Bug 704663 – [abrt] Crash under em_folder_tree_model_add_store()

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 704663 - [abrt] Crash under em_folder_tree_model_add_store()


Summary:	[abrt] Crash under em_folder_tree_model_add_store()


Status:	RESOLVED FIXED

Product:	evolution
Classification:	Applications
Component:	Mailer
Version:	3.10.x (obsolete)
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	evolution-mail-maintainers
QA Contact:	Evolution QA team

URL:
Whiteboard:

Duplicates:	712169 (view as bug list)
Depends on:
Blocks:

Reported:	2013-07-22 08:16 UTC by Milan Crha
Modified:	2014-06-11 10:58 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Milan Crha 2013-07-22 08:16:02 UTC

Moving this from a downstream bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=986717

Version-Release number of selected component:
evolution-3.9.4-3.fc20

Additional info:
reporter:       libreport-2.1.5
backtrace_rating: 4
cmdline:        evolution
crash_function: gtk_tree_store_append
executable:     /usr/bin/evolution
kernel:         3.9.9-302.fc19.x86_64

Core was generated by `evolution'.
Program terminated with signal 11, Segmentation fault.

+ Trace 232284

Thread 4 (Thread 0x7fe551a59700 (LWP 1968))

#0 __lll_lock_wait
at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S line 135
#1 _L_lock_1088
from /lib64/libpthread.so.0
#2 __GI___pthread_mutex_lock
at ../nptl/pthread_mutex_lock.c line 134
#3 g_mutex_lock
at gthread-posix.c line 213
#4 signal_emit_unlocked_R
at gsignal.c line 3590
#5 g_signal_emit_valist
at gsignal.c line 3326
#6 g_signal_emit
at gsignal.c line 3382
#7 g_object_dispatch_properties_changed
at gobject.c line 1047
#8 g_object_notify_queue_thaw
at gobject.c line 292
#9 g_object_thaw_notify
at gobject.c line 1275
#10 source_load_from_key_file
at e-source.c line 560
#11 source_parse_dbus_data
at e-source.c line 644
#12 source_notify_dbus_data_cb
at e-source.c line 661
#13 g_closure_invoke
at gclosure.c line 777
#14 signal_emit_unlocked_R
at gsignal.c line 3582
#15 g_signal_emit_valist
at gsignal.c line 3326
#16 g_signal_emit
at gsignal.c line 3382
#17 g_object_dispatch_properties_changed
at gobject.c line 1047
#18 g_object_notify_by_spec_internal
at gobject.c line 1141
#19 g_object_notify
at gobject.c line 1183
#20 e_dbus_source_proxy_g_properties_changed
at e-dbus-source.c line 695
#21 ffi_call_unix64
at ../src/x86/unix64.S line 76
#22 ffi_call
at ../src/x86/ffi64.c line 522
#23 g_cclosure_marshal_generic
at gclosure.c line 1454
#24 g_closure_invoke
at gclosure.c line 777
#25 signal_emit_unlocked_R
at gsignal.c line 3620
#26 g_signal_emit_valist
at gsignal.c line 3326
#27 g_signal_emit_by_name
at gsignal.c line 3422
#28 signal_cb
at gdbusobjectmanagerclient.c line 1051
#29 emit_signal_instance_in_idle_cb
at gdbusconnection.c line 3743
#30 g_main_dispatch
at gmain.c line 3064
#31 g_main_context_dispatch
at gmain.c line 3640
#32 g_main_context_iterate
at gmain.c line 3711
#33 g_main_loop_run
at gmain.c line 3905
#34 source_registry_object_manager_thread
at e-source-registry.c line 1104
#35 g_thread_proxy
at gthread.c line 798
#36 start_thread
at pthread_create.c line 309
#37 clone
at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 111

Thread 1 (Thread 0x7fe5753a6a40 (LWP 1963))

