After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 682322 - SIGSEGV in pop3_folder_refresh_info_sync at camel-pop3-folder.c:701
SIGSEGV in pop3_folder_refresh_info_sync at camel-pop3-folder.c:701
Status: RESOLVED FIXED
Product: evolution
Classification: Applications
Component: Mailer
3.6.x (obsolete)
Other Linux
: Normal critical
: ---
Assigned To: evolution-mail-maintainers
Evolution QA team
Depends on:
Blocks:
 
 
Reported: 2012-08-21 01:47 UTC by David Ronis
Modified: 2013-07-16 12:21 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
eds patch (3.29 KB, patch)
2013-06-26 16:58 UTC, Milan Crha
committed Details | Review

Description David Ronis 2012-08-21 01:47:05 UTC
I'm running this morning's git/master of evo and related components.   I was updating my main Inbox (one of the feed accounts is pop3) and crashed.  I'd been running evo for ca 5 min.

Here's a backtrace:

 Program terminated with signal 11, Segmentation fault.

Thread 12 (Thread 0xb240a860 (LWP 14826))

  • #0 __x86.get_pc_thunk.bx
    from /opt/garnome-3.5/lib/libedataserver-1.2.so.17
  • #1 e_source_compare_by_display_name
    at e-source.c line 2245
  • #2 g_list_sort_merge
    at glist.c line 1059
  • #3 g_list_sort_real
    at glist.c line 1105
  • #4 g_list_sort_real
    at glist.c line 1105
  • #5 g_list_sort_real
    at glist.c line 1105
  • #6 g_list_sort_real
    at glist.c line 1105
  • #7 g_list_sort
    at glist.c line 1141
  • #8 e_source_registry_list_sources
    at e-source-registry.c line 2192
  • #9 em_utils_folder_is_drafts
    at e-mail-utils.c line 90
  • #10 update_1folder
    at mail-folder-cache.c line 363
  • #11 setup_folder
    at mail-folder-cache.c line 553
  • #12 create_folders
    at mail-folder-cache.c line 582
  • #13 update_folders
    at mail-folder-cache.c line 851
  • #14 g_simple_async_result_complete
    at gsimpleasyncresult.c line 775
  • #15 complete_in_idle_cb_for_thread
    at gsimpleasyncresult.c line 843
  • #16 g_idle_dispatch
    at gmain.c line 4797
  • #17 g_main_dispatch
    at gmain.c line 2707
  • #18 g_main_context_dispatch
    at gmain.c line 3211
  • #19 g_main_context_iterate
    at gmain.c line 3282
  • #20 g_main_loop_run
    at gmain.c line 3476
  • #21 gtk_main
    at gtkmain.c line 1162
  • #22 main
    at main.c line 674

Thread 1 (Thread 0x9a4ffb70 (LWP 15011))

  • #0 pop3_folder_refresh_info_sync
    at camel-pop3-folder.c line 701
  • #1 camel_folder_refresh_info_sync
    at camel-folder.c line 3989
  • #2 camel_pop3_folder_new
    at camel-pop3-folder.c line 967
  • #3 pop3_store_get_folder_sync
    at camel-pop3-store.c line 698
  • #4 store_get_inbox_folder_sync
    at camel-store.c line 317
  • #5 camel_store_get_inbox_folder_sync
    at camel-store.c line 2226
  • #6 e_mail_session_get_inbox_sync
    at e-mail-session.c line 2067
  • #7 fetch_mail_exec
    at mail-ops.c line 296
  • #8 mail_msg_proxy
    at mail-mt.c line 423
  • #9 g_thread_pool_thread_proxy
    at gthreadpool.c line 309
  • #10 g_thread_proxy
    at gthread.c line 801
  • #11 start_thread
    from /lib/libpthread.so.0
  • #12 clone
    from /lib/libc.so.6

Comment 1 Milan Crha 2012-08-21 07:24:02 UTC
Thanks for a bug report. I think, on the first look, that pop3_store->engine is either NULL or some garbage pointer, but the question is why such thing happened. I suppose this is basically the first time you faced this crash, did you?
Comment 2 David Ronis 2012-08-21 17:18:42 UTC
Yes, this seems to be something I've not seen before.
Comment 3 Milan Crha 2012-12-17 14:04:06 UTC
Similar downstream bug report from 3.6.2:
https://bugzilla.redhat.com/show_bug.cgi?id=887399

Description of problem:
The last action before Evolution disappeared from the display and was replaced by the Automatic Bug Reporting Tool was to expunge Trash.

Version-Release number of selected component:
evolution-3.6.2-3.fc18

Core was generated by `evolution'.
Program terminated with signal 11, Segmentation fault.

