Created attachment 88916 [details]
Stacktrace for the bug

I attached this stack trace to the ubuntu bug on launchpad but here it is again for your convenience.

Also, the bug seems to be reproducible with any link in the form news:foo@bar

I can reproduce this every time too on Ubuntu 7.04 using gnome-terminal 2.18.0-0ubuntu1 . Here's my backtrace:

(gdb) bt

+ Trace 136465

Also reproduced on Fedora 7 (latest test release) with gnome-terminal 2.18.0-1.fc7

terminal-screen.c defines 4 different "address" types in terminal_screen_init():

terminal_screen_init (TerminalScreen *screen)
{

[..]

#define USERCHARS "-A-Za-z0-9"
#define PASSCHARS "-A-Za-z0-9,?;.:/!%$^*&~\"#'"
#define HOSTCHARS "-A-Za-z0-9"
#define PATHCHARS "-A-Za-z0-9_$.+!*(),;:@&=?/~#%"
#define SCHEME    "(news:|telnet:|nntp:|file:/|https?:|ftps?:|webcal:)"
#define USER      "[" USERCHARS "]+(:["PASSCHARS "]+)?"
#define URLPATH   "/[" PATHCHARS "]*[^]'.}>) \t\r\n,\\\"]"

  terminal_widget_match_add (screen->priv->term,
			     "\\<" SCHEME "//(" USER "@)?[" HOSTCHARS ".]+"
			     "(:[0-9]+)?(" URLPATH ")?\\>/?", FLAVOR_AS_IS);

  terminal_widget_match_add (screen->priv->term,
			     "\\<(www|ftp)[" HOSTCHARS "]*\\.[" HOSTCHARS ".]+"
			     "(:[0-9]+)?(" URLPATH ")?\\>/?",
			     FLAVOR_DEFAULT_TO_HTTP);

  terminal_widget_match_add (screen->priv->term,
			     "\\<(mailto:)?[a-z0-9][a-z0-9.-]*@[a-z0-9]"
			     "[a-z0-9-]*(\\.[a-z0-9][a-z0-9-]*)+\\>",
			     FLAVOR_EMAIL);

  terminal_widget_match_add (screen->priv->term,
			     "\\<news:[-A-Z\\^_a-z{|}~!\"#$%&'()*+,./0-9;:=?`]+"
			     "@[" HOSTCHARS ".]+(:[0-9]+)?\\>", FLAVOR_AS_IS);

[...]
}

This creates 4 flags with 3 flavors. Here's a snippet of terminal_widget_match_add() out of terminal-widget-vte.c:

void
terminal_widget_match_add                  (GtkWidget            *widget,
					    const char           *regexp,
                                            int                   flavor)
{
  TagData *tag_data;
  VteData *data;
  int tag;
  
  data = g_object_get_data (G_OBJECT (widget), "terminal-widget-data");

  tag = vte_terminal_match_add (VTE_TERMINAL (widget), regexp);

  tag_data = g_new0 (TagData, 1);
  tag_data->tag = tag;
  tag_data->flavor = flavor;

  data->url_tags = g_slist_append (data->url_tags, tag_data);
}

Both the the tag and the flavor are set.

In terminal-widget-vte.c there is terminal_widget_check_match which returns the flavor of matched addresses:

char*
terminal_widget_check_match (GtkWidget *widget,
			     int        column,
			     int        row,
                             int       *flavor)
{
  VteData *data;
  GSList *tags;
  gint tag;
  char *match;
   
  data = g_object_get_data (G_OBJECT (widget), "terminal-widget-data");

  match = vte_terminal_match_check(VTE_TERMINAL(widget), column, row, &tag);
  for (tags = data->url_tags; tags != NULL; tags = g_slist_next(tags))
    if (GPOINTER_TO_INT(((TagData*)tags->data)->tag) == tag)
      {
        if (flavor)
          *flavor = tag;
        return match;
      }

  g_free (match);
  return NULL;
}

Now I could be wrong but look at how flavor is set from tag not from flavor. This could be the root of the problem...

I guess I should also post a code snippet from the area which calls the assertion:

enum {
  FLAVOR_AS_IS,
  FLAVOR_DEFAULT_TO_HTTP,
  FLAVOR_EMAIL
};

static void
open_url (TerminalScreen *screen,
          const char     *orig_url,
          int             flavor)
{
[..]
  switch (flavor)
    {
    case FLAVOR_DEFAULT_TO_HTTP:
      url = g_strdup_printf ("http:%s", orig_url);
      break;
    case FLAVOR_EMAIL:
      if (strncmp ("mailto:", orig_url, 7))
	url = g_strdup_printf ("mailto:%s", orig_url);
      else
	url = g_strdup (orig_url);
      break;
    case FLAVOR_AS_IS:
      url = g_strdup (orig_url);
      break;
    default:
      url = NULL;
      g_assert_not_reached ();
    }

It might be fun to shuffle the order of the terminal_widget_match_add calls around and see what happens...

Unique and detailed stack trace. Also reproduceable on Ubuntu Gutsy with Terminal 2.18.1. Confirming.

Thanks Sitsofe for the analysis.  That's exactly what was happening.

2007-11-26  Behdad Esfahbod  <behdad@gnome.org>

        Bug 441618 – Message-ID/news-Link crashes gnome-terminal

        * src/terminal-widget-vte.c (terminal_widget_check_match),
        (terminal_widget_skey_check_match): Return flavor as flavor,
        not tag as flavor.