#0 gtk_tree_store_append
at gtktreestore.c line 1737
#1 em_folder_tree_model_add_store
at em-folder-tree-model.c line 1129
#2 g_closure_invoke
at gclosure.c line 777
#3 signal_emit_unlocked_R
at gsignal.c line 3582
#4 g_signal_emit_valist
at gsignal.c line 3326
#5 g_signal_emit
at gsignal.c line 3382
#6 store_emit_folder_info_stale_cb
at camel-store.c line 222
#7 g_main_dispatch
at gmain.c line 3064
#8 g_main_context_dispatch
at gmain.c line 3640
#9 g_main_context_iterate
at gmain.c line 3711
#10 g_main_loop_run
at gmain.c line 3905
#11 gtk_main
at gtkmain.c line 1157
#12 main
at main.c line 686

Comment 1 Milan Crha 2013-11-15 19:22:59 UTC

*** Bug 712169 has been marked as a duplicate of this bug. ***

Comment 2 Milan Crha 2013-11-15 19:24:41 UTC

Bug #712169 contains steps and backtraces from 3.10.1.

Downstream bug report about the same, also from 3.10.1:
https://bugzilla.redhat.com/show_bug.cgi?id=1030422

Description of problem:
Modified some settings of an Account managed by GOA and closed the dialog. Afterwards Evolution crashed

Version-Release number of selected component:
evolution-3.10.1-1.fc20

Comment 3 Milan Crha 2013-11-15 19:25:55 UTC

I forgot to add, most recent console errors from the downstream bug:

Nov 14 12:44:17 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_entry_set_text: assertion 'text != NULL' failed
Nov 14 12:44:17 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_entry_set_text: assertion 'text != NULL' failed
Nov 14 12:44:17 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_entry_set_text: assertion 'text != NULL' failed
Nov 14 12:44:17 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_entry_set_text: assertion 'text != NULL' failed
Nov 14 12:44:17 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_entry_set_text: assertion 'text != NULL' failed
Nov 14 12:44:59 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_tree_model_get_iter: assertion 'path != NULL' failed
Nov 14 12:44:59 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_tree_store_is_ancestor: assertion 'VALID_ITER (descendant, tree_store)' failed
Nov 14 12:44:59 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_tree_model_get_iter: assertion 'path != NULL' failed
Nov 14 12:44:59 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_tree_store_is_ancestor: assertion 'VALID_ITER (descendant, tree_store)' failed
Nov 14 12:44:59 Ostfriesland gnome-session[1692]: (evolution:3063): evolution-mail-CRITICAL **: file e-mail-account-store.c: line 1098 (e_mail_account_store_add_service): should not be reached
Nov 14 12:45:00 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_tree_store_append: assertion 'GTK_IS_TREE_STORE (tree_store)' failed
Nov 14 12:45:00 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_tree_store_set_valist: assertion 'GTK_IS_TREE_STORE (tree_store)' failed
Nov 14 12:45:00 Ostfriesland gnome-session[1692]: (evolution:3063): GLib-GObject-WARNING **: invalid unclassed pointer in cast to 'GtkTreeModel'
Nov 14 12:45:00 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_tree_model_get_path: assertion 'GTK_IS_TREE_MODEL (tree_model)' failed
Nov 14 12:45:00 Ostfriesland gnome-session[1692]: (evolution:3063): GLib-GObject-WARNING **: invalid unclassed pointer in cast to 'GtkTreeModel'
Nov 14 12:45:00 Ostfriesland gnome-session[1692]: (evolution:3063): Gtk-CRITICAL **: gtk_tree_row_reference_new: assertion 'GTK_IS_TREE_MODEL (model)' failed
Nov 14 12:47:48 Ostfriesland gnome-session[1692]: (evolution:3602): dconf-WARNING **: failed to commit changes to dconf: Zeitüberschreitung wurde erreicht
Nov 14 12:48:20 Ostfriesland gnome-session[1692]: ** (evolution:3602): WARNING **: The set_id method on WebKitDOMHTMLElement is deprecated. Use the one in WebKitDOMElement instead.
Nov 14 12:48:27 Ostfriesland gnome-session[1692]: ** (evolution:3602): WARNING **: The set_id method on WebKitDOMHTMLElement is deprecated. Use the one in WebKitDOMElement instead.
Nov 14 12:48:36 Ostfriesland gnome-session[1692]: ** (evolution:3602): WARNING **: The set_id method on WebKitDOMHTMLElement is deprecated. Use the one in WebKitDOMElement instead.

