autopilot-gtk crashes gcalctool

[Thomi Richards]

When using ap-gtk to introspect gcalctool, the ap plugin causes a crash inside GtkNode.

See full stack-trace in attached file.

[Charles Kerr (charlesk)]

This is possibly a GTK+ bug.

The backtrace relevant backtrace is:

#0 __memcpy_ssse3_rep () at ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S:1284
#1 0xb7d6e175 in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>)
    at /usr/include/i386-linux-gnu/bits/string3.h:51
#2 gtk_tree_path_copy (path=0x82548c0) at /build/buildd/gtk+3.0-3.6.4/./gtk/gtktreemodel.c:907
#3 0xb784a151 in _g_type_boxed_copy (type=type@entry=135789712, value=value@entry=0x82548c0)
    at /build/buildd/glib2.0-2.35.4/./gobject/gtype.c:4259
#4 0xb7822394 in g_boxed_copy (boxed_type=boxed_type@entry=135789712, src_boxed=src_boxed@entry=0x82548c0)
    at /build/buildd/glib2.0-2.35.4/./gobject/gboxed.c:352
#5 0xb78226e0 in value_set_boxed_internal (need_free=1, need_copy=1, boxed=0x82548c0, value=0xbfffe89c)
    at /build/buildd/glib2.0-2.35.4/./gobject/gboxed.c:479
#6 g_value_set_boxed (value=value@entry=0xbfffe89c, boxed=0x82548c0)
    at /build/buildd/glib2.0-2.35.4/./gobject/gboxed.c:496
#7 0xb7d6be6b in gtk_tree_menu_get_property (object=0x81c73e8, prop_id=2, value=0xbfffe89c, pspec=0x81c28c8)
    at /build/buildd/gtk+3.0-3.6.4/./gtk/gtktreemenu.c:555

Where GtkTreeMenu is passing a GtkTreeRowReference into a boxed GtkTreePath, and gtype is calling gtk_tree_path_copy() with that GtkTreeRowReference pointer.

  GtkTreeRowReference *root;

...

  g_object_class_install_property (object_class,
                                   PROP_ROOT,
                                   g_param_spec_boxed ("root",
                                                       P_("TreeMenu root row"),
                                                       P_("The TreeMenu will display children of the "
                                                          "specified root"),
                                                       GTK_TYPE_TREE_PATH,
                                                       GTK_PARAM_READWRITE));

...

    case PROP_ROOT:
      g_value_set_boxed (value, priv->root);
      break;