GtkIconView crash (SIGSEGV)

["Michael N. Filippov" <michael idisys iae nsk su>]

Hello!

I think I found a bug and want to make sure it is not in my code (FAQ).
This is SIGSEGV in GtkIconView, recreated on all GTK versions I found: 
libgtk2.0-0=2.8.20-3, libgtk2.0-0=2.10.7-1 on Debian and even 
gtk+-2.8.20.zip for Windows.

It crashes when I select icons with rubberband while the program is 
inserting more items.
The code below calls add_image() every 500ms, so if you press left mouse 
button and keep
moving mouse cursor to select/unselect items, the program will crash in 
1-2 seconds.
It happens even if you select items in the area full of images and no 
changes.

Full dump goes below the code (from gtk_icon_view_get_cell_box() to main()).

And next question: how can I prevent this for now (maybe something like 
button_press/release
hooks to stop inserting items while user is selecting items)?

Thanks in advance,

Michael

// ---

#include <gtk/gtk.h>
#include <stdio.h>

enum
{
    COLUMN_PIXBUF,
    COLUMNS_NUMBER
};

void
add_image(GtkIconView *iconview)
{
    GtkTreeModel *model = gtk_icon_view_get_model (iconview);

    GdkPixbuf *pixbuf = gdk_pixbuf_new_from_file ("example.png", NULL);

    if (!pixbuf) {
        fprintf(stderr, "pixbuf is not loaded\n");
        return;
    }

    GtkTreeIter iter;
    gtk_list_store_append (GTK_LIST_STORE (model), &iter);
    gtk_list_store_set (GTK_LIST_STORE (model), &iter,
                        COLUMN_PIXBUF, pixbuf,
                        -1);
}

gboolean
on_timeout (gpointer user_data)
{
    add_image (user_data);
    return TRUE;
}

int
main (int argc, char *argv[])
{
    GtkWidget *window;
    GtkWidget *iconview;
    GtkListStore    *store;
    int i;

    gtk_init (&argc, &argv);

    window = gtk_window_new (GTK_WINDOW_TOPLEVEL);
    gtk_window_set_default_size (GTK_WINDOW (window), 800, 600);
    g_signal_connect (G_OBJECT (window), "destroy",
                      G_CALLBACK (gtk_main_quit),
                      NULL);

    store = gtk_list_store_new(COLUMNS_NUMBER, GDK_TYPE_PIXBUF);

    iconview = gtk_icon_view_new_with_model (GTK_TREE_MODEL (store));
    gtk_icon_view_set_pixbuf_column (GTK_ICON_VIEW (iconview), 
COLUMN_PIXBUF);
    gtk_icon_view_set_selection_mode (GTK_ICON_VIEW (iconview),
                                      GTK_SELECTION_MULTIPLE);

    gtk_container_add (GTK_CONTAINER (window), iconview);

    for (i = 0; i < 10; ++i) {
        add_image (GTK_ICON_VIEW (iconview));
    }

    gtk_widget_show (iconview);
    gtk_widget_show (window);

    g_timeout_add (500, on_timeout, iconview);

    gtk_main();
}

// ---

michael michael:~/work/tests/iconview$ gdb 
--directory=/build/buildd/glib-2.12.9/gobject 
--directory=/build/buildd/glib-2.12.9/glib ./main
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
Using host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) run
Starting program: /home/michael/work/tests/iconview/main

