...and webkitgtk4-2.18.5-1.fc27.x86_64

Thanks for a bug report. What is the message structure, please? Would it be possible to share it privately, for testing purposes only, please? I see there had been some meeting invitation mails you've been looking at, but you probably just selected it and moved away shortly after it.

I tried with one text/plain and one text/html messages and no crash here.

Again with a different email:
1. Connect mobile phone (via MTP) and mount it
2. Choose email (note to myself: Regiojet HTML email 20180313)
3. Press Ctrl+P
4. Choose "Print to File"
5. Click path/filename chooser to set mobile phone as storage place
6. Click "Print"
7. See "Printing..." in Evolution status bar
8. See Evolution crash and disappear

evolution-3.26.6-1.fc27.x86_64
evolution-data-server-3.26.6-1.fc27.x86_64
webkitgtk4-2.18.6-1.fc27.x86_64
gtk3-3.22.26-2.fc27.x86_64

$:acko\> rpm -q evolution
$:acko\> gdb evolution
GNU gdb (GDB) Fedora 8.0.1-36.fc27
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from evolution...Reading symbols from /usr/lib/debug/usr/bin/evolution-3.26.6-1.fc27.x86_64.debug...done.
done.
(gdb) run
Starting program: /usr/bin/evolution 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Missing separate debuginfo for /lib64/libstdc++.so.6
Try: dnf --enablerepo='*debug*' install /usr/lib/debug/.build-id/cd/c463c75c8b403f920a00bfa314d97133edc26f.debug
[New Thread 0x7fffdc0fd700 (LWP 8410)]
[New Thread 0x7fffd4923700 (LWP 8411)]
[New Thread 0x7fffcffff700 (LWP 8412)]
[New Thread 0x7fffcf7fe700 (LWP 8413)]
[New Thread 0x7fffce988700 (LWP 8415)]
Detaching after fork from child process 8416.
Missing separate debuginfo for /usr/lib64/libnssckbi.so
Try: dnf --enablerepo='*debug*' install /usr/lib/debug/.build-id/72/66f2364b364ea49c3bec9335de26a6b4952488.debug
[New Thread 0x7fffb6d09700 (LWP 8423)]
[New Thread 0x7fffb6508700 (LWP 8424)]
[New Thread 0x7fffb5d07700 (LWP 8427)]
[New Thread 0x7fffb5506700 (LWP 8428)]
[New Thread 0x7fffb4d05700 (LWP 8429)]
[New Thread 0x7fff9ffff700 (LWP 8430)]
[New Thread 0x7fff9f7fe700 (LWP 8431)]
[New Thread 0x7fff9effd700 (LWP 8432)]
[New Thread 0x7fff9e7fc700 (LWP 8433)]
[New Thread 0x7fff9dffb700 (LWP 8434)]
[New Thread 0x7fff9d7fa700 (LWP 8435)]
[New Thread 0x7fff968dc700 (LWP 8436)]
[New Thread 0x7fff960db700 (LWP 8437)]
[New Thread 0x7fff958da700 (LWP 8438)]
Detaching after fork from child process 8439.
[New Thread 0x7fff950d9700 (LWP 8441)]
Detaching after fork from child process 8442.
[Thread 0x7fff9d7fa700 (LWP 8435) exited]
[Thread 0x7fff9dffb700 (LWP 8434) exited]
[Thread 0x7fff9e7fc700 (LWP 8433) exited]
