! Please note that this is a snapshot of our old Bugzilla server, which is read only since May 29, 2020. Please go to gitlab.xfce.org for our new server !
Terminal crashes when opening the encoding submenu
Status:
RESOLVED: FIXED
Product:
Xfce4-terminal
Component:
General

Comments

Description Thaddaeus Tintenfisch editbugs 2013-10-07 17:06:48 CEST
The crash appears to be caused by glib 2.37 or newer and does affect Ubuntu 13.10 and Fedora 20.

https://bugs.launchpad.net/ubuntu/+source/xfce4-terminal/+bug/1206739
Comment 1 Alistair Buxton 2013-10-14 00:04:01 CEST
After some investigation we found that the problem stops happening if one line in terminal-encoding-action.c is commented:

       /* category item */
       item = gtk_menu_item_new_with_label (_(terminal_encodings_names[n]));
       gtk_menu_shell_append (GTK_MENU_SHELL (menu), item);
       //groups = g_slist_prepend (groups, item); <-- THIS LINE
       gtk_widget_show (item);
 
       submenu = gtk_menu_new ();


The cause seems to be as follows:

The encoding menu uses radio menu items to indicate which encoding is currently active. Radio items are mutually exclusive - only one item can be active in a given group. 'groups' is used to store the group of radio items.

The encoding menu is also categorized into submenus. The category menu items are NOT radio items, but they are added to the radio group still. It seems that having a none-radio item in a radio group was not a problem with gtk 2.36, but causes a segfault in gtk 2.38.

Simply not adding the category menu items to the radio group (ie comment that one line) makes the bug not happen, and does not seem to affect functionality of the program at all.
Comment 2 Alistair Buxton 2013-10-14 01:28:48 CEST
Looking deeper at this, the whole function seems fishy.

According to https://developer.gnome.org/gtk2/stable/GtkRadioMenuItem.html, the correct way to construct a radio item group is like this:

  GSList group = NULL;

  item1 = gtk_radio_menu_item_new_with_label (group, "This is an example");
  group = gtk_radio_menu_item_get_group (GTK_RADIO_MENU_ITEM (item1));

  item2 = gtk_radio_menu_item_new_with_label (group, "This is an example");
  group = gtk_radio_menu_item_get_group (GTK_RADIO_MENU_ITEM (item2));

  ...

gtk_radio_menu_item_new does this (pseudocode):

  tmp_list = group;
  radio_menu_item->group = g_slist_prepend (group, radio_menu_item);

  for each tmp_menu_item in tmp_group:
      tmp_menu_item->group = radio_menu_item->group;

g_slist_prepend does this:

  new_list = _g_slist_alloc ();
  new_list->data = data;
  new_list->next = list;

  return new_list;

In xfce4-terminal, instead of:
  group = gtk_radio_menu_item_get_group (GTK_RADIO_MENU_ITEM (item));
it does:
  group = g_slist_prepend (group, item);

This produces a list with the same VALUES, but it is NOT the same list as what is stored inside the item. The 
two lists have a different first node, because prepending the same data again creates a new node. Both of the first nodes point to the same tail. The list inside the item is overwritten when the next item is created, and so this causes a memory leak, as the first node is not in the new list (it's a different one with the same value.)

Luckily the fix is very simple: just do what the example code does.

This also fully explains the crash: tmp_menu_item->group = radio_menu_item->group; segfaults if radio_menu_item is not a radio menu item.
Comment 3 Alistair Buxton 2013-10-14 01:44:11 CEST
Created attachment 5186 
Fix up encoding menu creation.
Comment 4 arokux 2013-10-21 18:39:14 CEST
Patch works for me, too. Please ship it! :)
Comment 5 Pablo Lezaeta 2013-10-30 07:09:29 CET
Maybe if you aren't getting enought attention want drop this to the mailist.

and yes that patch here work too for glib2 2.38.1 and since this is a .1 release of glib, this mean that the fix belong to xfce
Comment 6 Yves-Alexis Perez editbugs 2013-11-27 07:40:40 CET
Hi Nick,

could you import that patch to master?
Comment 7 Nick Schermer editbugs 2013-12-07 12:23:51 CET
Pushed. Thanks.
Comment 8 Nick Schermer editbugs 2013-12-26 22:17:58 CET
*** Bug 10412 has been marked as a duplicate of this bug. ***

Bug #10395

Reported by:
Thaddaeus Tintenfisch
Reported on: 2013-10-07
Last modified on: 2013-12-26
Duplicates (1):
  • 10412 Xfce4-terminal crashes when selecting the "set encoding" submenu.

People

Assignee:
Nick Schermer
CC List:
9 users

Version

Attachments

Fix up encoding menu creation. (2.59 KB, patch)
2013-10-14 01:44 CEST , Alistair Buxton
no flags

Additional information