GNOME Bugzilla – Bug 696673
[abrt] Crash during message highlight
Last modified: 2013-04-12 14:44:23 UTC
Moving this from a downstream bug report: https://bugzilla.redhat.com/show_bug.cgi?id=928200 Description of problem: Changed search filter to 'Message contains...', and Evo crashed. Version-Release number of selected component: evolution-3.8.0-1.fc19 Additional info: backtrace_rating: 4 cmdline: evolution crash_function: strstr executable: /usr/bin/evolution kernel: 3.9.0-0.rc4.git0.1.fc19.x86_64 var_log_messages contains: Mar 26 23:26:10 adam /etc/gdm/Xsession[1562]: ** (evolution:17069): CRITICAL **: gchar* webkit_dom_character_data_get_data(WebKitDOMCharacterData*): assertion `WEBKIT_DOM_IS_CHARACTER_DATA(self)' failed
+ Trace 231688
Thread 1 (Thread 0x7f6f9109ba00 (LWP 17069))
I cannot reproduce the crash, it seems like it's related to certain message structure, but I just got a busy loop when searching for "Message contains" "a", the highlight phase, basically the same backtrace, doesn't want to stop and eats whole CPU.
*** Bug 697466 has been marked as a duplicate of this bug. ***
I can reproduce with this steps: - Select a folder. - try to search with subjects or address contains - press enter and display the results. - change the search options to body contains - crash
Sorry I can't reproduce it too (even with steps that you provided). Is it possible to send me that email that crashes evolution?
this is my evolution version. evolution-3.8.0-1.fc19.i686 evolution-mapi-3.8.0-1.fc19.i686 evolution-data-server-3.8.0-1.fc19.i686
(In reply to comment #5) > this is my evolution version. > evolution-3.8.0-1.fc19.i686 > evolution-mapi-3.8.0-1.fc19.i686 > evolution-data-server-3.8.0-1.fc19.i686 Can you also list your webkitgtk3 version? I'm seeing what Milan saw: no crash, but CPU pegged and the stack track is somewhere deep in WebCore while recursing over the DOM node tree. For me, "pkg-config --modversion webkitgtk-3.0" ==> 1.10.1
my webkit version is: webkitgtk3-2.0.0-1.fc19.i686 webkitgtk-1.10.2-6.fc19.i686 qtwebkit-2.3.0-2.fc19.i686 webkitgtk3-debuginfo-2.0.0-1.fc19.i686
That's it. I can reproduce the crash with webkitgtk3 2.0.0.
Created attachment 241142 [details] test message Tomas gave me a webkit 2.0.0 with some patch, which fixed the crash, but then I get into a busy lock, 1 core on 100% usage. It doesn't do every message, but I found one which does, it's this attached. My steps are basically the same as those above, but let me clarify some details: a) import the message to any On This Computer folder (it might not matter where it is imported, can be basically anywhere). b) enter the folder and set search to "Subject or Addresses contain" c) into Search field enter: rhyth d) press Enter and wait until the "Generating message list" is finished e) select the imported message, make sure preview panel is on f) change search type to Body contains And now I get either the crash (with vanilla webkigtk3 2.0.0) or a busy lock.
Might be worthwhile to verify there aren't cycles in the DOM node tree. Not sure if that's even possible, but the recursion code in e-web-view.c assumes there isn't. That's the only way that I can see how we'd be causing the busy loop.
Created attachment 241259 [details] [review] Proposed patch Fixes crash/busylock in highlighting also fixes clearing of highlights.
Review of attachment 241259 [details] [review]: One thing also found, not every highlight is removed (showed "online"). Good thing is no crash and no busy-loop. ::: e-util/e-web-view.c @@ +2457,3 @@ + gulong iframes_count, highlights_count; + gulong i, j; + This new block produces: e-web-view.c: In function 'e_web_view_clear_highlights': e-web-view.c:2454:2: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
Just for a completeness, I tested with webkitgtk3-2.0.0 and webkitgtk3-1.10.2
Created attachment 241328 [details] [review] Version utilizing WebKit This patch drops our implementation of highlighting and utilizes WebKit highlighting.
Review of attachment 241328 [details] [review]: Looks good, and doesn't crash. Please commit to master and gnome-3-8, thus it's part of 3.8.1 on Monday.
Review of attachment 241328 [details] [review]: +100 That's way better. Nice one, Tomas.
*** Bug 697804 has been marked as a duplicate of this bug. ***
Commited in https://git.gnome.org/browse/evolution/commit/?id=b9a1dcc4df863fc7ade0ca61a8d325c731bde142