Bug 643089 – Double click a mail in evolution -> glibc detected double free

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 643089 - Double click a mail in evolution -> glibc detected double free


Summary:	Double click a mail in evolution -> glibc detected double free


Status:	RESOLVED DUPLICATE of bug 643207

Product:	evolution
Classification:	Applications
Component:	Mailer
Version:	3.0.x (obsolete)
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	evolution-mail-maintainers
QA Contact:	Evolution QA team

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2011-02-23 16:38 UTC by Milan Crha
Modified:	2013-09-13 01:11 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Milan Crha 2011-02-23 16:38:04 UTC

Moving this from a downstream bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=679763

Description of problem:
*** glibc detected *** /usr/bin/evolution: double free or corruption (fasttop):
0x000000000170a490 ***

======= Backtrace: =========
/lib64/libc.so.6(+0x7889a)[0x7fffee77d89a]
/lib64/libglib-2.0.so.0(g_free+0x23)[0x7fffeeaeb9d3]
/usr/lib64/libgdk-3.so.0(gdk_event_free+0x89)[0x7ffff12518f9]
/lib64/libgobject-2.0.so.0(g_value_unset+0x23)[0x7fffef3fc933]
/lib64/libgobject-2.0.so.0(g_signal_emit_valist+0x8bc)[0x7fffef3ef91c]
/lib64/libgobject-2.0.so.0(g_signal_emit+0x82)[0x7fffef3efa92]
/usr/lib64/evolution/2.92/libetable.so.0(+0x44357)[0x7ffff6ad6357]
/usr/lib64/evolution/2.92/libgnomecanvas.so.0(gnome_canvas_marshal_BOOLEAN__BOXED+0x98)[0x7ffff5fb35d8]
/lib64/libgobject-2.0.so.0(g_closure_invoke+0x15e)[0x7fffef3d52de]
/lib64/libgobject-2.0.so.0(+0x1ecfd)[0x7fffef3e5cfd]
/lib64/libgobject-2.0.so.0(g_signal_emit_valist+0x64b)[0x7fffef3ef6ab]
/lib64/libgobject-2.0.so.0(g_signal_emit_by_name+0x1dd)[0x7fffef3efc7d]
/usr/lib64/evolution/2.92/libemiscwidgets.so.0(+0x4b301)[0x7ffff6626301]
/usr/lib64/libgtk-3.so.0(+0x148188)[0x7ffff17f9188]
/lib64/libgobject-2.0.so.0(g_closure_invoke+0x15e)[0x7fffef3d52de]
/lib64/libgobject-2.0.so.0(+0x1ecfd)[0x7fffef3e5cfd]
/lib64/libgobject-2.0.so.0(g_signal_emit_valist+0x64b)[0x7fffef3ef6ab]
/lib64/libgobject-2.0.so.0(g_signal_emit+0x82)[0x7fffef3efa92]
/usr/lib64/libgtk-3.so.0(+0x269c99)[0x7ffff191ac99]
/usr/lib64/libgtk-3.so.0(gtk_propagate_event+0xca)[0x7ffff17f89ea]
/usr/lib64/libgtk-3.so.0(gtk_main_do_event+0x2c3)[0x7ffff17f8d83]
/usr/lib64/libgdk-3.so.0(+0x45a02)[0x7ffff1275a02]
/lib64/libglib-2.0.so.0(g_main_context_dispatch+0x1dd)[0x7fffeeae4a9d]
/lib64/libglib-2.0.so.0(+0x43278)[0x7fffeeae5278]
/lib64/libglib-2.0.so.0(g_main_loop_run+0x16a)[0x7fffeeae58ba]
/usr/lib64/libgtk-3.so.0(gtk_main+0x8d)[0x7ffff17f822d]
/usr/bin/evolution[0x402d60]
/lib64/libc.so.6(__libc_start_main+0xed)[0x7fffee7262fd]
/usr/bin/evolution[0x403335]
======= Memory map: ========
00400000-00405000 r-xp 00000000 fd:00 22941                             
/usr/bin/evolution
00605000-00606000 rw-p 00005000 fd:00 22941                             
/usr/bin/evolution
00606000-024aa000 rw-p 00000000 00:00 0                                  [heap]
7fffb8000000-7fffb82ad000 rw-p 00000000 00:00 0 
7fffb82ad000-7fffbc000000 ---p 00000000 00:00 0 
7fffbe53c000-7fffbe541000 r-xp 00000000 fd:00 144568                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mail-notification.so
7fffbe541000-7fffbe741000 ---p 00005000 fd:00 144568                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mail-notification.so
7fffbe741000-7fffbe742000 rw-p 00005000 fd:00 144568                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mail-notification.so
7fffbe742000-7fffbea43000 rw-p 00000000 00:00 0 
7fffbea43000-7fffbee2b000 r--p 00000000 fd:00 40239                     
/usr/share/fonts/un-core/UnDotumBold.ttf
7fffbee2b000-7fffbf1a8000 r--p 00000000 fd:00 40238                     
/usr/share/fonts/un-core/UnDotum.ttf
7fffbf1a8000-7fffbf1ab000 r-xp 00000000 fd:00 16923                     
/usr/lib64/pango/1.6.0/modules/pango-hangul-fc.so
7fffbf1ab000-7fffbf3aa000 ---p 00003000 fd:00 16923                     
/usr/lib64/pango/1.6.0/modules/pango-hangul-fc.so
