Bug 278987 – Crash when opening drop-down menu entry

• Component: WebKitGTK
• Status: RESOLVED MOVED

[darkblaze69]

Created attachment 472392 [details]
gdb-104708.log

* Arch Linux
* gtk4 4.15.6-r104-g5f1ec18550
* webkitgtk-6.0 2.45.6-r1349-gb53fec47fe5a
* epiphany 47.rc

Crash when opening drop-down menu entry.

#0  _g_log_abort (breakpoint=<optimized out>) at ../glib/glib/gmessages.c:426
#1  g_logv (log_domain=0x7f18aa2c4de8 "Gtk", log_level=G_LOG_LEVEL_CRITICAL, format=<optimized out>, 
    args=args@entry=0x7ffd41e59340) at ../glib/glib/gmessages.c:1273
#2  0x00007f18aa831e94 in g_log (log_domain=<optimized out>, log_level=<optimized out>, format=<optimized out>)
    at ../glib/glib/gmessages.c:1315
#3  0x00007f18a9efee9c in gtk_widget_grab_focus (widget=0x0) at ../gtk/gtk/gtkwidget.c:4919
#4  0x00007f18a65c022e in WebKit::WebPopupMenuProxyGtk::hidePopupMenu() ()
    at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WebKit/UIProcess/gtk/WebPopupMenuProxyGtk.cpp:415
#5  0x00007f18a65c1bd3 in activateItemAtPath ()
    at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WebKit/UIProcess/gtk/WebPopupMenuProxyGtk.cpp:88
#6  operator() () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WebKit/UIProcess/gtk/WebPopupMenuProxyGtk.cpp:200
#7  __invoke () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WebKit/UIProcess/gtk/WebPopupMenuProxyGtk.cpp:200
#8  0x00007f18a9c880a0 in _gtk_marshal_VOID__BOXED_OBJECTv (closure=0x55a163f91070, return_value=<optimized out>, 
    instance=0x55a163dc3ce0, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, 
    param_types=0x55a163f316e0) at gtk/gtkmarshalers.c:2978
#9  0x00007f18aa951ca2 in _g_closure_invoke_va (closure=0x55a163f91070, return_value=0x0, instance=0x55a163dc3ce0, 
    args=0x7ffd41e59770, n_params=<optimized out>, param_types=0x55a163f316e0) at ../glib/gobject/gclosure.c:896
#10 signal_emit_valist_unlocked (instance=instance@entry=0x55a163dc3ce0, signal_id=signal_id@entry=406, 
    detail=detail@entry=0, var_args=var_args@entry=0x7ffd41e59770) at ../glib/gobject/gsignal.c:3423
#11 0x00007f18aa951db2 in g_signal_emit_valist (instance=0x55a163dc3ce0, signal_id=406, detail=0, 
    var_args=var_args@entry=0x7ffd41e59770) at ../glib/gobject/gsignal.c:3262
#12 0x00007f18aa951e74 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, 
    detail=<optimized out>) at ../glib/gobject/gsignal.c:3582
#13 0x00007f18aa087fb7 in gtk_tree_view_click_gesture_released (gesture=<optimized out>, n_press=<optimized out>, 
    x=<optimized out>, y=<optimized out>, tree_view=0x55a163dc3ce0) at ../gtk/gtk/deprecated/gtktreeview.c:3300
#14 0x00007f18a9c88f26 in _gtk_marshal_VOID__INT_DOUBLE_DOUBLEv (closure=<optimized out>, 
    return_value=<optimized out>, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, 
    n_params=<optimized out>, param_types=<optimized out>) at gtk/gtkmarshalers.c:3688
#15 0x00007f18aa951ca2 in _g_closure_invoke_va (closure=0x55a16385a5b0, return_value=0x0, instance=0x55a163859dc0, 
    args=0x7ffd41e59af0, n_params=<optimized out>, param_types=0x55a16071c580) at ../glib/gobject/gclosure.c:896
#16 signal_emit_valist_unlocked (instance=instance@entry=0x55a163859dc0, signal_id=signal_id@entry=139, 
    detail=detail@entry=0, var_args=var_args@entry=0x7ffd41e59af0) at ../glib/gobject/gsignal.c:3423
#17 0x00007f18aa951db2 in g_signal_emit_valist (instance=0x55a163859dc0, signal_id=139, detail=0, 
    var_args=var_args@entry=0x7ffd41e59af0) at ../glib/gobject/gsignal.c:3262
#18 0x00007f18aa951e74 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, 
    detail=<optimized out>) at ../glib/gobject/gsignal.c:3582
#19 0x00007f18a9d64c89 in gtk_gesture_click_end (gesture=0x55a163859dc0, sequence=0x0)
    at ../gtk/gtk/gtkgestureclick.c:275
#20 0x00007f18aa934f76 in g_cclosure_marshal_VOID__BOXEDv (closure=0x55a160b0c270, return_value=<optimized out>, 
    instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, 
    param_types=0x55a16071b260) at ../glib/gobject/gmarshal.c:1686
#21 0x00007f18aa951ca2 in _g_closure_invoke_va (closure=0x55a160b0c270, return_value=0x0, instance=0x55a163859dc0, 
    args=0x7ffd41e59ec0, n_params=<optimized out>, param_types=0x55a16071b260) at ../glib/gobject/gclosure.c:896
#22 signal_emit_valist_unlocked (instance=instance@entry=0x55a163859dc0, signal_id=signal_id@entry=134, 
    detail=detail@entry=0, var_args=var_args@entry=0x7ffd41e59ec0) at ../glib/gobject/gsignal.c:3423
#23 0x00007f18aa951db2 in g_signal_emit_valist (instance=0x55a163859dc0, signal_id=134, detail=0, 
    var_args=var_args@entry=0x7ffd41e59ec0) at ../glib/gobject/gsignal.c:3262
