GNOME Bugzilla – Bug 612344
Crash in html_object_prev_not_type at htmlobject.c line 1384
Last modified: 2010-12-01 15:09:34 UTC
What were you doing when the application crashed? I'v just clicked on "add link?" buttom. Distribution: Debian squeeze/sid Gnome Release: 2.28.2 2009-12-18 (Debian) BugBuddy Version: 2.28.0 System: Linux 2.6.32-trunk-amd64 #1 SMP Sun Jan 10 22:40:40 UTC 2010 x86_64 X Vendor: The X.Org Foundation X Vendor Release: 10605000 Selinux: No Accessibility: Disabled GTK+ Theme: Litoral Icon Theme: gnome GTK+ Modules: gnomebreakpad, canberra-gtk-module Memory status: size: 753844224 vsize: 753844224 resident: 72650752 share: 35532800 rss: 72650752 rss_rlim: 18446744073709551615 CPU usage: start_time: 1268168357 rtime: 2536 utime: 2270 stime: 266 cutime:0 cstime: 3 timeout: 0 it_real_value: 0 frequency: 100 Backtrace was generated from '/usr/bin/evolution' [Thread debugging using libthread_db enabled] [New Thread 0x7f00426fe910 (LWP 3387)] [New Thread 0x7f0040c24910 (LWP 3386)] [New Thread 0x7f004414e910 (LWP 3236)] [New Thread 0x7f004494f910 (LWP 3235)] [New Thread 0x7f004535a910 (LWP 3233)] [New Thread 0x7f0047817910 (LWP 3232)] 0x00007f005ce6051d in __libc_waitpid (pid=3733, stat_loc=<value optimized out>, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:41 in ../sysdeps/unix/sysv/linux/waitpid.c
+ Trace 220888
Thread 1 (Thread 0x7f00622057f0 (LWP 3214))
A debugging session is active. Inferior 1 [process 3214] will be detached. Quit anyway? (y or n) [answered Y; input not from terminal] ----------- .xsession-errors --------------------- ** (epiphany:3690): DEBUG: NP_Initialize ** (epiphany:3690): DEBUG: NP_Initialize succeeded ** (epiphany:3690): DEBUG: NP_Initialize ** (epiphany:3690): DEBUG: NP_Initialize succeeded ** (epiphany:3690): DEBUG: NP_Shutdown ** (epiphany:3690): DEBUG: NP_Initialize ** (epiphany:3690): DEBUG: NP_Initialize succeeded ** (epiphany:3690): DEBUG: NP_Shutdown ** (epiphany:3690): DEBUG: NP_Initialize ** (epiphany:3690): DEBUG: NP_Initialize succeeded ** (epiphany:3690): DEBUG: NP_Initialize ** (epiphany:3690): DEBUG: NP_Initialize succeeded (evolution:3214): gtkhtml-editor-WARNING **: cs-CZ: No such language 41 ../sysdeps/unix/sysv/linux/waitpid.c: Adresář nebo soubor neexistuje. --------------------------------------------------
Thanks for taking the time to report this bug. Unfortunately, that stack trace is missing some elements that will help a lot to solve the problem, so it will be hard for the developers to fix that crash. Could you please install some debugging packages [1], start the application as normal, and reproduce the crash, if possible? Once bug-buddy pops up, you can find the stacktrace in the Details, now containing way more information. Please copy that stacktrace and paste it as a comment here. Thanks in advance! [1] debugging packages for evolution, evolution-data-server, evolution-exchange, gtkhtml2, gtk2 and glib2 (as far as those packages are provided by your distribution). More details can be found here: http://live.gnome.org/GettingTraces
We got a similar backtrace at: https://bugs.edge.launchpad.net/evolution/+bug/523300 ".
+ Trace 221088
Thread 1 (process 2548)
Downstream bug report about the same in 3.32.1: https://bugzilla.redhat.com/show_bug.cgi?id=656346 Steps: 1. Copied text that was a hyperlink from a webpage. 2. Pasted into e-mail reply. 3. Highlighted already-linked text and clicked the insert link button. 4. Crash.
Created attachment 175624 [details] [review] gtkhtml patch for gtkhtml; I was able to reproduce this with steps from the previous comment. The issue was with the 'link_object', which was a cache of the object where the cursor was standing last time, with a link. Seeing its usage it was pretty unnecessary to cache this, so I removed it and it works as expected, as far as I can tell, even when pasting text, which is later normalized, which also means that particular object can be deleted, thus the cached object pointed to already freed memory.
Created commit fdb840a in gtkhtml master (3.91.4+) Created commit 39aacb8 in gtkhtml gnome-2-32 (3.32.2+)