7fffbf3aa000-7fffbf3ab000 rw-p 00002000 fd:00 16923                     
/usr/lib64/pango/1.6.0/modules/pango-hangul-fc.so
7fffbf3ab000-7fffbf3e4000 r-xp 00000000 fd:00 21054                     
/usr/lib64/libibus-1.0.so.0.0.0
7fffbf3e4000-7fffbf5e3000 ---p 00039000 fd:00 21054                     
/usr/lib64/libibus-1.0.so.0.0.0
7fffbf5e3000-7fffbf5e6000 rw-p 00038000 fd:00 21054                     
/usr/lib64/libibus-1.0.so.0.0.0
7fffbf5e6000-7fffbf5ec000 r-xp 00000000 fd:00 17439                     
/usr/lib64/gtk-3.0/3.0.0/immodules/im-ibus.so
7fffbf5ec000-7fffbf7eb000 ---p 00006000 fd:00 17439                     
/usr/lib64/gtk-3.0/3.0.0/immodules/im-ibus.so
7fffbf7eb000-7fffbf7ec000 rw-p 00005000 fd:00 17439                     
/usr/lib64/gtk-3.0/3.0.0/immodules/im-ibus.so
7fffbf7ec000-7fffbf7f1000 r-xp 00000000 fd:00 144558                    
/usr/lib64/evolution/2.92/modules/libevolution-module-plugin-manager.so
7fffbf7f1000-7fffbf9f0000 ---p 00005000 fd:00 144558                    
/usr/lib64/evolution/2.92/modules/libevolution-module-plugin-manager.so
7fffbf9f0000-7fffbf9f1000 rw-p 00004000 fd:00 144558                    
/usr/lib64/evolution/2.92/modules/libevolution-module-plugin-manager.so
7fffbf9f1000-7fffbf9f5000 r-xp 00000000 fd:00 144561                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-backup-restore.so
7fffbf9f5000-7fffbfbf4000 ---p 00004000 fd:00 144561                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-backup-restore.so
7fffbfbf4000-7fffbfbf5000 rw-p 00003000 fd:00 144561                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-backup-restore.so
7fffbfbf5000-7fffbfbfb000 r-xp 00000000 fd:00 139903                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-templates.so
7fffbfbfb000-7fffbfdfb000 ---p 00006000 fd:00 139903                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-templates.so
7fffbfdfb000-7fffbfdfc000 rw-p 00006000 fd:00 139903                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-templates.so
7fffbfdfc000-7fffbfdff000 r-xp 00000000 fd:00 144570                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mailing-list-actions.so
7fffbfdff000-7fffbffff000 ---p 00003000 fd:00 144570                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mailing-list-actions.so
7fffbffff000-7fffc0000000 rw-p 00003000 fd:00 144570                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mailing-list-actions.so
7fffc0000000-7fffc03e6000 rw-p 00000000 00:00 0 
7fffc03e6000-7fffc4000000 ---p 00000000 00:00 0 
7fffc4000000-7fffc4740000 rw-p 00000000 00:00 0 
7fffc4740000-7fffc8000000 ---p 00000000 00:00 0 
7fffc8000000-7fffca89d000 rw-p 00000000 00:00 0 
7fffca89d000-7fffcc000000 ---p 00000000 00:00 0 
7fffcc1e4000-7fffcc1e8000 r-xp 00000000 fd:00 144571                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mark-all-read.so
7fffcc1e8000-7fffcc3e8000 ---p 00004000 fd:00 144571                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mark-all-read.so
7fffcc3e8000-7fffcc3e9000 rw-p 00004000 fd:00 144571                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mark-all-read.so
7fffcc3e9000-7fffcc3f2000 r-xp 00000000 fd:00 144569                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mail-to-task.so
7fffcc3f2000-7fffcc5f1000 ---p 00009000 fd:00 144569                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mail-to-task.so
7fffcc5f1000-7fffcc5f2000 rw-p 00008000 fd:00 144569                    
/usr/lib64/evolution/2.92/plugins/liborg-gnome-mail-to-task.so
7fffcc5f2000-7fffcc5f3000 ---p 00000000 00:00 0 
7fffcc5f3000-7fffccdf3000 rw-p 00000000 00:00 0 
7fffccdf3000-7fffccdf9000 r-xp 00000000 fd:00 9167                      
/usr/lib64/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-
Program received signal SIGABRT, Aborted.
0x00007fffee73b285 in raise (sig=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64   return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);

