Opened 10 months ago

Closed 9 months ago

#15786 closed defect (fixed)

wxDataViewListCtrl::DeleteItem core dumped with GTK3

Reported by: antoine163 Owned by:
Priority: normal Milestone:
Component: wxGTK Version: 3.0.0
Keywords: wxDataViewListCtrl gtk3 Cc:
Blocked By: Blocking:
Patch: no

Description

(Sorry for my English)
The delete from the item selected with wxDataViewListCtrl generate a core dumped.

For example(_ctrlDataList is the wxDataViewListCtrl):

wxDataViewItemArray itemsSelected;
_ctrlDataList->GetSelections(itemsSelected);

for(auto it: itemsSelected)
{
   int row = _ctrlDataList->ItemToRow(it);
   _ctrlDataList->DeleteItem(row);
}

That code don't work with GTK3 but work with GTK2.
This bug is producible from dataview sample, but from a wxDataViewTreeCtrl panel, (I think is same problem).

For more detail, please go to on http://forums.wxwidgets.org/viewtopic.php?f=1&t=38556

Change History (5)

comment:1 Changed 10 months ago by vadz

  • Keywords gtk3 added

What exactly needs to be done in the sample?

Do you have the stack dump from gdb for the crash?

comment:2 Changed 10 months ago by pcor

  • Status changed from new to confirmed

Click on the wxDataViewTreeCtrl tab, expand the tree root, select an item and click Delete Selected.

comment:3 Changed 10 months ago by pcor

It's a use of a deleted object. Here is the valgrind output:

==1357== Invalid read of size 8
==1357==    at 0x5624CD7: wxDataViewTreeStore::IsContainer(wxDataViewItem const&) const (datavcmn.cpp:2122)
==1357==    by 0x56AF8FD: wxGtkTreeCellDataFunc (dataview.cpp:2890)
==1357==    by 0x61933E0: apply_cell_attributes (gtkcellarea.c:1284)
==1357==    by 0x73253DF: g_hash_table_foreach (in /usr/lib64/libglib-2.0.so.0.3600.3)
==1357==    by 0x619346B: gtk_cell_area_real_apply_attributes (gtkcellarea.c:1313)
==1357==    by 0x619C42F: gtk_cell_area_box_apply_attributes (gtkcellareabox.c:1317)
==1357==    by 0x62BCD1D: _gtk_marshal_VOID__OBJECT_BOXED_BOOLEAN_BOOLEANv (gtkmarshalers.c:4960)
==1357==    by 0x6EABC56: ??? (in /usr/lib64/libgobject-2.0.so.0.3600.3)
==1357==    by 0x6EC3D86: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.3600.3)
==1357==    by 0x6EC4A71: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.3600.3)
==1357==    by 0x6195E73: gtk_cell_area_apply_attributes (gtkcellarea.c:2362)
==1357==    by 0x644A795: gtk_tree_view_column_cell_set_cell_data (gtktreeviewcolumn.c:2867)
==1357==    by 0x64E4218: set_cell_data (gtktreeviewaccessible.c:335)
==1357==    by 0x64E44E9: create_cell (gtktreeviewaccessible.c:420)
==1357==    by 0x64E73EE: _gtk_tree_view_accessible_add_state (gtktreeviewaccessible.c:1933)
==1357==    by 0x643DAD4: gtk_tree_view_real_set_cursor (gtktreeview.c:13236)
==1357==    by 0x6433869: gtk_tree_view_row_deleted (gtktreeview.c:9115)
==1357==    by 0x6EABA27: g_closure_invoke (in /usr/lib64/libgobject-2.0.so.0.3600.3)
==1357==    by 0x6EBCA3C: ??? (in /usr/lib64/libgobject-2.0.so.0.3600.3)
==1357==    by 0x6EC4828: g_signal_emit_valist (in /usr/lib64/libgobject-2.0.so.0.3600.3)
==1357==    by 0x6EC4A71: g_signal_emit (in /usr/lib64/libgobject-2.0.so.0.3600.3)
==1357==    by 0x6405C9B: gtk_tree_model_row_deleted (gtktreemodel.c:1867)
==1357==    by 0x56AB8C4: wxGtkDataViewModelNotifier::ItemDeleted(wxDataViewItem const&, wxDataViewItem const&) (dataview.cpp:1642)
==1357==    by 0x561CB1D: wxDataViewModel::ItemDeleted(wxDataViewItem const&, wxDataViewItem const&) (datavcmn.cpp:159)
==1357==    by 0x56262F5: wxDataViewTreeCtrl::DeleteItem(wxDataViewItem const&) (datavcmn.cpp:2496)
==1357==    by 0x41B0AE: MyFrame::OnDeleteTreeItem(wxCommandEvent&) (dataview.cpp:1157)
==1357==  Address 0x1be8bdb0 is 0 bytes inside a block of size 88 free'd
==1357==    at 0x4C298DE: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==1357==    by 0x562437D: wxDataViewTreeStoreNode::~wxDataViewTreeStoreNode() (datavcmn.cpp:1986)
==1357==    by 0x56243AB: wxwxDataViewTreeStoreNodeListNode::DeleteData() (datavcmn.cpp:1989)
==1357==    by 0x5311C90: wxListBase::DoDeleteNode(wxNodeBase*) (list.cpp:368)
==1357==    by 0x5311EAC: wxListBase::DeleteNode(wxNodeBase*) (list.cpp:404)
==1357==    by 0x5311EFF: wxListBase::DeleteObject(void*) (list.cpp:415)
==1357==    by 0x5628D64: wxDataViewTreeStoreNodeList::DeleteObject(wxDataViewTreeStoreNode*) (dataview.h:1143)
==1357==    by 0x5625136: wxDataViewTreeStore::DeleteItem(wxDataViewItem const&) (datavcmn.cpp:2222)
==1357==    by 0x56262D6: wxDataViewTreeCtrl::DeleteItem(wxDataViewItem const&) (datavcmn.cpp:2493)
==1357==    by 0x41B0AE: MyFrame::OnDeleteTreeItem(wxCommandEvent&) (dataview.cpp:1157)

The following change avoids the invalid access. I have no idea if it is the right thing to do.

Index: src/gtk/dataview.cpp
===================================================================
--- src/gtk/dataview.cpp	(revision 75572)
+++ src/gtk/dataview.cpp	(working copy)
@@ -1638,11 +1638,11 @@
     gtk_tree_path_append_index( path, index );
 #endif
 
+    m_internal->ItemDeleted( parent, item );
+
     gtk_tree_model_row_deleted(
         GTK_TREE_MODEL(wxgtk_model), path );
 
-    m_internal->ItemDeleted( parent, item );
-
     // Did we remove the last child, causing 'parent' to become a leaf?
     if ( !m_wx_model->IsContainer(parent) )
     {

comment:4 Changed 10 months ago by vadz

I'm not sure of the fix neither but it definitely can't make things any worse (than crashing) so I say let's apply it.

This whole notifications thing in general (and ItemDeleted() in particular) remains a complete mystery to me, as can be seen from r75044...

comment:5 Changed 9 months ago by PC

  • Resolution set to fixed
  • Status changed from confirmed to closed

(In [75639]) avoid crash with GTK3 when deleting an item, closes #15786

Note: See TracTickets for help on using tickets.