_context_iterate (context=0x81f2060, block=1,
dispatch=1, self=0x81d4f08)
    at gmain.c:2677
#4  0x003737c9 in IA__g_main_loop_run (loop=0x83032b8) at gmain.c:2881
#5  0x04ef9554 in IA__gtk_main () at gtkmain.c:1148
#6  0x0807a6c0 in main (argc=1, argv=Cannot access memory at address 0x4
) at main.c:345
#7  0x00ca1f2c in __libc_start_main () from /lib/libc.so.6
#8  0x080574f1 in _start ()
(gdb) 
Comment 6 Fedora Update System 2007-04-17 08:39:25 EDT
gtk2-2.10.8-3.fc6 has been pushed for fc6, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.