(gdb) bt

+ Trace 226074

#0 raise
at ../nptl/sysdeps/unix/sysv/linux/raise.c line 64
#1 abort
at abort.c line 92
#2 __libc_message
at ../sysdeps/unix/sysv/linux/libc_fatal.c line 186
#3 malloc_printerr
#4 g_free
at gmem.c line 263
#5 gdk_event_free
at gdkevents.c line 648
#6 g_value_unset
at gvalue.c line 275
#7 g_signal_emit_valist
at gsignal.c line 3012
#8 g_signal_emit
at gsignal.c line 3040
#9 eti_event
at e-table-item.c line 2417
#10 gnome_canvas_marshal_BOOLEAN__BOXED
at gnome-canvas-marshal.c line 128
#11 g_closure_invoke
at gclosure.c line 767
#12 signal_emit_unlocked_R
at gsignal.c line 3290
#13 g_signal_emit_valist
at gsignal.c line 2993
#14 g_signal_emit_by_name
at gsignal.c line 3077
#15 canvas_emit_event
at e-canvas.c line 151
#16 _gtk_marshal_BOOLEAN__BOXED
at gtkmarshalers.c line 85
#17 g_closure_invoke
at gclosure.c line 767
#18 signal_emit_unlocked_R
at gsignal.c line 3290
#19 g_signal_emit_valist
at gsignal.c line 2993
#20 g_signal_emit
at gsignal.c line 3040
#21 gtk_widget_event_internal
at gtkwidget.c line 6066
#22 gtk_propagate_event
at gtkmain.c line 2588
#23 gtk_main_do_event
at gtkmain.c line 1863
#24 gdk_event_source_dispatch
at gdkeventsource.c line 318
#25 g_main_dispatch
at gmain.c line 2440
#26 g_main_context_dispatch
at gmain.c line 3013
#27 g_main_context_iterate
at gmain.c line 3091
#28 g_main_loop_run
at gmain.c line 3299
#29 gtk_main
at gtkmain.c line 1349
#30 main
at main.c line 734


Version-Release number of selected component (if applicable):
evolution-2.91.6.2-1.fc15.x86_64

How reproducible:
always

Steps to Reproduce:
1. double click a mail in evolution.