Thread 1 (Thread 0x7fb2bffff700 (LWP 10338))

  • #0 pop3_folder_refresh_info_sync
    at camel-pop3-folder.c line 729
  • #1 camel_folder_refresh_info_sync
    at camel-folder.c line 3991
  • #2 camel_pop3_folder_new
    at camel-pop3-folder.c line 1027
  • #3 store_get_inbox_folder_sync
    at camel-store.c line 317
  • #4 camel_store_get_inbox_folder_sync
    at camel-store.c line 2226
  • #5 mail_folder_expunge_pop3_stores
    at e-mail-folder-utils.c line 332
  • #6 e_mail_folder_expunge_sync
    at e-mail-folder-utils.c line 430
  • #7 mail_folder_expunge_thread
    at e-mail-folder-utils.c line 200
  • #8 run_in_thread
    at gsimpleasyncresult.c line 869
  • #9 io_job_thread
    at gioscheduler.c line 162
  • #10 g_thread_pool_thread_proxy
    at gthreadpool.c line 309
  • #11 g_thread_proxy
    at gthread.c line 797
  • #12 start_thread
    at pthread_create.c line 308
  • #13 clone
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 114

Comment 4 Brian J. Murrell 2013-01-17 12:46:53 UTC
I've also run into this on FC18 evolution-3.6.2-3.2.fc18 also.
Comment 5 Brian J. Murrell 2013-01-22 12:26:50 UTC
In fact, I seem to run into it every day now.  Every morning when I start work, evolution has crashed and needs to be restarted.  I have lots of Fedora/RH abrt reports if any more information is required.
Comment 6 Brian J. Murrell 2013-01-26 18:37:27 UTC
The frequency of this seems to have increased to about once or twice an hour now.  Very annoying to have to keep restarting evolution every time I come back to it to read new e-mail.

Any chance of getting this one fixed?
Comment 7 Milan Crha 2013-01-28 09:59:27 UTC
It usually depends on reproducibility. If it's reproducible on developer's machine(s), then it's usually easier to fix. What is your setting for the POP3 account. I see from the backtrace that his happens during folder expunge, thus I guess it's when expunging either On This Computer/Inbox or On This Computer/Trash. Am I right?
Comment 8 Brian J. Murrell 2013-01-28 12:05:53 UTC
(In reply to comment #7)
> It usually depends on reproducibility. If it's reproducible on developer's
> machine(s), then it's usually easier to fix.

Understandable.

> What is your setting for the POP3
> account.

Pretty typical with the exception that I am using GSSAPI to authenticate.

> I see from the backtrace that his happens during folder expunge, thus
> I guess it's when expunging either On This Computer/Inbox or On This
> Computer/Trash. Am I right?

Only if that expunging happens automagically on POP3 mailboxes.  As I mentioned before, it was happening every night (i.e. while I am not at the computer, so not issuing expunges myself) before it increased to pretty much once or twice an hour.  But again, it typically happens while I am not using it, so again, not issuing expunges, myself.
Comment 9 Milan Crha 2013-01-28 13:19:34 UTC
Thanks for the update. What is set in Edit->Preferences->Mail Accounts-><POP account->Edit->Receiving Options tab, please? And also at Edit->Preferences->Mail Preferences->General tab->Delete Mail section.
Comment 10 Brian J. Murrell 2013-01-28 13:37:47 UTC
(In reply to comment #9)
> Thanks for the update.

NPAA.  Whatever I can do to facilitate this.

> What is set in Edit->Preferences->Mail Accounts-><POP
> account->Edit->Receiving Options tab, please?

  * Check for new messages every 1 minutes
  * Leave messages on server

> And also at
> Edit->Preferences->Mail Preferences->General tab->Delete Mail section.

  o Empty trash folders on exit
  o Confirm when expunging a folder

where:

* == selected checkbox/item
o == unselected checkbox/item
Comment 11 Milan Crha 2013-02-01 14:13:39 UTC
Based on the backtrace from comment #3, one of configured POP3 accounts has both the options
 [x] Leave messages on server
 [x] Delete expunged from local Inbox
checked, otherwise it cannot get into that part of the code, unless it works with a garbage pointer, which was freed/unreffed incorrectly. Furthermore, pop3_folder_refresh_info_sync() is called in that backtrace only if the store is connected, which may not happen, because on update evolution always connects to the server and disconnects when the update is done. The complete backtrace in the downstream bug report doesn't suggest a thread interleaving here, hence I guess it's something else, probably the incorrect unref call. It might be noticeable when running evolution on console, there might be some critical warnings just before the crash.

