Bug 312831 – crash in camel-folder-thread.c:sort_node when generating message list

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 312831 - crash in camel-folder-thread.c:sort_node when generating message list


Summary:	crash in camel-folder-thread.c:sort_node when generating message list


Status:	RESOLVED FIXED

Product:	evolution-data-server
Classification:	Platform
Component:	Mailer
Version:	1.2.x (obsolete)
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	evolution-mail-maintainers
QA Contact:	Evolution QA team

URL:
Whiteboard:	evolution[mbox]

Duplicates:	312875 312916 344760 (view as bug list)
Depends on:
Blocks:

Reported:	2005-08-07 21:44 UTC by Nicholas Miell
Modified:	2006-06-13 14:41 UTC

See Also:
GNOME target:	---
GNOME version:	2.9/2.10

Attachments
Compressed mbox (part 1) (1000.00 KB, application/octet-stream) 2005-08-07 22:30 UTC, Nicholas Miell		Details
Compressed mbox (part 2) (1000.00 KB, application/octet-stream) 2005-08-07 22:31 UTC, Nicholas Miell		Details
Compressed mbox (part 3) (70.54 KB, application/octet-stream) 2005-08-07 22:32 UTC, Nicholas Miell		Details
Somewhat minimal test case (330.85 KB, application/x-bzip2) 2005-08-07 22:47 UTC, Nicholas Miell		Details
fixes the crash (2.28 KB, patch) 2005-08-08 05:46 UTC, Not Zed	committed	Details \| Review

Description Nicholas Miell 2005-08-07 21:44:27 UTC

I have a 791 MB mbox (159 MB compressed) which will crash Evolution every time
it attempts to display the folder. (Obviously, I can't attach the mbox to this
bug report for your crashing pleasure, and trimming the file doesn't reproduce
the bug. Let me know where you want it and how to put it there and I'll be happy
to give it to you.)

It looks like the assumption being made in sort_node ("if we have no message, it
must be a dummy node, which also means it must have a child, just use that as
the sort data (close enough?)") is wrong, because it's somehow getting a dummy
node that has no child.

(gdb) frame 0

+ Trace 62270

#0 sort_node
at camel-folder-thread.c line 373
#0 sort_node
at camel-folder-thread.c line 373
#1 msort_with_tmp
at msort.c line 56
#2 msort_with_tmp
at msort.c line 48
#3 msort_with_tmp
at msort.c line 48
#4 msort_with_tmp
at msort.c line 47
#5 msort_with_tmp
at msort.c line 48
#6 msort_with_tmp
at msort.c line 48
#7 msort_with_tmp
at msort.c line 48
#8 msort_with_tmp
at msort.c line 48
#9 *__GI_qsort
at msort.c line 154
#10 sort_thread
at camel-folder-thread.c line 405
#11 thread_summary
at camel-folder-thread.c line 519
#12 camel_folder_thread_messages_new
at camel-folder-thread.c line 632
#13 regen_list_regen
at message-list.c line 3547
#14 mail_msg_received
at mail-mt.c line 556
#15 thread_dispatch
at e-msgport.c line 826
#16 start_thread
at pthread_create.c line 261
#17 ??
from /lib64/libc.so.6
#18 ??

Comment 1 Nicholas Miell 2005-08-07 22:30:28 UTC

Created attachment 50358 [details]
Compressed mbox (part 1)

Compressed mbox that will crash Evolution

Comment 2 Nicholas Miell 2005-08-07 22:31:35 UTC

Created attachment 50359 [details]
Compressed mbox (part 2)

Comment 3 Nicholas Miell 2005-08-07 22:32:24 UTC

Created attachment 50360 [details]
Compressed mbox (part 3)

Final part, cat them together and decompress, etc.

Comment 4 Nicholas Miell 2005-08-07 22:47:06 UTC

Created attachment 50362 [details]
Somewhat minimal test case

I was able to reduce the mbox file further.

Comment 5 Not Zed 2005-08-08 05:46:46 UTC

Created attachment 50369 [details] [review]
fixes the crash

seems to fix it for me, without changing the behaviour

Comment 6 Nicholas Miell 2005-08-08 07:05:40 UTC

Looks like it fixes it for me, too. Many thanks.

Comment 7 Not Zed 2005-08-09 04:03:26 UTC

also committed to 2.2

Comment 8 Not Zed 2005-08-09 04:09:00 UTC

*** Bug 312916 has been marked as a duplicate of this bug. ***

Comment 9 Not Zed 2005-08-09 09:13:25 UTC

*** Bug 312875 has been marked as a duplicate of this bug. ***

Comment 10 Elijah Newren 2006-06-13 14:41:37 UTC

*** Bug 344760 has been marked as a duplicate of this bug. ***