Additional info:
evolution-data-server-2.91.6-4.fc15.x86_64
gtkhtml3-3.91.6-4.fc15.x86_64
glib2-2.28.1-1.fc15.x86_64
gtk3-3.0.1-1.fc15.x86_64

Comment 1 Dan Williams 2011-02-24 18:08:41 UTC

More detailed backtrace, same package versions as above:

+ Trace 226095

#0 raise
at ../nptl/sysdeps/unix/sysv/linux/raise.c line 64
#1 abort
at abort.c line 92
#2 __libc_message
at ../sysdeps/unix/sysv/linux/libc_fatal.c line 186
#3 malloc_printerr
#4 g_free
at gmem.c line 263
#5 gdk_event_free
at gdkevents.c line 648
#6 g_value_unset
at gvalue.c line 275
#7 g_signal_emit_valist
at gsignal.c line 3012
#8 g_signal_emit
at gsignal.c line 3040
#9 eti_event
at e-table-item.c line 2417
#10 gnome_canvas_marshal_BOOLEAN__BOXED
at gnome-canvas-marshal.c line 128
#11 g_closure_invoke
at gclosure.c line 767
#12 signal_emit_unlocked_R
at gsignal.c line 3290
#13 g_signal_emit_valist
at gsignal.c line 2993
#14 g_signal_emit_by_name
at gsignal.c line 3077
#15 canvas_emit_event
at e-canvas.c line 151
#16 _gtk_marshal_BOOLEAN__BOXED
at gtkmarshalers.c line 85
#17 g_closure_invoke
at gclosure.c line 767
#18 signal_emit_unlocked_R
at gsignal.c line 3290
#19 g_signal_emit_valist
at gsignal.c line 2993
#20 g_signal_emit
at gsignal.c line 3040
#21 gtk_widget_event_internal
at gtkwidget.c line 6066
#22 gtk_propagate_event
at gtkmain.c line 2588
#23 gtk_main_do_event
at gtkmain.c line 1863
#24 gdk_event_source_dispatch
at gdkeventsource.c line 318
#25 g_main_dispatch
at gmain.c line 2440
#26 g_main_context_dispatch
at gmain.c line 3013

Comment 2 Dan Williams 2011-02-24 18:09:12 UTC

And valgrind output showing where the first free comes from:

