GNOME Bugzilla – Bug 441372
Repeating evermore segfault in calc_dimension htmlframeset.c
Last modified: 2007-05-30 18:39:13 UTC
Steps to reproduce: 1. Receive attached email from eWeek in evolution using gtkhtml 3.12.3 2. Click on the title 3. evolution crashes repeatedly until you run it under gdb, use a command list to set the offending variable to zero every time it hits the code, and then click on a different email. Normal users would have to delete their inbox. It is very easy to patch htmlframeset.c so the crash doesn't happen, and the patch is obviously harmless even after the underlying cause is fixed. The email will be attached to this bug. Stack trace: Distribution: Fedora Core release 6 (Zod) Gnome Release: 2.16.3 2007-01-31 (Red Hat, Inc) BugBuddy Version: 2.16.0 System: Linux 2.6.20-1.2933.fc6 #1 SMP Mon Mar 19 10:42:48 EDT 2007 i686 X Vendor: The X.Org Foundation X Vendor Release: 70101000 Selinux: Permissive Accessibility: Disabled Memory status: size: 163168256 vsize: 0 resident: 163168256 share: 0 rss: 28884992 rss_rlim: 0 CPU usage: start_time: 1180103347 rtime: 0 utime: 433 stime: 0 cutime:386 cstime: 0 timeout: 47 it_real_value: 0 frequency: 0 Backtrace was generated from '/usr/bin/evolution' Using host libthread_db library "/lib/libthread_db.so.1". [Thread debugging using libthread_db enabled] [New Thread -1208842016 (LWP 8453)] [New Thread -1324524656 (LWP 8469)] [New Thread -1314034800 (LWP 8468)] [New Thread -1303135344 (LWP 8467)] [New Thread -1267229808 (LWP 8463)] [New Thread -1245856880 (LWP 8462)] [New Thread -1256346736 (LWP 8461)] [New Thread -1235367024 (LWP 8458)] 0x00e36402 in __kernel_vsyscall ()
+ Trace 136119
Thread 1 (Thread -1208842016 (LWP 8453))
Other information: --- usr-src-debug-gtkhtml-3.12.3-src-htmlframeset.c~ 2007-05-26 02:17:21.000000000 -0400 +++ usr-src-debug-gtkhtml-3.12.3-src-htmlframeset.c 2007-05-26 02:19:17.000000000 -0400 @@ -95,7 +95,7 @@ int remain; int num_frac = 0; - remain = total; + remain = (dim->len > 0 ? total : 0); for (i = 0; i < dim->len; i++) { len = g_ptr_array_index (dim, i); span[i] = 0;
Created attachment 88833 [details] email from eWeek which triggered crash You don't need to confirm the crash or get this email to cause it. Just apply the patch so poor users won't have to delete their inbox to get evolution to work. But to fix the underlying problem (why was calc_dimension called with span == 0?) you might need this email.
Created attachment 88834 [details] [review] Proposed patch This patch will save users from having to delete their inbox to get evolution to come up. Just apply it!
+ Trace 136866
This stack trace is due to the implementation of the new spinner animation in evolution. This is dupe of bug #338921 I'll fix that for 2.11.3 *** This bug has been marked as a duplicate of 338921 ***