[Nautilus-list] Segfault when dragging icons

[Alex Larsson <alexl redhat com>]

I'm currently tracking down a DnD segfault, and I need some help.

The segfault can be triggered by massive dragging of directories to the
location bar. One way I've been able to trigger it is to go to
/usr/share/doc and drag some directory, drop it on the location bar, then
go "up" and repeat. After a while it crashes. (I'm using fam, dunno if
that matters.)

The bug is really hard to reproduce, but here is a backtrace:

#1  0x407d75eb in raise (sig=6) at signals.c:65
#2  0x40962232 in abort () at ../sysdeps/generic/abort.c:88
#3  0x407be09c in g_logv () at eval.c:41
#4  0x407be147 in g_log () at eval.c:41
#5  0x080a117f in get_icon_images_callback (container=0x82a8418, file=0x0,
    modifier=0x408e77e5 "", emblem_icons=0xbfffec58, icon_view=0x8281ed0)
    at fm-icon-view.c:1941
#6  0x401d9108 in eel_gtk_marshal_POINTER__POINTER_POINTER_POINTER
    (object=0x82a8418, func=0x80a10b8 <get_icon_images_callback>,
    func_data=0x8281ed0, args=0xbfffe960) at eel-gtk-extensions.c:1059
#7  0x40552406 in gtk_handlers_run () at eval.c:41
#8  0x4055173d in gtk_signal_real_emit () at eval.c:41
#9  0x4054f4f5 in gtk_signal_emit () at eval.c:41
#10 0x408b97ad in nautilus_icon_container_update_icon
   (container=0x82a8418, icon=0x83d5f58) at nautilus-icon-container.c:3732
#11 0x408be355 in set_drop_target (container=0x82a8418, icon=0x0) at
    nautilus-icon-dnd.c:1107
#12 0x408be4b7 in nautilus_icon_dnd_update_drop_target
    (container=0x82a8418, context=0x84f7190, x=76, y=111) at
    nautilus-icon-dnd.c:1147
#13 0x408beb5a in drag_motion_callback (widget=0x82a8418,
    context=0x84f7190, x=76, y=111, time=3337116829) at
    nautilus-icon-dnd.c:1310
#14 0x4051eba8 in gtk_marshal_BOOL__POINTER_INT_INT_INT () at eval.c:41
#15 0x40552406 in gtk_handlers_run () at eval.c:41
#16 0x4055173d in gtk_signal_real_emit () at eval.c:41
#17 0x4054f8d9 in gtk_signal_emit_by_name () at eval.c:41
#18 0x404ec158 in gtk_drag_dest_motion () at eval.c:41
#19 0x404ebb2d in gtk_drag_find_widget () at eval.c:41
#20 0x404eba87 in gtk_drag_find_widget () at eval.c:41
#21 0x404eba87 in gtk_drag_find_widget () at eval.c:41
#22 0x404eba87 in gtk_drag_find_widget () at eval.c:41
#23 0x404eba87 in gtk_drag_find_widget () at eval.c:41
#24 0x404eba87 in gtk_drag_find_widget () at eval.c:41
#25 0x404eba87 in gtk_drag_find_widget () at eval.c:41
#26 0x404eba87 in gtk_drag_find_widget () at eval.c:41
#27 0x404eba87 in gtk_drag_find_widget () at eval.c:41
#28 0x404eb2a4 in gtk_drag_dest_handle_event () at eval.c:41
#29 0x4051dba3 in gtk_main_do_event () at eval.c:41
#30 0x405ced8f in gdk_event_dispatch () at eval.c:41
#31 0x407bb773 in g_main_dispatch () at eval.c:41
#32 0x407bbd39 in g_main_iterate () at eval.c:41
#33 0x407bbeec in g_main_run () at eval.c:41
#34 0x4051d343 in gtk_main () at eval.c:41
#35 0x400830bc in bonobo_main () at eval.c:41
#36 0x0806fe99 in main (argc=1, argv=0xbffffaa4) at nautilus-main.c:283
#37 0x4094f5e7 in __libc_start_main (main=0x806f9bc <main>, argc=1,
ubp_av=0xbffffaa4, init=0x805f134 <_init>, fini=0x80aebc0 <_fini>,
(gdb) frame 5
#5  0x080a117f in get_icon_images_callback (container=0x82a8418, file=0x0,
    modifier=0x408e77e5 "", emblem_icons=0xbfffec58, icon_view=0x8281ed0)
    at fm-icon-view.c:1941
1941		g_assert (NAUTILUS_IS_FILE (file));
(gdb) frame 10
#10 0x408b97ad in nautilus_icon_container_update_icon
    (container=0x82a8418, icon=0x83d5f58) at
     nautilus-icon-container.c:3732
3732		  gtk_signal_emit (GTK_OBJECT (container),
(gdb) l
3727	}
3728
3729		details = container->details;
3730
3731		/* Get the icons. */
3732		   gtk_signal_emit (GTK_OBJECT (container),
3733				 signals[GET_ICON_IMAGES],
3734				icon->data,
3735				(icon == details->drop_target) ? "accept" : "",
3736				&emblem_scalable_icons,
(gdb) p *icon
$1 = {data = 0x0, item = 0x0, x = 1.4821969375237396e-323, y = 0, scale_x = 0,
      scale_y = 0, is_selected = 0, was_selected_before_rubberband = 0}
(gdb) up
#11 0x408be355 in set_drop_target (container=0x82a8418, icon=0x0) at
    nautilus-icon-dnd.c:1107
1107		  nautilus_icon_container_update_icon (container,
old_icon);
(gdb) l
1102		return;
1103			}
1104
1105		/* Remember the new drop target for the next round. */
1106		   container->details->drop_target = icon;
1107		nautilus_icon_container_update_icon (container, old_icon);
1108		nautilus_icon_container_update_icon (container, icon);
1109
}
1110
1111	static void
(gdb) p old_icon
$2 = (NautilusIcon *) 0x407e2618
(gdb) p icon
$3 = (NautilusIcon *) 0x0

I have the core file left if anyone needs more info.

Basically what happens is that i get a drag_motion event while dragging
the icon. Then i look at the current mouse position to see if the drop
target needs to change (in nautilus_icon_dnd_update_drop_target). It
notices that there should be no active drop target (icon == NULL). So, it
needs to update the old icon to not be prelighted, but in the
nautilus_icon_container_update_icon (container, old_icon) call the
old_icon argument passed is bogus. It is non-null, but old_icon->data is
NULL, and the whole struct contents looks bad, so we bail the g_assert
(NAUTILUS_IS_FAIL (old_icon->data)) in get_icon_images_callback().

I thing i need some help figuring this one out.

/ Alex