Comment 12 for bug 1386255

Revision history for this message
Marius Gedminas (mgedmin) wrote :

Here's what causes the crash:

- overlay-scrollbar's gtk_module_init() does this:

    widget_class = g_type_class_ref (GTK_TYPE_SCROLLBAR)
    pre_hijacked_scrollbar_grab_notify = widget_class->grab_notify;

  In GTK+ 3.14 widget_class->grab_notify for GTK_TYPE_SCROLLBAR is NULL.

- overlay-scrollbar's patch_scrollbar_class_vtable() does this:

    if (widget_class->grab_notify == pre_hijacked_scrollbar_grab_notify)
      widget_class->grab_notify = hijacked_scrollbar_grab_notify;

  Since widget_class->grab_notify is still NULL and it is equal to pre_hijacked_scrollbar_grab_notify, we install our own signal handler.

- overlay-scrollbar's hijacked_scrollbar_grab_notify() does this:

    if (use_overlay_scrollbar ())
      return;

    (* pre_hijacked_scrollbar_grab_notify) (widget, was_grabbed);

  Since in Ubuntu GNOME use_overlay_scrollbar() returns a false value due, this code calls a NULL pointer and segfaults.

A more future-proof fix would be to check all pre_hijacked_ handlers before calling them.