GNOME Bugzilla – Bug 734085
evolution-alarm-notify hangs on snooze
Last modified: 2014-10-08 10:40:23 UTC
The alarm notification window becomes unresponsive on clicking "snooze". This usually happens, after I get updates in an ics file that is monitored by evolution and the due alarms are popping up. The window is modal (in foreground) and does not respond, the only way to get rid of it is a kill command: $ killall evolution-alarm-notify More details (annotated logs) in the ubuntu bug report (not copied here): https://bugs.launchpad.net/ubuntu/+source/evolution/+bug/1278429 Current version running here is: 3.10.4-0ubuntu1
I'm hitting the same hangs on CentOS 6.5, evolution-2.32.3-30.el6.i686. I checked the backtrace of a hung evolution-alarm-notify process and it is hanging within a call to malloc_printerr in glibc. And indeed, my ~/.xsession-errors contains: *** glibc detected *** /usr/libexec/evolution/2.32/evolution-alarm-notify: malloc(): memory corruption: 0x08d8c1f0 *** The original Ubuntu bug has: *** Error in `/usr/lib/evolution/3.8/evolution-alarm-notify': corrupted double-linked list: 0x00007fc067703060 *** so it is probably the same thing. Running evolution-alarm-notify under valgrind gives: ==7598== Invalid write of size 4 ==7598== at 0x8051738: notify_dialog_cb (alarm-queue.c:1231) ==7598== by 0x804EE38: snooze_pressed_cb (alarm-notify-dialog.c:190) ==7598== by 0x4F4B4F03: g_cclosure_marshal_VOID__VOID (in /lib/libgobject-2.0.so.0.2600.1) ==7598== by 0x4F4A4F22: g_closure_invoke (in /lib/libgobject-2.0.so.0.2600.1) [...] ==7598== Address 0x71e3c4c is 68 bytes inside a block of size 72 free'd ==7598== at 0x4006C7F: free (vg_replace_malloc.c:446) ==7598== by 0x4F38DDF6: g_free (in /lib/libglib-2.0.so.0.2600.1) ==7598== by 0x804F28D: free_tray_icon_data (alarm-queue.c:1008) ==7598== by 0x805148F: tray_list_remove_data_async (alarm-queue.c:1187) ==7598== by 0x80516C2: notify_dialog_cb (alarm-queue.c:184) ==7598== by 0x804EE38: snooze_pressed_cb (alarm-notify-dialog.c:190) ==7598== by 0x4F4B4F03: g_cclosure_marshal_VOID__VOID (in /lib/libgobject-2.0.so.0.2600.1) alarm-queue.c:1231 is: tray_data->is_in_tree = FALSE; and tray_data is in fact deleted a few lines earlier (alarm-queue.c:1220) tray_list_remove_data (tray_data); -> message_push -> tray_list_remove_data_async(tray_data) -> free_tray_icon_data (tray_data) -> g_free (tray_data)
This seems to be already fixed in commit 3219d7a8e37fadadd823dd7676a40d40283836fd. And this is a duplicate of https://bugzilla.gnome.org/show_bug.cgi?id=709162
Right Michal, your issue is fixed by commit for bug #709162, which was (stable-) released as 3.12.0 only. The patch can be backported by respective distribution maintainers. Martin's bug looks the same, thus I mark this as a duplicate of bug #709162. *** This bug has been marked as a duplicate of bug 709162 ***