Created attachment 143827 [details]
full gdb backtrace etc

Three users downstream have reported the same bug:
https://bugs.launchpad.net/ubuntu/+source/at-spi/+bug/420053

Repro steps:
1. install the current snapshot of ubuntu karmic
2. tick the checkbox "system::prefs::assistive techs::enable assistive tech"
3. (optionally attach gdb from an ssh shell logged in from another computer)
4. log out
5. SEGV in process "at-spi-registryd" function "_SmcProcessMessage".


Exact location is src/sm_process.c:324 (the function pointer call in the last
statement in the snippet below)

*smcConn->callbacks.save_complete.callback is NULL when the programs jumps to
it.

...
    case SM_SaveComplete:

        if (!smcConn->save_yourself_in_progress)
        {
            _IceErrorBadState (iceConn, _SmcOpcode,
                SM_SaveComplete, IceCanContinue);
        }
        else
        {
            CHECK_SIZE_MATCH (iceConn, _SmcOpcode, opcode,
                length, SIZEOF (smSaveCompleteMsg),
                IceFatalToProtocol);

            smcConn->save_yourself_in_progress = False;

            (*smcConn->callbacks.save_complete.callback) (smcConn,
                smcConn->callbacks.save_complete.client_data);
        }
        break;
...