Comment 4 Igor Gnatenko 2013-12-04 13:35:52 UTC

Can confirm.

Comment 5 nathanael 2013-12-05 18:01:57 UTC

I had the same issue occur today

Comment 6 Matthew Barnes 2013-12-05 21:26:58 UTC

This might have fixed it:
https://git.gnome.org/browse/evolution/commit/?h=gnome-3-10&id=506e730dbd74dd5f45c6aab236358d2dd53ff84b

Will be part of 3.10.3.  Guess we'll wait and see.

Comment 7 Milan Bouchet-Valat 2014-01-02 17:04:52 UTC

Sorry, I just experienced it with 3.10.3 on Fedora 20.

Comment 8 Yuki Izumi 2014-04-15 08:17:47 UTC

(In reply to comment #7)
> Sorry, I just experienced it with 3.10.3 on Fedora 20.

Likewise on 3.10.4.

Comment 9 Christian Stadelmann 2014-04-27 14:21:01 UTC

I can reproduce this bug by following these steps:

1. add a new email account in Evolution. Don't use Gnome-Online-Accounts (not tested). I used different IMAP+/SMTP-Accounts with different Servers, mostly with STARTTLS.
2. provide password as you are asked to
3. edit the account preferences, set a path for the trash folder. Confirm dialog with "OK"

Changing the trash folder seems to trigger this bug.

Running Evolution 3.10.4 on Fedora 20. Got a match on the Fedora downstream bug using abrt/libreport.

Comment 10 Christian Stadelmann 2014-04-27 15:01:53 UTC

I did the same thing on an existing account and evolution got stuck at 100% CPU. This is the backtrace:

(gdb) bt full

+ Trace 233529

#0 g_hash_table_lookup_node
at ghash.c line 394
#1 g_hash_table_insert_internal
at ghash.c line 1153
#2 em_folder_tree_model_add_store
at em-folder-tree-model.c line 1162
#3 g_closure_invoke
at gclosure.c line 777
#4 signal_emit_unlocked_R
at gsignal.c line 3586
#5 g_signal_emit_valist
at gsignal.c line 3330
#6 g_signal_emit
at gsignal.c line 3386
#7 store_emit_folder_info_stale_cb
at camel-store.c line 223
#8 g_main_dispatch
at gmain.c line 3066
#9 g_main_context_dispatch
at gmain.c line 3642
#10 g_main_context_iterate
at gmain.c line 3713
#11 g_main_loop_run
at gmain.c line 3907
#12 gtk_main
at gtkmain.c line 1158
#13 main
at main.c line 683

Comment 11 Milan Crha 2014-06-11 10:58:48 UTC

I realized that the custom-created EMFolterTreeModel-s are not properly freed, because there is a circular dependency between GtkTreeRowReference-s and the model (the model keeps hash of references in its private structure), thus for example when a button to select real junk was pressed then a new model had been created, but it was never freed.

I was never able reproduce the crash, neither saw any signs of it when running evolution under valgrind, but I guess it's the cause of the problem, thus I'm closing this bug report with the below change. I also made some smaller change in evolution-data-server (commit 946415e for master and commit 98b3258 for 3-12), but that doesn't have any real influence.

Created commit 6576094 in evo master (3.13.3+) [1]
Created commit 457fea5 in evo evolution-3-12 (3.12.4+)

[1] https://git.gnome.org/browse/evolution/commit?id=6576094