Created attachment 399303 [details]
2 stack traces from the crashes
Description of problem:
When nm-connection-editor is up and a change in PolicyKit action "org.freedesktop.network-manager-settings.system.modify" is made, the editor crashes.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Start nm-connection-editor
2. Click to select a connection
3. Click "Edit" button (editor window appears)
4. Close the editor window by "Cancel" button (or any other way, doesn't matter)
5. Now open /usr/share/polkit-1/actions/org.freedesktop.network-manager-settings.system.policy file
6. Change "<allow_active>auth_admin_keep</allow_active>" to
7. Save the file
8. Boom - nm-connection-editor crashes
Should not crash
The crash stack traces can differ. Two types are in the attachment.
Created attachment 399334 [details]
patch fixing the crash
Hmm, looks like that after closing the editor window, it is destroyed.
However, there are signal handlers connected to ok_button, which takes editor as its data (and it is of course not valid after editor had been destroyed).
The patch disconnects signal handlers of ok_button and thus preventing the nasty things.
However, I'm not sure whether that is a clean way.
I've also tried (at first) gtk_object_destroy (ok_button), however it mysteriously causes disposing ok_button twice - little puzzled.
So looking at this, the problem is actually that editor->window doesn't ever get destroyed. I had assumed that since we got the window widget from the GladeXML with:
widget = glade_xml_get_widget (xml, "<name>");
that glade would own a reference to the widget, and release that reference when we destroyed the GLadeXML object in the NMConnectionEditor's dispose() method. But that's not the case.
It appears that we own the initial reference to top-level widgets like GtkWindows or GtkDialogs that we get from glade, so we need to make sure to release that reference when we clean up. We don't need to care about the CEPolikitButton though, because that gets embedded into editor->window, which takes over the reference to the button when we call gtk_box_pack_end(). When we destroy editor->window in the NMConnectionEditor object's dispose(), that walks the widget hierarchy of the window and destroys all the widgets in the window.
So I think we just need to convert the gtk_widget_hide (editor->window); in dispose() into a gtk_widget_destroy() and we're done. I've verified that change does indeed destroy the CEPolkitButton object.
Upstream fix is
this appears to have regressed from 0.7.x -> 0.8.x.
git master fix is actually:
*** Bug 606561 has been marked as a duplicate of this bug. ***
*** Bug 604999 has been marked as a duplicate of this bug. ***
*** Bug 579559 has been marked as a duplicate of this bug. ***
NetworkManager-0.8.1-1.fc13 has been submitted as an update for Fedora 13.
NetworkManager-0.8.1-1.fc12 has been submitted as an update for Fedora 12.
NetworkManager-0.8.1-1.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update NetworkManager'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/NetworkManager-0.8.1-1.fc13
NetworkManager-0.8.1-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
NetworkManager-0.8.1-4.git20100817.fc12 has been submitted as an update for Fedora 12.
NetworkManager-0.8.1-6.git20100831.fc12 has been submitted as an update for Fedora 12.
NetworkManager-0.8.1-6.git20100831.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.