Bug 471687 – crash selecting mail content ...

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 471687 - crash selecting mail content ...


Summary:	crash selecting mail content ...


Status:	RESOLVED FIXED

Product:	GtkHtml
Classification:	Other
Component:	Rendering
Version:	3.18.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	gtkhtml-maintainers
QA Contact:	Evolution QA team

URL:
Whiteboard:

Duplicates:	491958 491961 491962 500837 535172 (view as bug list)
Depends on:
Blocks:

Reported:	2007-08-30 03:53 UTC by Akhil Laddha
Modified:	2009-11-03 15:51 UTC

See Also:
GNOME target:	---
GNOME version:	2.21/2.22

Description Akhil Laddha 2007-08-30 03:53:02 UTC

If I start a selection by pressing shuft select and press page-down a few times
to extend it downwards (over the HTML table): bang ...

Program received signal SIGSEGV, Segmentation fault.
(gdb) bt

+ Trace 158954

#0 op_copy
at htmltable.c line 182
#1 html_object_op_copy
at htmlobject.c line 888
#2 op_helper
at htmlclue.c line 156
#3 op_helper
at htmlclueflow.c line 273
#4 html_object_op_copy
at htmlobject.c line 888
#5 op_helper
at htmlclue.c line 156
#6 html_object_op_copy
at htmlobject.c line 888
#7 html_engine_copy_object
at htmlengine-edit-cut-and-paste.c line 370
#8 html_engine_activate_selection
at htmlselection.c line 406
#9 html_engine_update_selection_active_state
at htmlselection.c line 426
#10 command
at gtkhtml.c line 4584
#11 html_g_cclosure_marshal_BOOLEAN__ENUM
at htmlmarshal.c line 122
#12 g_type_class_meta_marshal
at gclosure.c line 569
#13 g_closure_invoke
at gclosure.c line 492
#14 signal_emit_unlocked_R
at gsignal.c line 2523
#15 g_signal_emitv
at gsignal.c line 2156
#16 gtk_binding_entry_activate
at gtkbindings.c line 526
#17 binding_match_activate
at gtkbindings.c line 928
#18 gtk_bindings_activate_list
at gtkbindings.c line 1063
#19 IA__gtk_bindings_activate_event
at gtkbindings.c line 1139
#20 gtk_widget_real_key_press_event
at gtkwidget.c line 3476
#21 key_press_event
at gtkhtml.c line 919
#22 _gtk_marshal_BOOLEAN__BOXED
at gtkmarshalers.c line 83
#23 g_type_class_meta_marshal
at gclosure.c line 569
#24 g_closure_invoke
at gclosure.c line 492
#25 signal_emit_unlocked_R
at gsignal.c line 2523
#26 g_signal_emit_valist
at gsignal.c line 2254
#27 g_signal_emit
at gsignal.c line 2288
#28 gtk_widget_event_internal
at gtkwidget.c line 3735
#29 IA__gtk_window_propagate_key_event
at gtkwindow.c line 4517
#30 gtk_window_key_press_event
at gtkwindow.c line 4547
#31 ??
from /opt/gnome/lib/libbonoboui-2.so.0

Comment 1 Akhil Laddha 2007-08-30 03:56:47 UTC

Looks dup of either http://bugzilla.gnome.org/show_bug.cgi?id=222062
or http://bugzilla.gnome.org/show_bug.cgi?id=269748

Comment 2 André Klapper 2007-12-19 03:35:02 UTC

*** Bug 500837 has been marked as a duplicate of this bug. ***

Comment 3 André Klapper 2007-12-19 03:35:04 UTC

*** Bug 491962 has been marked as a duplicate of this bug. ***

Comment 4 André Klapper 2007-12-19 03:35:06 UTC

*** Bug 491961 has been marked as a duplicate of this bug. ***

Comment 5 André Klapper 2007-12-19 03:35:08 UTC

*** Bug 491958 has been marked as a duplicate of this bug. ***

Comment 6 Milan Crha 2008-01-22 16:35:28 UTC

Hmm, I cannot reproduce it, somehow. Do you have any special mail and text portion to reproduce this?

Comment 7 Akhil Laddha 2008-01-23 04:03:57 UTC

Milan, 
      Srini knows more details about the bug.I just filed the bug for him.It will be better to ask him. Thanks !

Comment 8 Akhil Laddha 2008-01-23 04:18:06 UTC

BNC bug https://bugzilla.novell.com/show_bug.cgi?id=293904

Comment 9 Milan Crha 2008-02-26 19:06:07 UTC

srag ping

Comment 10 Srinivasa Ragavan 2008-02-27 04:23:57 UTC

Milan, Michael was the original downstream reporter.

Comment 11 Akhil Laddha 2008-09-03 06:19:38 UTC

*** Bug 535172 has been marked as a duplicate of this bug. ***

Comment 12 Akhil Laddha 2008-09-03 06:20:24 UTC

last dup in 3.18.x

Comment 13 Tobias Mueller 2009-03-22 00:10:52 UTC

Hm. I am going to close this bug as OBSOLETE then...