==15829== Thread 1:
==15829== Invalid read of size 8
==15829==    at 0x4A07B50: memcpy (mc_replace_strmem.c:628)
==15829==    by 0x33DC409E34: XIGrabDevice (string3.h:52)
==15829==    by 0x3DAE039320: gdk_x11_device_xi2_grab (gdkdevice-xi2.c:415)
==15829==    by 0x3DAE03073A: gdk_pointer_grab (gdkwindow.c:8706)
==15829==    by 0x3DAFC15DF0: gnome_canvas_item_grab (gnome-canvas.c:869)
==15829==    by 0x3DB084C85D: e_canvas_item_grab (e-canvas.c:830)
==15829==    by 0x3DB1445B04: eti_event (e-table-item.c:196)
==15829==    by 0x3DAFC155D7: gnome_canvas_marshal_BOOLEAN__BOXED (gnome-canvas-marshal.c:128)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901ECFC: signal_emit_unlocked_R (gsignal.c:3290)
==15829==    by 0x33D90286AA: g_signal_emit_valist (gsignal.c:2993)
==15829==    by 0x33D9028C7C: g_signal_emit_by_name (gsignal.c:3077)
==15829==  Address 0x26eeaeb0 is 0 bytes inside a block of size 4 alloc'd
==15829==    at 0x4A04AF4: calloc (vg_replace_malloc.c:467)
==15829==    by 0x33DC409D5E: XIGrabDevice (XIGrabDevice.c:65)
==15829==    by 0x3DAE039320: gdk_x11_device_xi2_grab (gdkdevice-xi2.c:415)
==15829==    by 0x3DAE03073A: gdk_pointer_grab (gdkwindow.c:8706)
==15829==    by 0x3DAFC15DF0: gnome_canvas_item_grab (gnome-canvas.c:869)
==15829==    by 0x3DB084C85D: e_canvas_item_grab (e-canvas.c:830)
==15829==    by 0x3DB1445B04: eti_event (e-table-item.c:196)
==15829==    by 0x3DAFC155D7: gnome_canvas_marshal_BOOLEAN__BOXED (gnome-canvas-marshal.c:128)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901ECFC: signal_emit_unlocked_R (gsignal.c:3290)
==15829==    by 0x33D90286AA: g_signal_emit_valist (gsignal.c:2993)
==15829==    by 0x33D9028C7C: g_signal_emit_by_name (gsignal.c:3077)
==15829== 
==15829== Invalid read of size 2
==15829==    at 0x4A07BA9: memcpy (mc_replace_strmem.c:628)
==15829==    by 0x33DC409E34: XIGrabDevice (string3.h:52)
==15829==    by 0x3DAE039320: gdk_x11_device_xi2_grab (gdkdevice-xi2.c:415)
==15829==    by 0x3DAE03073A: gdk_pointer_grab (gdkwindow.c:8706)
==15829==    by 0x3DAFC15DF0: gnome_canvas_item_grab (gnome-canvas.c:869)
==15829==    by 0x3DB084C85D: e_canvas_item_grab (e-canvas.c:830)
==15829==    by 0x3DB1445B04: eti_event (e-table-item.c:196)
==15829==    by 0x3DAFC155D7: gnome_canvas_marshal_BOOLEAN__BOXED (gnome-canvas-marshal.c:128)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901ECFC: signal_emit_unlocked_R (gsignal.c:3290)
==15829==    by 0x33D90286AA: g_signal_emit_valist (gsignal.c:2993)
==15829==    by 0x33D9028C7C: g_signal_emit_by_name (gsignal.c:3077)
==15829==  Address 0x23f31cb4 is 0 bytes after a block of size 4 alloc'd
==15829==    at 0x4A04AF4: calloc (vg_replace_malloc.c:467)
==15829==    by 0x33DC409D5E: XIGrabDevice (XIGrabDevice.c:65)
==15829==    by 0x3DAE039320: gdk_x11_device_xi2_grab (gdkdevice-xi2.c:415)
==15829==    by 0x3DAE03073A: gdk_pointer_grab (gdkwindow.c:8706)
==15829==    by 0x3DAFC15DF0: gnome_canvas_item_grab (gnome-canvas.c:869)
==15829==    by 0x3DB084C85D: e_canvas_item_grab (e-canvas.c:830)
==15829==    by 0x3DB1445B04: eti_event (e-table-item.c:196)
==15829==    by 0x3DAFC155D7: gnome_canvas_marshal_BOOLEAN__BOXED (gnome-canvas-marshal.c:128)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901ECFC: signal_emit_unlocked_R (gsignal.c:3290)
==15829==    by 0x33D90286AA: g_signal_emit_valist (gsignal.c:2993)
==15829==    by 0x33D9028C7C: g_signal_emit_by_name (gsignal.c:3077)
