GTK2: Recreating widget (i.e. while anchor docking) leeds to SIGSEGV in `function DeliverMouseUpMessage()`

• Lazarus/FPC Version: trunk
• Operating System: linux (Ubuntu 23.10, Debian 12)
• CPU / Bitness: 64

What happens

Problem is in function DeliverMouseUpMessage, file lazarus/lcl/interfaces/gtk2/gtk2callback.inc:2271. I marked it with "!!!".

function DeliverMouseUpMessage(widget: PGtkWidget; event: pgdkEventButton;
  AWinControl: TWinControl): boolean;
...
    DeliverMessage(AWinControl, MessI);
    // !!! at this point widget could be recreated, so local variable `Widget` can be illegal
    if not AWinControl.HandleAllocated then
      Result := True
    else if MessI.Result <> 0 then
    begin
      // issue #19914
      // !!! `AWinControl.Handle` is legal widget pointer
      // !!! was: if GTK_IS_NOTEBOOK(Widget) then
      if GTK_IS_NOTEBOOK({%H-}Pointer(AWinControl.Handle)) then
      begin
        if g_object_get_data({%H-}PGObject(AWinControl.Handle),'lclnotebookdragging') <> nil then
        begin
          g_object_steal_data({%H-}PGObject(AWinControl.Handle),'lclnotebookdragging');
          exit;
        end;
      end;
      // handled by the LCL
      //DebugLn(['DeliverMouseUpMessage msg was handled by the LCL, Stopping signal ...']);
      // !!! was: g_signal_stop_emission_by_name(PGTKObject(Widget), 'button-release-event');
      Result := True;
    end;

Steps to reproduce

1. run miniide1
2. dock, for example, "FPDoc Editor" into "Messages"
3. undock "Messages" out - all linux show errors in terminal output, like shown above
4. repeat 2,3 several times - in Ubuntu 23.10 I got SIGSEGV

Patch

40793_new.patch

Also

I researched the same situations and found another possible bug, at line 2348:

function gtkMouseBtnRelease(widget: PGtkWidget; event : pgdkEventButton;
  data: gPointer) : GBoolean; cdecl;
...
  if DeliverMouseUpMessage(Widget, Event, TWinControl(Data)) then
  begin
    ReleaseMouseCapture;
    if not DragManager.IsDragging then
      Result := not CallBackDefaultReturn
    else
    begin
      // workaround for gtk2 bug where "clicked" isn't triggered
      // because of Result=TRUE and we started modal form from OnDropDown event.
      // see issue http://bugs.freepascal.org/view.php?id=14318 for details.
      if GTK_IS_BUTTON(Widget) then // !!!
      begin
        AForm := GetParentForm(TWinControl(Data));
        if (AForm <> nil) and (fsModal in AForm.FormState) then
          gtk_button_clicked(PGtkButton(Widget)); // !!!
      end;
    end;
  end else
    ReleaseMouseCapture;

  if (csDesigning in TComponent(Data).ComponentState) then
  begin
    if (Event^.button = 3) then
    begin
      Result:=DeliverContextMenuMessage(widget,false); // !!!
    end;
  end;

changed the description

Please create a patch.

@zeljan1, what do you think about this?

I don't see any patch

If I understood Ilya correctly, the patch should look like this

40793.patch

The general idea is that the handle is created anew, so it will be incorrect to use a widget as a parameter, because it will already be destroyed at the time of the call.

How to reproduce the SIGSEGV?

marked this issue as related to #40428 (closed)

Steps to reproduce are specified in the related issue. I think the problem described in both these issues is the same.

Ok, sorry for not writing here, was busy enough... I've tested example miniide1 under many linux platforms - SIGSEGV raised only in Ubuntu 23.10, under debugger (in terminal simply hangs). Also in any linux got errors in terminal:

(miniide1:11520): GLib-GObject-CRITICAL **: 16:04:22.722: instance of invalid non-instantiatable type '(null)'

(miniide1:11520): GLib-GObject-CRITICAL **: 16:04:22.722: g_signal_stop_emission_by_name: assertion 'G_TYPE_CHECK_INSTANCE (instance)' failed

(miniide1:11520): GLib-GObject-CRITICAL **: 16:04:35.714: instance with invalid (NULL) class pointer

Steps to reproduce

1. run miniide1
2. dock, for example, "FPDoc Editor" into "Messages"
3. undock "Messages" out - all linux show errors in terminal output, like shown above
4. repeat 2,3 several times - in Ubuntu 23.10 I got SIGSEGV

patch should look like this

After testing patched exammple, I still got errors in output like this:

(miniide1:15308): GLib-GObject-CRITICAL **: 16:27:19.936: ../../../gobject/gsignal.c:1285: no emission of signal "button-release-event" to stop for instance '0x13112d0'

So, I need to comment second patched string to remove errors:

+      //g_signal_stop_emission_by_name(PGTKObject(AWinControl.Handle), 'button-release-event');

Finally, I attached a patch. 40793_new.patch

changed the description

@ganmax what about my patch?

mentioned in commit dcaf7e6b

I applied the patch. Thanks. Please test everybody.

assigned to @JuhaManninen

marked #40428 (closed) as a duplicate of this issue

mentioned in issue #40428 (closed)

Closing.

closed

This patch will be applied to fixes_3_0 after some testing.

changed milestone to %Version 3.4

mentioned in commit f289407d