GNOME Bugzilla – Bug 748878
[abrt] Crash in ect_dispose() on quit
Last modified: 2015-05-08 12:12:28 UTC
Moving this from a downstream bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1217979 Description of problem: Tried to close evolution while it was downloading messages. Version-Release number of selected component: evolution-3.16.1-1.fc22 Additional info: reporter: libreport-2.5.1 backtrace_rating: 4 cmdline: evolution crash_function: g_type_check_instance_cast executable: /usr/bin/evolution global_pid: 25923 kernel: 4.0.0-1.fc23.x86_64 Core was generated by `evolution'. Program terminated with signal SIGSEGV, Segmentation fault.
+ Trace 235022
Thread 1 (Thread 0x7f5bb9309a40 (LWP 25923))
I forgot to add that this was under gnome-wayland.
I can reproduce this crash too, even without wayland. My steps are: a) run evolution in the Tasks view b) click to "Click to add a task" c) click again to the Summary column, thus the cursor blinks in the view d) quit evolution by pressing the window's 'X' button
This is what valgrind says: Invalid read of size 8 at 0x5084CCB: ect_dispose (gal-a11y-e-cell-text.c:47) by 0x7BCD809: g_object_unref (gobject.c:3133) by 0x5086316: cell_text_destroyed (gal-a11y-e-cell-text.c:676) by 0x7BCCAA4: weak_refs_notify (gobject.c:2630) by 0x7E3943D: g_data_set_internal (gdataset.c:407) by 0x7E398F1: g_datalist_id_set_data_full (gdataset.c:670) by 0x7BC8C1E: g_object_real_dispose (gobject.c:1021) by 0x7BCD809: g_object_unref (gobject.c:3133) by 0x50129DD: etc_dispose (e-table-col.c:61) by 0x7BCD809: g_object_unref (gobject.c:3133) by 0x5029B60: eth_do_remove (e-table-header.c:150) by 0x5029CD2: eth_finalize (e-table-header.c:188) Address 0x3247e060 is 0 bytes inside a block of size 112 free'd at 0x4A07CE9: free (in /usr/lib64/valgrind/...) by 0x7E61A0D: g_free (gmem.c:190) by 0x4F1044C: ect_kill_view (e-cell-text.c:372) by 0x4F1A379: e_cell_kill_view (e-cell.c:293) by 0x502CF40: eti_detach_cell_views (e-table-item.c:453) by 0x502D7A3: eti_remove_header_model (e-table-item.c:650) by 0x502FBD4: eti_dispose (e-table-item.c:1539) by 0x7BC8D9E: g_object_run_dispose (gobject.c:1076) by 0x5011B10: finish_editing (e-table-click-to-add.c:397) by 0x5011951: item_key_press (e-table-click-to-add.c:363) by 0x4FAF77F: e_marshal_BOOLEAN__INT_INT_BOXED (e-marshal.c:167) by 0x7BC1B70: g_closure_invoke (gclosure.c:768)
I finally realized that this was caused by leaked objects, which were accessing already freed structure (which wasn't a GObject). Pretty tough. Created commit e3112ac in evo master (3.17.2+) Created commit a0eb59a in evo gnome-3-16 (3.16.2+)
Cool, thanks!