gnucash dumps core

[Marc Evans]

Hi,

I recently updated gnucash from 2.2.6 to 2.2.7 on FreeBSD-6.1. Now when
I run it, it will core dump when I try double click on an account in the
Assets list. I rebuilt with -g so that I could gain some information
about the situation and found that the issue is a NULL pointer
dereference at line 177 of gnucash-style.c, as shown here:

                                cd->can_span_over = FALSE;

cd is NULL. looking further up in the code I see:

                        cd = g_table_index (dimensions->cell_dimensions,
                                            row, col);

so I looked at the argument to the function call but am not seeing
anything suspicious:

(gdb) p *dimensions
$1 = {nrows = 1, ncols = 9, height = 17, width = 680,
  cell_dimensions = 0x9814720, refcount = 6}
(gdb) p row
$2 = 1
(gdb) p col
$3 = 1
(gdb) p *(dimensions->cell_dimensions)
$4 = {array = 0x3, entry_size = 8, rows = 147190083, cols = 0,
  constructor = 0x1b, destroyer = 0x8, user_data = 0x8c5f14c}

The full stack trace shows:

(gdb) where
#0  0x28203df1 in set_dimensions_pass_one (sheet=0xa4a60a8,
cursor=0x969f9f0,
    dimensions=0x9814700) at gnucash-style.c:177
#1  0x282046b8 in styles_recompute_layout_dimensions (sheet=0xa4a60a8,
    default_width=680) at gnucash-style.c:493
#2  0x282047aa in gnucash_sheet_styles_set_dimensions (sheet=0xa4a60a8,
    default_width=680) at gnucash-style.c:506
#3  0x28204fb4 in gnucash_sheet_compile_styles (sheet=0xa4a60a8)
    at gnucash-style.c:668
#4  0x282064a1 in gnc_table_init_gui (widget=0x80811c8, data=0x8185640)
    at table-gnome.c:189
#5  0x281a9a72 in gsr_create_table (gsr=0x83381a0) at gnc-split-reg.c:387
#6  0x281a9935 in gnc_split_reg_init2 (gsr=0x83381a0) at gnc-split-reg.c:353
#7  0x281a9837 in gnc_split_reg_new (ld=0xa043380, parent=0x82a1008,
    numberOfLines=10, read_only=0) at gnc-split-reg.c:325
#8  0x281a0c94 in gnc_plugin_page_register_create_widget (
    plugin_page=0xa38a858) at gnc-plugin-page-register.c:727
#9  0x282c411c in gnc_plugin_page_create_widget (plugin_page=0xa38a858)
    at gnc-plugin-page.c:151
#10 0x282ba449 in gnc_main_window_open_page (window=0x82a1008,
page=0xa38a858)
    at gnc-main-window.c:2211
#11 0x28198696 in gppat_open_account_common (page=0x8350868,
    account=0x83464e8, include_subs=0) at gnc-plugin-page-account-tree.c:672
#12 0x2819875f in gnc_plugin_page_account_tree_double_click_cb (
    treeview=0x82ba000, path=0x91faee8, col=0x8188c48, page=0x8350868)
    at gnc-plugin-page-account-tree.c:685
#13 0x28c01330 in gtk_marshal_VOID__UINT_STRING ()
   from /usr/local/lib/libgtk-x11-2.0.so.0
#14 0x293e69b9 in g_closure_invoke () from
/usr/local/lib/libgobject-2.0.so.0
#15 0x293fabbe in g_signal_has_handler_pending ()
   from /usr/local/lib/libgobject-2.0.so.0
#16 0x293fba48 in g_signal_emit_valist ()
   from /usr/local/lib/libgobject-2.0.so.0
#17 0x293fbc8c in g_signal_emit () from /usr/local/lib/libgobject-2.0.so.0
#18 0x28cd2727 in gtk_tree_view_row_activated ()
   from /usr/local/lib/libgtk-x11-2.0.so.0
#19 0x28ce4685 in gtk_tree_view_set_model ()
   from /usr/local/lib/libgtk-x11-2.0.so.0
#20 0x28bffd82 in gtk_marshal_VOID__UINT_STRING ()
   from /usr/local/lib/libgtk-x11-2.0.so.0
#21 0x293e6c65 in g_cclosure_new_swap ()
   from /usr/local/lib/libgobject-2.0.so.0
#22 0x293e69b9 in g_closure_invoke () from
/usr/local/lib/libgobject-2.0.so.0
#23 0x293fa720 in g_signal_has_handler_pending ()
   from /usr/local/lib/libgobject-2.0.so.0
#24 0x293fb7b5 in g_signal_emit_valist ()
   from /usr/local/lib/libgobject-2.0.so.0
#25 0x293fbc8c in g_signal_emit () from /usr/local/lib/libgobject-2.0.so.0
#26 0x28cf6dd0 in gtk_widget_activate ()
   from /usr/local/lib/libgtk-x11-2.0.so.0
#27 0x28bfe6c3 in gtk_propagate_event ()
   from /usr/local/lib/libgtk-x11-2.0.so.0
#28 0x28bfe94b in gtk_main_do_event () from
/usr/local/lib/libgtk-x11-2.0.so.0
#29 0x28e7cada in gdk_event_get_graphics_expose ()
   from /usr/local/lib/libgdk-x11-2.0.so.0
#30 0x29449b8f in g_main_context_dispatch ()
   from /usr/local/lib/libglib-2.0.so.0
#31 0x2944b490 in g_main_context_acquire ()
   from /usr/local/lib/libglib-2.0.so.0
#32 0x2944b6ec in g_main_loop_run () from /usr/local/lib/libglib-2.0.so.0
#33 0x28bfde6b in gtk_main () from /usr/local/lib/libgtk-x11-2.0.so.0
#34 0x282af7db in gnc_ui_start_event_loop () at gnc-gnome-utils.c:450
#35 0x0804cfcc in _start ()
#36 0x29323710 in invoke_main_func () from /usr/local/lib/libguile.so.20
#37 0x292fcbf7 in c_body () from /usr/local/lib/libguile.so.20
#38 0x2935c68a in scm_c_catch () from /usr/local/lib/libguile.so.20
#39 0x292fcbd1 in scm_i_with_continuation_barrier ()
   from /usr/local/lib/libguile.so.20
#40 0x292fcc57 in scm_c_with_continuation_barrier ()
   from /usr/local/lib/libguile.so.20
#41 0x2935a8ec in scm_i_with_guile_and_parent ()
   from /usr/local/lib/libguile.so.20
#42 0x2935a934 in scm_with_guile () from /usr/local/lib/libguile.so.20
#43 0x293236c3 in scm_boot_guile () from /usr/local/lib/libguile.so.20
#44 0x0804d37c in main ()

This is within thread 3. The other two threads appear to be awaiting wakeup.

Has anyone else seen this and/or have known solutions?

Thanks in advance - Marc