Bug 675442 – Crash in ews_active_job_done()

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 675442 - Crash in ews_active_job_done()


Summary:	Crash in ews_active_job_done()


Status:	RESOLVED FIXED

Product:	evolution-ews
Classification:	Other
Component:	Account Setup Plugin
Version:	3.5.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	Evolution EWS maintainer(s)
QA Contact:	Evolution EWS maintainer(s)

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2012-05-04 12:43 UTC by Matthew Barnes
Modified:	2012-07-18 19:23 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
ews patch (3.06 KB, patch) 2012-07-18 19:20 UTC, Milan Crha	committed	Details \| Review

Description Matthew Barnes 2012-05-04 12:43:44 UTC

Was setting up a new Evolution-EWS account.  Clicked Apply in the Account Assistant.

Running the git HEAD revision from May 3 (unreleased version 3.5.2).

Program received signal SIGSEGV, Segmentation fault.

+ Trace 230180

Thread 2731531120 (LWP 22989)

#0 g_type_check_instance
at gtype.c line 4075
#1 g_signal_handler_disconnect
at gsignal.c line 2560
#2 ews_active_job_done
at e-ews-connection.c line 359
#3 ews_response_cb
at e-ews-connection.c line 534
#4 ??
from /usr/lib/i386-linux-gnu/libsoup-2.4.so.1
#5 ??
from /usr/lib/i386-linux-gnu/libsoup-2.4.so.1
#6 ??
from /usr/lib/i386-linux-gnu/libsoup-2.4.so.1
#7 g_idle_dispatch
at gmain.c line 4634
#8 g_main_dispatch
at gmain.c line 2515
#9 g_main_context_dispatch
at gmain.c line 3052
#10 g_main_context_iterate
at gmain.c line 3123
#11 g_main_loop_run
at gmain.c line 3317
#12 e_ews_soup_thread
at e-ews-connection.c line 1063
#13 g_thread_proxy
at gthread.c line 801
#14 g_deprecated_thread_proxy
at deprecated/gthread-deprecated.c line 309
#15 start_thread
at pthread_create.c line 304
#16 clone
at ../sysdeps/unix/sysv/linux/i386/clone.S line 130

Comment 1 Matthew Barnes 2012-05-04 12:44:58 UTC

Let me know if you need to see the libsoup symbols and I can try to reproduce the crash with the same git revision.

Comment 2 Milan Crha 2012-07-18 11:04:29 UTC

Donwstream bug report about the same in 3.4.3, only from usual folder/message operations:
https://bugzilla.redhat.com/show_bug.cgi?id=809866

+ Trace 230531

Thread 1 (Thread 0xaebeeb40 (LWP 12084))

#0 g_type_check_instance
at gtype.c line 4073
#1 g_signal_handler_disconnect
at gsignal.c line 2564
#2 ews_active_job_done
at e-ews-connection.c line 433
#3 ews_response_cb
at e-ews-connection.c line 606
#4 process_queue_item
at soup-session-async.c line 432
#5 run_queue
at soup-session-async.c line 467
#6 idle_run_queue
at soup-session-async.c line 494
#7 g_idle_dispatch
at gmain.c line 4657
#8 g_main_dispatch
at gmain.c line 2539
#9 g_main_context_dispatch
at gmain.c line 3075
#10 g_main_context_iterate
at gmain.c line 3146
#11 g_main_loop_run
at gmain.c line 3340
#12 e_ews_soup_thread
at e-ews-connection.c line 1126
#13 g_thread_proxy
at gthread.c line 801
#14 start_thread
from /lib/libpthread.so.0
#15 clone
from /lib/libc.so.6

Comment 3 Milan Crha 2012-07-18 19:20:50 UTC

Created attachment 219154 [details] [review]
ews patch

for evolution-ews;

I cannot reproduce this, but it seems to me that the ews_node->cancellable was freed before ews_node was done with it. This is possible, because ews_active_job_done() runs in soup_thread. Adding ref and unref on particular places may fix this issue.

Comment 4 Milan Crha 2012-07-18 19:23:46 UTC

Created commit 6b447b3 in ews master (3.5.5+)
Created commit 1357a06 in ews gnome-3-4 (3.4.4+)