GNOME Bugzilla – Bug 351358
[a11y] Evolution crashes after trying to navigate new message after deleting an old one.
Last modified: 2006-08-24 06:11:40 UTC
Tested with Ubuntu Dapper Drake (plus all updates). Using Evolution 2.6.1 and Orca from CVS HEAD. Steps to reproduce: * Startup Orca * Startup Evolution in mail view. * Tab to the mail message header summary list and arrow down to select one. * Hit Return to bring up that message in a new window. * Hit Delete to delete it. The next message is displayed in that message window. * Hit Tab (while focus is in that message window). * Evolution crashes. Here's the stack trace: Backtrace was generated from '/usr/bin/evolution-2.6' (no debugging symbols found) Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1". (no debugging symbols found) ... (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread -1231906592 (LWP 11475)] [New Thread -1309426768 (LWP 11482)] [New Thread -1286607952 (LWP 11481)] [New Thread -1278215248 (LWP 11479)] [New Thread -1268679760 (LWP 11478)] [New Thread -1260287056 (LWP 11477)] [New Thread -1251501136 (LWP 11476)] (no debugging symbols found) ... (no debugging symbols found) 0xffffe410 in __kernel_vsyscall ()
+ Trace 70448
Thread 1 (Thread -1231906592 (LWP 11475))
I got the crash too. But the trace is a little different: ----------------- lwp# 1 / thread# 1 -------------------- ce2a64b5 waitid (0, 144d, 8046d50, 3) ce299a53 waitpid (144d, 8046e4c, 0) + 70 d033ae57 libgnomeui_segv_handle (b) + 147 0807400e segv_redirect (b, 0, 8046f24) + 1e ce2a4b7f __sighndlr (b, 0, 8046f24, 8073ff0) + f ce29a6a5 call_user_handler (b, 0, 8046f24) + 28d ce29a82d sigacthandler (b, 0, 8046f24) + bc --- called from signal handler with signal 11 (SIGSEGV) --- d04fa6cf is_valid (9c67400) + af d04fab6c html_a11y_table_get_row_at_index (9c67400, 1) + 5c cf76d5a8 atk_table_get_row_at_index (9c67400, 1) + 48 cca5e237 impl_getRowAtIndex (9c74074, 1, 80473ec) + 2b cca579de _ORBIT_skel_small_Accessibility_Table_getRowAtIndex (9c74074, 8047280, 8047270, 80472a0, 80473ec, cca5e20c) + 1a cff0eb79 ORBit_POAObject_invoke (9bf73b8, 8047280, 8047270, 80472a0, 8047328, 80473ec) + 3d cff130a8 ORBit_OAObject_invoke (9bf73b8, 8047280, 8047270, 80472a0, 8047328, 80473ec) + 34 cff0078d ORBit_small_invoke_adaptor (9bf73b8, 9c72350, cca78b40, 8047328, 80473ec) + 2b5 cff0efc0 ORBit_POAObject_handle_request (9bf73b8, 9c78eb4, 0, 0, 0, 9c72350) + 334 cff0f3d0 ORBit_POAObject_invoke_incoming_request (9bf73b8, 9c72350, 80473ec) + 54 cff0f865 ORBit_POA_handle_request (80bbf08, 9c72350, 9c72368) + 2f5 cff12e70 ORBit_handle_request (80bbe90, 9c72350) + 4c cfefd97d giop_connection_handle_input (8a69558) + 2e5 cff1922e link_connection_io_handler (0, 1, 8a69558) + 56 cff1ae2e link_source_dispatch (8962378, cff191d8, 8a69558) + 42 ce349629 g_main_dispatch (80ba878) + 209 ce34adc7 g_main_context_dispatch (80ba878) + a7 ce34b3e2 g_main_context_iterate (80ba878, 1, 1, 8098638) + 592 ce34bdba g_main_loop_run (81b5540) + 44a d000f3b2 bonobo_main (d0ffb7c0, 29, ce2f2f50, 8168400, 8090ad0, 8098c28) + 5e 0807451e main (1, 80476a8, 80476b0) + 36e 08061c6a _start (1, 80477b0, 0, 80477dc, 804781a, 8047862) + 7a ----------------- lwp# 3 / thread# 3 -------------------- ce2a5b15 pollsys (cae3bd30, 1, 0, 0) ce261192 pselect (29, cae3bf1c, ce2ed990, ce2ed990, 0, 0) + 19e ce261484 select (29, cae3bf1c, 0, 0, 0) + 7e d064a1f2 e_msgport_wait (81c3fc8) + 112 d064ae65 thread_dispatch (81c3f68) + b5 ce2a482f _thr_setup (cdf02400) + 51 ce2a4a80 _lwp_start (cdf02400, 0, 0, 0, 0, 0) ----------------- lwp# 4 / thread# 4 -------------------- ce2a5b15 pollsys (cac6dd30, 1, 0, 0) ce261192 pselect (29, cac6df1c, ce2ed990, ce2ed990, 0, 0) + 19e ce261484 select (29, cac6df1c, 0, 0, 0) + 7e d064a1f2 e_msgport_wait (81c3fc8) + 112 d064ae65 thread_dispatch (81c3f68) + b5 ce2a482f _thr_setup (cab50000) + 51 ce2a4a80 _lwp_start (cab50000, 0, 0, 0, 0, 0) ----------------- lwp# 5 / thread# 5 -------------------- ce2a5b15 pollsys (cab4dc10, 1, 0, 0) ce261192 pselect (4d, cab4df1c, ce2ed990, ce2ed990, 0, 0) + 19e ce261484 select (4d, cab4df1c, 0, 0, 0) + 7e d064a1f2 e_msgport_wait (82b7040) + 112 d064ae65 thread_dispatch (82b7110) + b5 ce2a482f _thr_setup (cab50400) + 51 ce2a4a80 _lwp_start (cab50400, 0, 0, 0, 0, 0) ----------------- lwp# 9 / thread# 9 -------------------- ce2a5b15 pollsys (caa4dd70, 1, 0, 0) ce261192 pselect (21, caa4df1c, ce2ed990, ce2ed990, 0, 0) + 19e ce261484 select (21, caa4df1c, 0, 0, 0) + 7e d064a1f2 e_msgport_wait (81c3ea8) + 112 d064ae65 thread_dispatch (81c3e48) + b5 ce2a482f _thr_setup (cab50800) + 51 ce2a4a80 _lwp_start (cab50800, 0, 0, 0, 0, 0) ----------------- lwp# 7 / thread# 7 -------------------- ce2a5b15 pollsys (ca8ddd50, 1, 0, 0) ce261192 pselect (25, ca8ddf1c, ce2ed990, ce2ed990, 0, 0) + 19e ce261484 select (25, ca8ddf1c, 0, 0, 0) + 7e d064a1f2 e_msgport_wait (81c3f38) + 112 d064ae65 thread_dispatch (81c3ed8) + b5 ce2a482f _thr_setup (cab50c00) + 51 ce2a4a80 _lwp_start (cab50c00, 0, 0, 0, 0, 0)
stacktrace looks like gtkhtml
Created attachment 71504 [details] [review] patch to fix this bug
looks OK to commit into HEAD.