Comment 14 Bastien Nocera 2009-08-04 14:07:27 UTC

I can reproduce at will trying to remove gunk from a forwarded message (it crashes while using shift+arrows to select the text).

gtkhtml3-3.26.3-1.fc11.x86_64
evolution-2.26.3-1.fc11.x86_64

+ Trace 216783

#0 op_copy
at htmltable.c line 185
#1 op_helper
at htmlclue.c line 160
#2 op_copy
at htmlclue.c line 177
#3 op_helper
at htmlclueflow.c line 275
#4 op_copy
at htmlclueflow.c line 287
#5 op_helper
at htmlclue.c line 160
#6 op_copy
at htmlclue.c line 177
#7 html_engine_copy_object
at htmlengine-edit-cut-and-paste.c line 397
#8 move_selection
at gtkhtml.c line 4989
#9 command
at gtkhtml.c line 5111
#10 html_g_cclosure_marshal_BOOLEAN__ENUM
at htmlmarshal.c line 122
#11 IA__g_closure_invoke
at gclosure.c line 767
#12 signal_emit_unlocked_R
at gsignal.c line 3285
#13 ??
from /usr/lib64/libgtk-x11-2.0.so.0
#14 ??
from /usr/lib64/libgtk-x11-2.0.so.0
#15 ??
from /usr/lib64/libgtk-x11-2.0.so.0
#16 gtk_bindings_activate_event
from /usr/lib64/libgtk-x11-2.0.so.0
#17 key_press_event
at gtkhtml.c line 1052
#18 ??
from /usr/lib64/libgtk-x11-2.0.so.0
#19 IA__g_closure_invoke
at gclosure.c line 767
#20 signal_emit_unlocked_R
at gsignal.c line 3285
#21 IA__g_signal_emit_valist
at gsignal.c line 2990
#22 IA__g_signal_emit
at gsignal.c line 3037
#23 ??
from /usr/lib64/libgtk-x11-2.0.so.0
#24 gtk_window_propagate_key_event
from /usr/lib64/libgtk-x11-2.0.so.0
#25 ??
from /usr/lib64/libgtk-x11-2.0.so.0
#26 ??
from /usr/lib64/libgtk-x11-2.0.so.0
#27 IA__g_closure_invoke
at gclosure.c line 767
#28 signal_emit_unlocked_R
at gsignal.c line 3285
#29 IA__g_signal_emit_valist
at gsignal.c line 2990
#30 IA__g_signal_emit
at gsignal.c line 3037
#31 ??
from /usr/lib64/libgtk-x11-2.0.so.0
#32 gtk_propagate_event
from /usr/lib64/libgtk-x11-2.0.so.0
#33 gtk_main_do_event
from /usr/lib64/libgtk-x11-2.0.so.0
#34 ??
from /usr/lib64/libgdk-x11-2.0.so.0
#35 g_main_dispatch
at gmain.c line 1824
#36 IA__g_main_context_dispatch
at gmain.c line 2377
#37 g_main_context_iterate
at gmain.c line 2455
#38 IA__g_main_loop_run
at gmain.c line 2663
#39 bonobo_main
at bonobo-main.c line 311
#40 main
at main.c line 704

Comment 15 Bastien Nocera 2009-08-04 14:11:33 UTC

For me to find it again:
Message-Id: <1249391496.3375.577.camel@handsome-monkey-king>

180		t  = HTML_TABLE (self);
181		nt = g_new0 (HTMLTable, 1);
182	
183		start = HTML_TABLE_CELL ((from && from->next) ? from->data : html_object_head (self));
184		end   = HTML_TABLE_CELL ((to && to->next)     ? to->data   : html_object_tail (self));
185		rows  = end->row - start->row + 1;
186		cols  = end->row == start->row ? end->col - start->col + 1 : t->totalCols;
187	
188		copy_sized (self, HTML_OBJECT (nt), rows, cols);
189	

(gdb) p start
$3 = (HTMLTableCell *) 0x0

Huh.

Comment 16 Milan Crha 2009-08-04 14:55:30 UTC

Thanks for the update, Bastien. Could you share the test mail with some exact steps what portion to select and such, please? Of course only if it doesn't contain any private information. (I believe the message HTML part structure is important here only, not whom it sent or what information it contained).

Comment 17 Akhil Laddha 2009-11-02 07:18:09 UTC

Simon Brys has attached a patch in downstream bug which solves crash for him. 

--- gtkhtml/htmltable.c.ori	2009-09-17 11:33:12.000000000 +0200
+++ gtkhtml/htmltable.c	2009-09-17 11:35:23.000000000 +0200
@@ -182,6 +182,13 @@
 
 	start = HTML_TABLE_CELL ((from && from->next) ? from->data : html_object_head (self));
 	end   = HTML_TABLE_CELL ((to && to->next)     ? to->data   : html_object_tail (self));
+
+	if (!start || !end) {
+		copy_sized (self, HTML_OBJECT (nt), 0, 0);
+		(*len) ++;
+		return HTML_OBJECT (nt);
+	}
+
 	rows  = end->row - start->row + 1;
 	cols  = end->row == start->row ? end->col - start->col + 1 : t->totalCols;

Comment 18 Milan Crha 2009-11-03 14:45:16 UTC

I cannot reproduce it now, with 2.28.1, without the above patch. I'm willing to include this in sources, I just want to test it first. Do we have some reproducer, please? I tried to build some test HTML message, with some tables/link/image but no luck with a selection crash.

Comment 19 Bastien Nocera 2009-11-03 14:58:28 UTC

Sent you a reproducer privately.

Comment 20 Milan Crha 2009-11-03 15:51:04 UTC

Great, thanks, I can reproduce it with your message, but I cannot with the patch applied, thus:

Created commit 5147eac in gtkhtml master (3.29.2+)
Created commit 2956681 in gtkhtml gnome-2-28 (3.28.2+)