I'd like to see a valgrind log for a crashing session, maybe it'll give a clue what happens here. You can run evolution under valgrind with this command:
   $ G_SLICE=always-malloc valgrind --num-callers=50 evolution &>log.txt
and let it running for some time. You mentioned it happens for you quite often, when not using it, thus it might be when evolution automatically updates content, as it can also expunge the folder content. I suppose, when you decrease automatic update interval for your POP3 (maybe also other) account(s), then the crash will exhibit itself more often.

I tried to reproduce this myself, but no luck, unfortunately. Neither valgrind claims anything related to me (only something from webkit). I hope it'll be easier for you to get the valgrind log. Please make sure you'll have installed proper (of the same version as the binary packages) debug info packages at least for evolution-data-server and evolution itself, thus the valgrind log will contain debugging information.
Comment 12 Brian J. Murrell 2013-02-02 05:39:52 UTC
OK.  It seems the mitigating factor here is using gssapi for pop3.  If I change it to Login or PLAIN the problem goes away.

Perhaps that helps in reproducing.
Comment 13 Milan Crha 2013-02-04 14:27:54 UTC
Thanks for the clarification. I do not have available any POP3 server with enabled and working GSSAPI authentication, but as soon as I find one, I'll return back here.
Comment 14 David Ronis 2013-02-04 18:36:19 UTC
I'm not sure this is relevant, but I don't use GSSAPI.  I'm using qpopper on the server and use SSL for encryption.
Comment 15 Milan Crha 2013-02-05 12:03:53 UTC
David, does it still crash for you too? I got a duplicate in the downstream bugzilla, but I cannot reproduce it myself, thought I use only a PLAIN authentication.
Comment 16 Brian J. Murrell 2013-06-14 18:59:52 UTC
So, I just got this without using GSSAPI.  I turned that off back around comment #12 time frame.

Currently using:

evolution-ews-3.6.4-1.fc18.x86_64
evolution-3.6.4-3.fc18.x86_64
evolution-data-server-3.6.4-4.fc18.x86_64
Comment 17 David Ronis 2013-06-14 19:51:45 UTC
Milan,

I haven't seen this one in a while.  As usual, I'm running recent git/masters.
Comment 18 Milan Crha 2013-06-26 13:04:18 UTC
I just got a similar downstream bug report from evolution-3.8.2-1.fc19:
https://bugzilla.redhat.com/show_bug.cgi?id=977927

Where the crash happened with lost connection to a pop3 server. I'll try to address this, it doesn't seem to be too complicated. (Reproducibility is a problem here, as is usual with crasher bugs.)

pop3_folder_refresh_info_sync (folder=0x2134710, cancellable=0x22b9000, error=0x22f7990) at camel-pop3-folder.c:729
729		if (!local_error && (pop3_store->engine->capa & CAMEL_POP3_CAP_UIDL) != 0)

Thread 1 (Thread 0x7f6839ff9700 (LWP 5280))

  • #0 pop3_folder_refresh_info_sync
    at camel-pop3-folder.c line 729
  • #1 camel_folder_refresh_info_sync
    at camel-folder.c line 4128
  • #2 camel_pop3_folder_new
    at camel-pop3-folder.c line 1027
  • #3 store_get_inbox_folder_sync
    at camel-store.c line 340
  • #4 camel_store_get_inbox_folder_sync
    at camel-store.c line 2301
  • #5 e_mail_session_get_inbox_sync
    at e-mail-session.c line 2098
  • #6 fetch_mail_exec
    at mail-ops.c line 314
  • #7 mail_msg_proxy
    at mail-mt.c line 426
  • #8 g_thread_pool_thread_proxy
    at gthreadpool.c line 309
  • #9 g_thread_proxy
    at gthread.c line 798
  • #10 start_thread
    at pthread_create.c line 308
  • #11 clone
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 113

Comment 19 Milan Crha 2013-06-26 16:58:26 UTC
Created attachment 247842 [details] [review]
eds patch

for evolution-data-server;

Event after changes from [1], the code didn't check for validity of the returned pointer, thus it could crash in the similar way, when dereferencing NULL pointer. These are, hopefully, the last bits of the crashes in the POP3 provider.

[1] https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=590dc3968326d63494627020d2139c82fcf5510b
Comment 20 Milan Crha 2013-06-26 17:01:37 UTC
Created commit ed65569 in eds master (3.9.4+)
Created commit 6aa6b97 in eds gnome-3-8 (3.8.4+)
Comment 21 Brian J. Murrell 2013-07-16 11:11:07 UTC
Will a 3.8.4 be cut any time soon?  This is an annoying crash.
Comment 22 Milan Crha 2013-07-16 12:21:31 UTC
Yes the planned date is July 22nd.