BUG: fixed-height-mode (critical)

[Markus Lausser <sgop users sourceforge net>]

Hello.

I think i've found a bug in gtk+-2.6.0 and i cannot connect to BugZilla at the moment...

Backtrace is:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 11675)]
_gtk_rbtree_node_set_height (tree=0x8307768, node=0x0, height=21) at gtkrbtree.c:724
724	  gint diff = height - GTK_RBNODE_GET_HEIGHT (node);
(gdb) bt
#0  _gtk_rbtree_node_set_height (tree=0x8307768, node=0x0, height=21) at gtkrbtree.c:724
#1  0x405409dc in gtk_tree_view_row_inserted (model=0x820ecc8, path=0x87d6de8, iter=0x820c178, data="">
    at gtktreeview.c:6744
#2  0x4048ab00 in _gtk_marshal_VOID__BOXED_BOXED (closure=0x82f4888, return_value=0x0, n_param_values=3, param_values=0xbfffe590, 
    invocation_hint=0xbfffe478, marshal_data=0x0) at gtkmarshalers.c:1028
#3  0x406ec5ce in g_closure_invoke (closure=0x82f4888, return_value=0x0, n_param_values=3, param_values=0xbfffe590, 
    invocation_hint=0xbfffe478) at gclosure.c:437
#4  0x40702243 in signal_emit_unlocked_R (node=0x82afe60, detail=0, instance=0x820ecc8, emission_return=0x0, 
    instance_and_params=0xbfffe590) at gsignal.c:2436
#5  0x407008f2 in g_signal_emit_valist (instance=0x820ecc8, signal_id=131, detail=0, var_args=0xbfffe724) at gsignal.c:2195
#6  0x40700b73 in g_signal_emit (instance=0x820ecc8, signal_id=131, detail=0) at gsignal.c:2239
#7  0x40525ef1 in gtk_tree_model_row_inserted (tree_model=0x820ecc8, path=0x83192e0, iter=0x831a330) at gtktreemodel.c:1374
#8  0x40484519 in gtk_list_store_append (list_store=0x820ecc8, iter=0x831a330) at gtkliststore.c:1347
#9  0x40373ae6 in ui_filetree_node_show (tree=0x81faa18, node=0x874f740) at ui_filetree.c:172

This bug doesnt appear:
- when the treeview is not in fixed-height-mode
- when the liststore is filled the first time.

It appears if both
- the treeview is in fixed-height-mode
- the liststore is cleared and filled again.

I am not sure, but shouldn't the newly inserted node be passed to _gtk_rb_tree_node_set_height(), instead of 'tmpnode'?
Or maybe the fixed height shoud be reset to -1 when the rbTree gets empty?

Markus.