==15829== 
==15829== Invalid read of size 2
==15829==    at 0x4A07B98: memcpy (mc_replace_strmem.c:628)
==15829==    by 0x33DC409E34: XIGrabDevice (string3.h:52)
==15829==    by 0x3DAE039320: gdk_x11_device_xi2_grab (gdkdevice-xi2.c:415)
==15829==    by 0x3DAE03073A: gdk_pointer_grab (gdkwindow.c:8706)
==15829==    by 0x3DAFC15DF0: gnome_canvas_item_grab (gnome-canvas.c:869)
==15829==    by 0x3DB084C85D: e_canvas_item_grab (e-canvas.c:830)
==15829==    by 0x3DB1445B04: eti_event (e-table-item.c:196)
==15829==    by 0x3DAFC155D7: gnome_canvas_marshal_BOOLEAN__BOXED (gnome-canvas-marshal.c:128)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901ECFC: signal_emit_unlocked_R (gsignal.c:3290)
==15829==    by 0x33D90286AA: g_signal_emit_valist (gsignal.c:2993)
==15829==    by 0x33D9028C7C: g_signal_emit_by_name (gsignal.c:3077)
==15829==  Address 0x23f31cb6 is 2 bytes after a block of size 4 alloc'd
==15829==    at 0x4A04AF4: calloc (vg_replace_malloc.c:467)
==15829==    by 0x33DC409D5E: XIGrabDevice (XIGrabDevice.c:65)
==15829==    by 0x3DAE039320: gdk_x11_device_xi2_grab (gdkdevice-xi2.c:415)
==15829==    by 0x3DAE03073A: gdk_pointer_grab (gdkwindow.c:8706)
==15829==    by 0x3DAFC15DF0: gnome_canvas_item_grab (gnome-canvas.c:869)
==15829==    by 0x3DB084C85D: e_canvas_item_grab (e-canvas.c:830)
==15829==    by 0x3DB1445B04: eti_event (e-table-item.c:196)
==15829==    by 0x3DAFC155D7: gnome_canvas_marshal_BOOLEAN__BOXED (gnome-canvas-marshal.c:128)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901ECFC: signal_emit_unlocked_R (gsignal.c:3290)
==15829==    by 0x33D90286AA: g_signal_emit_valist (gsignal.c:2993)
==15829==    by 0x33D9028C7C: g_signal_emit_by_name (gsignal.c:3077)
==15829== 
==15829== Invalid free() / delete / delete[]
==15829==    at 0x4A0556E: free (vg_replace_malloc.c:366)
==15829==    by 0x33D7C499D2: g_free (gmem.c:263)
==15829==    by 0x3DAE0218F8: gdk_event_free (gdkevents.c:648)
==15829==    by 0x33D9035932: g_value_unset (gvalue.c:275)
==15829==    by 0x33D902891B: g_signal_emit_valist (gsignal.c:3012)
==15829==    by 0x33D9028A91: g_signal_emit (gsignal.c:3040)
==15829==    by 0x3DB1444356: eti_event (e-table-item.c:2417)
==15829==    by 0x3DAFC155D7: gnome_canvas_marshal_BOOLEAN__BOXED (gnome-canvas-marshal.c:128)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901ECFC: signal_emit_unlocked_R (gsignal.c:3290)
==15829==    by 0x33D90286AA: g_signal_emit_valist (gsignal.c:2993)
==15829==    by 0x33D9028C7C: g_signal_emit_by_name (gsignal.c:3077)
==15829==  Address 0x2230ac20 is 0 bytes inside a block of size 16 free'd
==15829==    at 0x4A0556E: free (vg_replace_malloc.c:366)
==15829==    by 0x33D7C499D2: g_free (gmem.c:263)
==15829==    by 0x3DAE0218F8: gdk_event_free (gdkevents.c:648)
==15829==    by 0x33D9035932: g_value_unset (gvalue.c:275)
==15829==    by 0x33D902891B: g_signal_emit_valist (gsignal.c:3012)
==15829==    by 0x33D9028A91: g_signal_emit (gsignal.c:3040)
==15829==    by 0x3DB14653BD: item_double_click (e-tree.c:865)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901EEEA: signal_emit_unlocked_R (gsignal.c:3252)
==15829==    by 0x33D90288E9: g_signal_emit_valist (gsignal.c:2983)
==15829==    by 0x33D9028A91: g_signal_emit (gsignal.c:3040)
==15829==    by 0x3DB1444356: eti_event (e-table-item.c:2417)
==15829== 
==15829== Invalid free() / delete / delete[]
==15829==    at 0x4A0556E: free (vg_replace_malloc.c:366)