#24 0x00007f18aa951e74 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, 
    detail=<optimized out>) at ../glib/gobject/gsignal.c:3582
#25 0x00007f18a9d6177f in _gtk_gesture_set_recognized (gesture=<optimized out>, recognized=<optimized out>, 
    sequence=<optimized out>) at ../gtk/gtk/gtkgesture.c:335
#26 0x00007f18a9d6177f in _gtk_gesture_check_recognized (gesture=0x55a163859dc0, sequence=0x0)
   from /usr/lib/libgtk-4.so.1
#27 0x00007f18a9d61149 in gtk_gesture_handle_event (controller=0x55a163859dc0, event=0x55a163e61f70, 
    x=<error reading variable: That operation is not available on integers of more than 8 bytes.>, 
    y=<error reading variable: That operation is not available on integers of more than 8 bytes.>)
    at ../gtk/gtk/gtkgesture.c:686
--Type <RET> for more, q to quit, c to continue without paging--c
#28 0x00007f18a9d66333 in gtk_gesture_single_handle_event (controller=0x55a163859dc0, event=0x55a163e61f70, 
    x=<error reading variable: That operation is not available on integers of more than 8 bytes.>, 
    y=<error reading variable: That operation is not available on integers of more than 8 bytes.>)
    at ../gtk/gtk/gtkgesturesingle.c:227
#29 0x00007f18a9f05a5a in gtk_event_controller_handle_event (controller=0x55a163859dc0, event=0x55a163e61f70, 
    target=0x55a163dc3ce0, 
    x=<error reading variable: That operation is not available on integers of more than 8 bytes.>, 
    y=<error reading variable: That operation is not available on integers of more than 8 bytes.>)
    at ../gtk/gtk/gtkeventcontroller.c:362
#30 gtk_widget_run_controllers (widget=0x55a163dc3ce0, event=0x55a163e61f70, target=0x55a163dc3ce0, 
    x=<error reading variable: That operation is not available on integers of more than 8 bytes.>, 
    y=<error reading variable: That operation is not available on integers of more than 8 bytes.>, 
    phase=GTK_PHASE_BUBBLE) at ../gtk/gtk/gtkwidget.c:4587
#31 0x00007f18a9dc185d in gtk_propagate_event_internal (widget=0x55a163dc3ce0, event=0x55a163e61f70, 
    topmost=<optimized out>) at ../gtk/gtk/gtkmain.c:1951
#32 0x00007f18a9dc0d71 in gtk_main_do_event (event=0x55a163e61f70) at ../gtk/gtk/gtkmain.c:1691
#33 0x00007f18a9e005d0 in surface_event (surface=<optimized out>, event=0x0, widget=<optimized out>)
    at ../gtk/gtk/gtkpopover.c:905
#34 0x00007f18aa191d32 in _gdk_marshal_BOOLEAN__POINTERv (closure=0x55a163d2ddd0, return_value=0x7ffd41e5a4c0, 
    instance=0x55a163d2d780, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, 
    param_types=<optimized out>) at gdk/gdkmarshalers.c:302
#35 gdk_surface_event_marshallerv (closure=0x55a163d2ddd0, return_value=0x7ffd41e5a4c0, instance=0x55a163d2d780, 
    args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=<optimized out>)
    at ../gtk/gdk/gdksurface.c:469
#36 0x00007f18aa951ca2 in _g_closure_invoke_va (closure=0x55a163d2ddd0, return_value=0x7ffd41e5a4c0, 
    instance=0x55a163d2d780, args=0x7ffd41e5a5b0, n_params=<optimized out>, param_types=0x55a160da4ce0)
    at ../glib/gobject/gclosure.c:896
#37 signal_emit_valist_unlocked (instance=instance@entry=0x55a163d2d780, signal_id=signal_id@entry=380, 
    detail=detail@entry=0, var_args=var_args@entry=0x7ffd41e5a5b0) at ../glib/gobject/gsignal.c:3423
#38 0x00007f18aa951db2 in g_signal_emit_valist (instance=0x55a163d2d780, signal_id=380, detail=0, 
    var_args=var_args@entry=0x7ffd41e5a5b0) at ../glib/gobject/gsignal.c:3262
#39 0x00007f18aa951e74 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, 
    detail=<optimized out>) at ../glib/gobject/gsignal.c:3582
#40 0x00007f18aa192e49 in gdk_surface_handle_event (event=0x55a163e61f70) at ../gtk/gdk/gdksurface.c:3083
#41 0x00007f18aa0faa13 in gdk_event_source_dispatch (base=<optimized out>, callback=<optimized out>, 
    data=<optimized out>) at ../gtk/gdk/wayland/gdkeventsource.c:142
#42 0x00007f18aa82c459 in g_main_dispatch (context=0x55a1606a9800) at ../glib/glib/gmain.c:3357
#43 0x00007f18aa88f0d7 in g_main_context_dispatch_unlocked (context=0x55a1606a9800) at ../glib/glib/gmain.c:4208
#44 g_main_context_iterate_unlocked.isra.0 (context=context@entry=0x55a1606a9800, block=block@entry=1, 
    dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4273
#45 0x00007f18aa82b955 in g_main_context_iteration (context=context@entry=0x55a1606a9800, 
    may_block=may_block@entry=1) at ../glib/glib/gmain.c:4338
#46 0x00007f18aaa5cbf6 in g_application_run (application=0x55a1606c2770, argc=<optimized out>, argv=0x7ffd41e5aab8)
    at ../glib/gio/gapplication.c:2715
#47 0x000055a144d8d6b6 in main (argc=<optimized out>, argv=<optimized out>) at ../epiphany/src/ephy-main.c:445

