Bug 607324 – crasher doing table editing ...

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 607324 - crasher doing table editing ...


Summary:	crasher doing table editing ...


Status:	RESOLVED WONTFIX

Product:	GtkHtml
Classification:	Other
Component:	Editing
Version:	3.28.x
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	---
Assigned To:	Bharath Acharya
QA Contact:	Akhil Laddha

URL:
Whiteboard:	gnome[unmaintained]

Duplicates:	621030 (view as bug list)
Depends on:
Blocks:

Reported:	2010-01-18 16:04 UTC by Michael Meeks
Modified:	2017-02-09 13:37 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
html ... (7.67 KB, text/html) 2010-01-18 16:05 UTC, Michael Meeks	Details

Description Michael Meeks 2010-01-18 16:04:59 UTC

I start a new mail in Evolution; I paste the attached HTML in from firefox (nb. it needs to be HTML type) - of course switch the mail type to 'HTML'.

Then right click - and 'Delete Row' for the footer, Right click 'Delete Column' a few times for some boring looking columns.

Send mail -> bang:

0xffffe424 in __kernel_vsyscall ()

+ Trace 220126

#0 __kernel_vsyscall
#1 waitpid
from /lib/libpthread.so.0
#2 IA__g_spawn_sync
at gspawn.c line 386
#3 IA__g_spawn_command_line_sync
at gspawn.c line 700
#4 ??
from /usr/lib/gtk-2.0/modules/libgnomebreakpad.so
#5 ??
from /usr/lib/gtk-2.0/modules/libgnomebreakpad.so
#6 <signal handler called>
#7 html_object_destroy
at htmlobject.c line 1037
#8 delete_cells_undo_destroy
at htmlengine-edit-table.c line 319
#9 html_undo_data_unref
at htmlundo.c line 572
#10 html_undo_action_destroy
at htmlundo-action.c line 55
#11 destroy_action_list
at htmlundo.c line 79
#12 html_undo_destroy
at htmlundo.c line 107
#13 html_engine_finalize
at htmlengine.c line 4069
#14 IA__g_object_unref
at gobject.c line 2472
#15 destroy
at gtkhtml.c line 815
#16 IA__g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#17 g_type_class_meta_marshal
at gclosure.c line 878
#18 IA__g_closure_invoke
at gclosure.c line 767
#19 signal_emit_unlocked_R
at gsignal.c line 3363
#20 IA__g_signal_emit_valist
at gsignal.c line 2980
#21 IA__g_signal_emit
at gsignal.c line 3037
#22 gtk_object_dispose
at gtkobject.c line 421
#23 gtk_widget_dispose
at gtkwidget.c line 8370
#24 IA__g_object_run_dispose
at gobject.c line 815
#25 IA__gtk_object_destroy
at gtkobject.c line 406
#26 gtk_bin_forall
at gtkbin.c line 128
#27 gtk_scrolled_window_forall
at gtkscrolledwindow.c line 1079
#28 IA__gtk_container_foreach
at gtkcontainer.c line 1526
#29 gtk_container_destroy
at gtkcontainer.c line 1066
#30 gtk_scrolled_window_destroy
at gtkscrolledwindow.c line 868
#31 IA__g_cclosure_marshal_VOID__VOID
at gmarshal.c line 77
#32 g_type_class_meta_marshal
at gclosure.c line 878
#33 IA__g_closure_invoke
at gclosure.c line 767
#34 signal_emit_unlocked_R


100% repeatable; I have:

gtkhtml2-3.28.2-0.1.13
evolution-2.28.2-0.1.5

on SLED11-SP1.

Comment 1 Michael Meeks 2010-01-18 16:05:37 UTC

Created attachment 151677 [details]
html ...

Comment 2 Rodney Dawes 2010-01-18 16:29:20 UTC

Wrong gtkhtml... moving to the right one.

Comment 3 Akhil Laddha 2010-01-19 05:09:29 UTC

Looks like there are many old duplicates bug 234594 , bug 227608 and bug 268225

Comment 4 Matthew Barnes 2010-02-10 18:44:26 UTC

Not a blocker.

Comment 5 Akhil Laddha 2010-06-09 03:47:06 UTC

*** Bug 621030 has been marked as a duplicate of this bug. ***

Comment 6 Bharath Acharya 2010-06-09 04:05:24 UTC

Committed to master and stable branches.
http://git.gnome.org/browse/gtkhtml/commit/?id=a77b5eb2f0197e524127a8b2d43128c9b5193fa0

Comment 7 Milan Crha 2010-09-07 15:44:45 UTC

I'm reopening and reverting this fix, in gtkhtml master, because with it every html object leaks, thus this is not the right fix. I'm sorry.

Comment 8 Michael Meeks 2010-09-08 09:29:20 UTC

grief - if we are not highly suspicious about a 'fix' for a Free Memory Read that just removes the 'free' ;-) then we have problems; Bharath ?

Comment 9 Bharath Acharya 2010-09-08 09:57:12 UTC

Well the entire problem was mine :) Sorry about this so called 'fix' :) The undo operation freed it twice, instead of removing the bad one, I seem to have removed the main one which affected others too.

Comment 10 André Klapper 2017-02-09 13:37:02 UTC

GtkHtml is not under active development anymore. 
Evolution (its main consumer) switched to a WebKit backend a while ago. 
It is currently unlikely that there will be any further GtkHtml development.

Closing this report as WONTFIX as part of Bugzilla Housekeeping (bug 778387) to reflect reality. Please feel free to reopen this bug report in the future if anyone takes the responsibility for active development again.