==15829==    by 0x33D7C499D2: g_free (gmem.c:263)
==15829==    by 0x3DAE0218F8: gdk_event_free (gdkevents.c:648)
==15829==    by 0x3DB084B31C: canvas_emit_event (e-canvas.c:159)
==15829==    by 0x3DAD948187: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:85)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901ECFC: signal_emit_unlocked_R (gsignal.c:3290)
==15829==    by 0x33D90286AA: g_signal_emit_valist (gsignal.c:2993)
==15829==    by 0x33D9028A91: g_signal_emit (gsignal.c:3040)
==15829==    by 0x3DADA69C98: gtk_widget_event_internal (gtkwidget.c:6066)
==15829==    by 0x3DAD9479E9: gtk_propagate_event (gtkmain.c:2588)
==15829==    by 0x3DAD947D82: gtk_main_do_event (gtkmain.c:1863)
==15829==  Address 0x2230ac20 is 0 bytes inside a block of size 16 free'd
==15829==    at 0x4A0556E: free (vg_replace_malloc.c:366)
==15829==    by 0x33D7C499D2: g_free (gmem.c:263)
==15829==    by 0x3DAE0218F8: gdk_event_free (gdkevents.c:648)
==15829==    by 0x33D9035932: g_value_unset (gvalue.c:275)
==15829==    by 0x33D902891B: g_signal_emit_valist (gsignal.c:3012)
==15829==    by 0x33D9028A91: g_signal_emit (gsignal.c:3040)
==15829==    by 0x3DB14653BD: item_double_click (e-tree.c:865)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901EEEA: signal_emit_unlocked_R (gsignal.c:3252)
==15829==    by 0x33D90288E9: g_signal_emit_valist (gsignal.c:2983)
==15829==    by 0x33D9028A91: g_signal_emit (gsignal.c:3040)
==15829==    by 0x3DB1444356: eti_event (e-table-item.c:2417)
==15829== 
==15829== Invalid free() / delete / delete[]
==15829==    at 0x4A0556E: free (vg_replace_malloc.c:366)
==15829==    by 0x33D7C499D2: g_free (gmem.c:263)
==15829==    by 0x3DAE0218F8: gdk_event_free (gdkevents.c:648)
==15829==    by 0x3DAE045A09: gdk_event_source_dispatch (gdkeventsource.c:320)
==15829==    by 0x33D7C42A9C: g_main_context_dispatch (gmain.c:2440)
==15829==    by 0x33D7C43277: g_main_context_iterate.isra.21 (gmain.c:3091)
==15829==    by 0x33D7C438B9: g_main_loop_run (gmain.c:3299)
==15829==    by 0x3DAD94722C: gtk_main (gtkmain.c:1349)
==15829==    by 0x402D5F: main (main.c:734)
==15829==  Address 0x2230ac20 is 0 bytes inside a block of size 16 free'd
==15829==    at 0x4A0556E: free (vg_replace_malloc.c:366)
==15829==    by 0x33D7C499D2: g_free (gmem.c:263)
==15829==    by 0x3DAE0218F8: gdk_event_free (gdkevents.c:648)
==15829==    by 0x33D9035932: g_value_unset (gvalue.c:275)
==15829==    by 0x33D902891B: g_signal_emit_valist (gsignal.c:3012)
==15829==    by 0x33D9028A91: g_signal_emit (gsignal.c:3040)
==15829==    by 0x3DB14653BD: item_double_click (e-tree.c:865)
==15829==    by 0x33D900E2DD: g_closure_invoke (gclosure.c:767)
==15829==    by 0x33D901EEEA: signal_emit_unlocked_R (gsignal.c:3252)
==15829==    by 0x33D90288E9: g_signal_emit_valist (gsignal.c:2983)
==15829==    by 0x33D9028A91: g_signal_emit (gsignal.c:3040)
==15829==    by 0x3DB1444356: eti_event (e-table-item.c:2417)

Comment 3 Matthew Barnes 2011-02-24 18:14:13 UTC

I haven't been able to reproduce this with gtk+ 3.0.0.

Suspect it was triggered by this commit for 3.0.1:
http://git.gnome.org/browse/gtk+/commit/?id=3f78b251b99f8bb301dae92ad94b6d1a6f66be96

I wouldn't call this a GTK+ bug yet.  I think more likely it uncovered a latent bug in Evo.

Comment 4 Matthew Barnes 2011-02-24 19:11:20 UTC

Turns out this is a GTK+ issues after all, introduced in 3.0.1.

*** This bug has been marked as a duplicate of bug 643207 ***