GNOME Bugzilla – Bug 759101
Unset old cursor after clean up of the message list
Last modified: 2016-02-17 18:16:05 UTC
Hi, reproducible evolution at deleting imap folders with a "Segmentation fault". The traceback are: [New Thread 0x7fff4ffff700 (LWP 15356)] [New Thread 0x7fff43df4700 (LWP 15357)] Program received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) bt
+ Trace 235789
-- System Information: Debian Release: stretch/sid APT prefers testing APT policy: (900, 'testing'), (800, 'unstable'), (500, 'testing-updates'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.2.0-1-amd64 (SMP w/6 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages evolution depends on: ii dbus 1.10.4-1 ii debconf [debconf-2.0] 1.5.58 ii evolution-common 3.18.2-1 ii evolution-data-server 3.18.2-1 ii libc6 2.19-22 ii libcamel-1.2-54 3.18.2-1 ii libclutter-gtk-1.0-0 1.6.6-1 ii libecal-1.2-19 3.18.2-1 ii libedataserver-1.2-21 3.18.2-1 ii libevolution 3.18.2-1 ii libglib2.0-0 2.46.2-1 ii libgtk-3-0 3.18.5-1 ii libical1a 1.0.1-0.1 ii libnotify4 0.7.6-2 ii libsoup2.4-1 2.52.1-1 ii libwebkitgtk-3.0-0 2.4.9-2+b1 ii libxml2 2.9.2+zdfsg1-4 ii psmisc 22.21-2.1+b1 Versions of packages evolution recommends: ii bogofilter 1.2.4+dfsg1-3 ii evolution-plugins 3.18.2-1 ii yelp 3.16.1-1 Versions of packages evolution suggests: pn evolution-ews <none> pn evolution-plugins-experimental <none> ii gnupg 1.4.19-6 ii network-manager 1.0.8-1 -- debconf information: evolution/kill_processes: evolution/needs_shutdown:
Thanks for taking the time to report this. This particular bug has already been reported into our bug tracking system, but we are happy to tell you that the problem has already been fixed in the code repository. *** This bug has been marked as a duplicate of bug 757789 ***
I'm reopening this. I found out a different circumstances, which could cause the crash even with changes from bug #757789.
The other instance was related to message delete. It could happen that the message list had been regenerated from scratch, but the stored cursor node had been left there, already deleted. That was a use-after-free, which resulted in an odd pointer dereference in the is_node_selectable() function. I made the cursor reset in the code, to avoid this. Created commit 647275a in evo master (3.19.91+)