Program received signal SIGSEGV, Segmentation fault.
0xb7cc5c70 in gtk_icon_view_get_cell_box (icon_view=0x808e000,
    item=<value optimized out>, info=<value optimized out>, box=0xbf827c24)
    at /build/buildd/gtk+2.0-2.10.7/gtk/gtkiconview.c:2636
2636      *box = item->box[info->position];
(gdb) up
#1  0xb7cce320 in gtk_icon_view_update_rubberband (data=<value optimized 
out>)
    at /build/buildd/gtk+2.0-2.10.7/gtk/gtkiconview.c:2209
2209          gtk_icon_view_get_cell_box (icon_view, item, info, &box);
(gdb) up
#2  0xb7ccfd97 in gtk_icon_view_motion (widget=0x808e000, event=0x805fa40)
    at /build/buildd/gtk+2.0-2.10.7/gtk/gtkiconview.c:1500
1500          gtk_icon_view_update_rubberband (widget);
(gdb) up
#3  0xb7cfaa72 in _gtk_marshal_BOOLEAN__BOXED (closure=0x807cd68,
    return_value=0xbf827e40, n_param_values=2, param_values=0xbf827f1c,
    invocation_hint=0xbf827e2c, marshal_data=0xb7ccfce0)
    at /build/buildd/gtk+2.0-2.10.7/gtk/gtkmarshalers.c:84
84        v_return = callback (data1,
(gdb) up
#4  0xb790bf39 in g_type_class_meta_marshal (closure=0x807cd68,
    return_value=0xbf827e40, n_param_values=2, param_values=0xbf827f1c,
    invocation_hint=0xbf827e2c, marshal_data=0xbc) at gclosure.c:567
567         closure->marshal (closure,
(gdb) up
#5  0xb790d97b in IA__g_closure_invoke (closure=0x807cd68,
    return_value=0xbf827e40, n_param_values=2, param_values=0xbf827f1c,
    invocation_hint=0xbf827e2c) at gclosure.c:490
490           marshal (closure,
(gdb) up
#6  0xb791ebff in signal_emit_unlocked_R (node=0x807d188, detail=0,
    instance=0x808e000, emission_return=0xbf8280dc,
    instance_and_params=0xbf827f1c) at gsignal.c:2478
2478          g_closure_invoke (class_closure,
(gdb) up
#7  0xb791f898 in IA__g_signal_emit_valist (instance=0x808e000, 
signal_id=31,
    detail=0, var_args=0xbf828160 "x\201\202ï ï\005\b") at gsignal.c:2209
2209          signal_emit_unlocked_R (node, detail, instance, 
&return_value, ins tance_and_params);
(gdb) up
#8  0xb791fc69 in IA__g_signal_emit (instance=0x808e000, signal_id=31,
    detail=0) at gsignal.c:2243
2243      g_signal_emit_valist (instance, signal_id, detail, var_args);
(gdb) up
#9  0xb7e0ced4 in gtk_widget_event_internal (widget=0x808e000, 
event=0x805fa40)
    at /build/buildd/gtk+2.0-2.10.7/gtk/gtkwidget.c:3915
3915            g_signal_emit (widget, widget_signals[signal_num], 0, 
event, &re turn_val);
(gdb) up
#10 0xb7cf3dd3 in IA__gtk_propagate_event (widget=0x808e000, 
event=0x805fa40)
    at /build/buildd/gtk+2.0-2.10.7/gtk/gtkmain.c:2335
2335                handled_event = gtk_widget_event (widget, event);
(gdb) up
#11 0xb7cf4fb7 in IA__gtk_main_do_event (event=0x805fa40)
    at /build/buildd/gtk+2.0-2.10.7/gtk/gtkmain.c:1569
1569          gtk_propagate_event (grab_widget, event);
(gdb) up
#12 0xb7b7c74a in gdk_event_dispatch (source=0x8078908, callback=0,
    user_data=0x0) at 
/build/buildd/gtk+2.0-2.10.7/gdk/x11/gdkevents-x11.c:2318
2318            (*_gdk_event_func) (event, _gdk_event_data);
(gdb) up
#13 0xb7896981 in IA__g_main_context_dispatch (context=0x8078950)
    at gmain.c:2045
2045              need_destroy = ! dispatch (source,
(gdb) up
#14 0xb78999f6 in g_main_context_iterate (context=0x8078950, block=1,
    dispatch=1, self=0x808df00) at gmain.c:2677
2677        g_main_context_dispatch (context);
(gdb) up
#15 0xb7899db7 in IA__g_main_loop_run (loop=0x8095680) at gmain.c:2881
2881        g_main_context_iterate (loop->context, TRUE, TRUE, self);
(gdb) up
#16 0xb7cf5431 in IA__gtk_main ()
    at /build/buildd/gtk+2.0-2.10.7/gtk/gtkmain.c:1148
1148          g_main_loop_run (loop);
(gdb) up
#17 0x08048f63 in main ()