After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 748878 - [abrt] Crash in ect_dispose() on quit
[abrt] Crash in ect_dispose() on quit
Status: RESOLVED FIXED
Product: evolution
Classification: Applications
Component: Calendar
3.16.x (obsolete)
Other Linux
: Normal critical
: ---
Assigned To: evolution-calendar-maintainers
Evolution QA team
Depends on:
Blocks:
 
 
Reported: 2015-05-04 09:39 UTC by Milan Crha
Modified: 2015-05-08 12:12 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Milan Crha 2015-05-04 09:39:23 UTC
Moving this from a downstream bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=1217979

Description of problem:
Tried to close evolution while it was downloading messages.

Version-Release number of selected component:
evolution-3.16.1-1.fc22

Additional info:
reporter:       libreport-2.5.1
backtrace_rating: 4
cmdline:        evolution
crash_function: g_type_check_instance_cast
executable:     /usr/bin/evolution
global_pid:     25923
kernel:         4.0.0-1.fc23.x86_64

Core was generated by `evolution'.
Program terminated with signal SIGSEGV, Segmentation fault.

Thread 1 (Thread 0x7f5bb9309a40 (LWP 25923))

  • #0 g_type_check_instance_cast
    at gtype.c line 4055
  • #1 ect_dispose
    at gal-a11y-e-cell-text.c line 47
  • #2 g_object_unref
    at gobject.c line 3137
  • #3 weak_refs_notify
    at gobject.c line 2629
  • #4 g_object_unref
    at gobject.c line 3137
  • #5 etc_dispose
    at e-table-col.c line 61
  • #6 g_object_unref
    at gobject.c line 3137
  • #7 free_columns
    at gal-a11y-e-table-item.c line 82
  • #8 eti_dispose
    at gal-a11y-e-table-item.c line 237
  • #9 g_object_unref
    at gobject.c line 3137
  • #10 weak_refs_notify
    at gobject.c line 2629
  • #11 gnome_canvas_item_dispose
    at gnome-canvas.c line 336
  • #12 g_object_run_dispose
    at gobject.c line 1076
  • #13 gnome_canvas_group_dispose
    at gnome-canvas.c line 1388
  • #14 gnome_canvas_item_dispose
    at gnome-canvas.c line 334
  • #15 g_object_run_dispose
    at gobject.c line 1076
  • #16 gnome_canvas_group_dispose
    at gnome-canvas.c line 1388
  • #17 gnome_canvas_item_dispose
    at gnome-canvas.c line 334
  • #18 g_object_run_dispose
    at gobject.c line 1076
  • #19 gnome_canvas_group_dispose
    at gnome-canvas.c line 1388
  • #20 gnome_canvas_item_dispose
    at gnome-canvas.c line 334
  • #21 g_object_unref
    at gobject.c line 3137
  • #22 gnome_canvas_dispose
    at gnome-canvas.c line 2008
  • #23 g_object_run_dispose
    at gobject.c line 1076
  • #24 gtk_widget_destroy
    at gtkwidget.c line 4794
  • #25 et_dispose
    at e-table.c line 421
  • #26 g_object_run_dispose
    at gobject.c line 1076
  • #27 gtk_scrolled_window_forall
    at gtkscrolledwindow.c line 2252
  • #28 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #32 <emit signal ??? on instance 0x49f2320 [GtkScrolledWindow]>
    at gsignal.c line 3361
  • #33 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #34 g_object_run_dispose
    at gobject.c line 1076
  • #35 gtk_box_forall
    at gtkbox.c line 2558
  • #36 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #40 <emit signal ??? on instance 0x3e21ba0 [GtkBox]>
    at gsignal.c line 3361
  • #41 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #42 g_object_run_dispose
    at gobject.c line 1076
  • #43 gtk_paned_forall
    at gtkpaned.c line 2085
  • #44 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #48 <emit signal ??? on instance 0x412eb90 [EPaned]>
    at gsignal.c line 3361
  • #49 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #50 g_object_run_dispose
    at gobject.c line 1076
  • #51 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #55 <emit signal ??? on instance 0x412e5c0 [EPaned]>
    at gsignal.c line 3361
  • #56 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #57 g_object_run_dispose
    at gobject.c line 1076
  • #58 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #62 <emit signal ??? on instance 0x39e4790 [ECalShellContent]>
    at gsignal.c line 3361
  • #63 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #64 g_object_run_dispose
    at gobject.c line 1076
  • #65 gtk_notebook_forall
    at gtknotebook.c line 4592
  • #66 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #70 <emit signal ??? on instance 0xb9a3e0 [GtkNotebook]>
    at gsignal.c line 3361
  • #71 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #72 g_object_run_dispose
    at gobject.c line 1076
  • #73 gtk_box_forall
    at gtkbox.c line 2558
  • #74 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #78 <emit signal ??? on instance 0x3eba510 [GtkBox]>
    at gsignal.c line 3361
  • #79 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #80 g_object_run_dispose
    at gobject.c line 1076
  • #81 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #85 <emit signal ??? on instance 0x3ed56d0 [GtkPaned]>
    at gsignal.c line 3361
  • #86 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #87 g_object_run_dispose
    at gobject.c line 1076
  • #88 gtk_box_forall
    at gtkbox.c line 2558
  • #89 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #93 <emit signal ??? on instance 0xbe8a50 [GtkBox]>
    at gsignal.c line 3361
  • #94 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #95 g_object_run_dispose
    at gobject.c line 1076
  • #96 gtk_window_forall
    at gtkwindow.c line 8084
  • #97 gtk_container_destroy
    at gtkcontainer.c line 1524
  • #101 <emit signal ??? on instance 0x42aaa10 [EShellWindow]>
    at gsignal.c line 3361
  • #102 gtk_widget_dispose
    at gtkwidget.c line 11962
  • #103 gtk_window_dispose
    at gtkwindow.c line 3021
  • #104 g_object_run_dispose
    at gobject.c line 1076
  • #105 g_list_foreach
    at glist.c line 1005
  • #106 shell_ready_for_quit
    at e-shell.c line 456