[darkblaze69]

Created attachment 472394 [details]
firefox-correct

[darkblaze69]

Created attachment 472395 [details]
epiphany-wrong

[darkblaze69]

This crash I can reproduce on the stable version and on main on the pastvu.com site.

The drop-down menu for "choose a shooting direction". Also the menu has wrong emojis for direction. I've attached how it looks in Firefox and how it looks in Epiphany.

[darkblaze69]

The site code is here.

https://github.com/PastVu/pastvu/blob/c528afcdc1d57ec72bd6d86ad48c94b5f7968563/public/js/module/photo/fields.js#L6

define(['Browser'], function (Browser) {
    const dirIcons = {
        // Arrows are not unified accross browsers and platforms.
        // The choices we use [default, FF, Mac].
        n: ['', '🡡', '↑'],
        ne: ['', '🡥', '↗'],
        e: ['', '🡢', '→'],
        se: ['', '🡦', '↘'],
        s: ['', '🡣', '↓'],
        sw: ['', '🡧', '↙'],
        w: ['', '🡠', '←'],
        nw: ['', '🡤', '↖'],
        aero: ['', '◎', '◎'],
    };

[darkblaze69]

Apparently it is not about emojis, on other drop-downs it also crashes.

[darkblaze69]

bisected to gtk commit here https://gitlab.gnome.org/GNOME/gtk/-/issues/6981#note_2214508

[Michael Catanzaro]

Reproducer: visit https://bugs.webkit.org/enter_bug.cgi?product=WebKit and click on one of the select elements (Severity/Hardware/OS).

[Michael Catanzaro]

(In reply to Michael Catanzaro from comment #7)
> Reproducer: visit https://bugs.webkit.org/enter_bug.cgi?product=WebKit and
> click on one of the select elements (Severity/Hardware/OS).

Then select one of the dropdown items.

[Michael Catanzaro]

Another reproducer: try to change the status of this bug report.

Anyway, this is a GTK bug. Let's move to: https://gitlab.gnome.org/GNOME/gtk/-/issues/6983

[Michael Catanzaro]

Fixed by https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/7691