Comment 1 zbyszek 2015-05-04 12:19:32 UTC
I forgot to add that this was under gnome-wayland.
Comment 2 Milan Crha 2015-05-06 14:06:57 UTC
I can reproduce this crash too, even without wayland. My steps are:
a) run evolution in the Tasks view
b) click to "Click to add a task"
c) click again to the Summary column, thus the cursor blinks in the view
d) quit evolution by pressing the window's 'X' button
Comment 3 Milan Crha 2015-05-06 14:07:59 UTC
This is what valgrind says:

 Invalid read of size 8
    at 0x5084CCB: ect_dispose (gal-a11y-e-cell-text.c:47)
    by 0x7BCD809: g_object_unref (gobject.c:3133)
    by 0x5086316: cell_text_destroyed (gal-a11y-e-cell-text.c:676)
    by 0x7BCCAA4: weak_refs_notify (gobject.c:2630)
    by 0x7E3943D: g_data_set_internal (gdataset.c:407)
    by 0x7E398F1: g_datalist_id_set_data_full (gdataset.c:670)
    by 0x7BC8C1E: g_object_real_dispose (gobject.c:1021)
    by 0x7BCD809: g_object_unref (gobject.c:3133)
    by 0x50129DD: etc_dispose (e-table-col.c:61)
    by 0x7BCD809: g_object_unref (gobject.c:3133)
    by 0x5029B60: eth_do_remove (e-table-header.c:150)
    by 0x5029CD2: eth_finalize (e-table-header.c:188)
  Address 0x3247e060 is 0 bytes inside a block of size 112 free'd
    at 0x4A07CE9: free (in /usr/lib64/valgrind/...)
    by 0x7E61A0D: g_free (gmem.c:190)
    by 0x4F1044C: ect_kill_view (e-cell-text.c:372)
    by 0x4F1A379: e_cell_kill_view (e-cell.c:293)
    by 0x502CF40: eti_detach_cell_views (e-table-item.c:453)
    by 0x502D7A3: eti_remove_header_model (e-table-item.c:650)
    by 0x502FBD4: eti_dispose (e-table-item.c:1539)
    by 0x7BC8D9E: g_object_run_dispose (gobject.c:1076)
    by 0x5011B10: finish_editing (e-table-click-to-add.c:397)
    by 0x5011951: item_key_press (e-table-click-to-add.c:363)
    by 0x4FAF77F: e_marshal_BOOLEAN__INT_INT_BOXED (e-marshal.c:167)
    by 0x7BC1B70: g_closure_invoke (gclosure.c:768)
Comment 4 Milan Crha 2015-05-07 15:13:49 UTC
I finally realized that this was caused by leaked objects, which were accessing already freed structure (which wasn't a GObject). Pretty tough.

Created commit e3112ac in evo master (3.17.2+)
Created commit a0eb59a in evo gnome-3-16 (3.16.2+)
Comment 5 zbyszek 2015-05-08 12:12:28 UTC
Cool, thanks!