[Thread 0x7fff9f7fe700 (LWP 8431) exited]
[Thread 0x7fffb5d07700 (LWP 8427) exited]
[New Thread 0x7fffb5d07700 (LWP 8457)]
[New Thread 0x7fff9d7fa700 (LWP 8459)]
[New Thread 0x7fff9e7fc700 (LWP 8460)]
[New Thread 0x7fff9dffb700 (LWP 8465)]
[New Thread 0x7fff2f3fd700 (LWP 8466)]
[New Thread 0x7fff2ebfc700 (LWP 8467)]
[New Thread 0x7fff2e3fb700 (LWP 8468)]
[New Thread 0x7fff2dbfa700 (LWP 8469)]
[Thread 0x7fff9dffb700 (LWP 8465) exited]
[Thread 0x7fff9e7fc700 (LWP 8460) exited]
[Thread 0x7fff968dc700 (LWP 8436) exited]
[Thread 0x7fff2ebfc700 (LWP 8467) exited]
[Thread 0x7fff9d7fa700 (LWP 8459) exited]
[Thread 0x7fffb6508700 (LWP 8424) exited]
[Thread 0x7fff9effd700 (LWP 8432) exited]
[Thread 0x7fffb5506700 (LWP 8428) exited]
[Thread 0x7fff9ffff700 (LWP 8430) exited]
[Thread 0x7fffb4d05700 (LWP 8429) exited]
[New Thread 0x7fffb4d05700 (LWP 8478)]
[New Thread 0x7fff9ffff700 (LWP 8479)]
[New Thread 0x7fffb5506700 (LWP 8480)]
[New Thread 0x7fff9effd700 (LWP 8481)]
[New Thread 0x7fffb6508700 (LWP 8482)]
[New Thread 0x7fff9e7fc700 (LWP 8483)]
[New Thread 0x7fff9dffb700 (LWP 8484)]
[New Thread 0x7fff9d7fa700 (LWP 8485)]
[New Thread 0x7fff968dc700 (LWP 8486)]
[New Thread 0x7fff2ebfc700 (LWP 8487)]
[Thread 0x7fffb4d05700 (LWP 8478) exited]
[Thread 0x7fff9dffb700 (LWP 8484) exited]
[Thread 0x7fff968dc700 (LWP 8486) exited]
[Thread 0x7fff9ffff700 (LWP 8479) exited]
[Thread 0x7fff9d7fa700 (LWP 8485) exited]
[Thread 0x7fff9e7fc700 (LWP 8483) exited]
[Thread 0x7fffb6508700 (LWP 8482) exited]
[Thread 0x7fff9effd700 (LWP 8481) exited]
[Thread 0x7fff2ebfc700 (LWP 8487) exited]
[Thread 0x7fffb5506700 (LWP 8480) exited]
[Thread 0x7fffb6d09700 (LWP 8423) exited]
[Thread 0x7fff2f3fd700 (LWP 8466) exited]
[New Thread 0x7fff2f3fd700 (LWP 8600)]
[Thread 0x7fff2f3fd700 (LWP 8600) exited]
[New Thread 0x7fff2f3fd700 (LWP 8605)]
[New Thread 0x7fffb6d09700 (LWP 8606)]
[New Thread 0x7fffb5506700 (LWP 8608)]
[New Thread 0x7fff2ebfc700 (LWP 8609)]
[New Thread 0x7fff9ffff700 (LWP 8610)]
[New Thread 0x7fff9f105700 (LWP 8611)]
[Thread 0x7fff2f3fd700 (LWP 8605) exited]
[Thread 0x7fff2ebfc700 (LWP 8609) exited]
[Thread 0x7fffb5506700 (LWP 8608) exited]
[Thread 0x7fff9ffff700 (LWP 8610) exited]
[Thread 0x7fff9f105700 (LWP 8611) exited]
[Thread 0x7fffb6d09700 (LWP 8606) exited]
[New Thread 0x7fffb6d09700 (LWP 8616)]
[Thread 0x7fffb6d09700 (LWP 8616) exited]
[New Thread 0x7fffb6d09700 (LWP 8631)]
[New Thread 0x7fff9f105700 (LWP 8632)]

(evolution:8406): module-itip-formatter-CRITICAL **: emfe_itip_format: assertion 'E_IS_MAIL_PART_ITIP (part)' failed
[New Thread 0x7fff9ffff700 (LWP 8633)]

(evolution:8406): module-itip-formatter-CRITICAL **: emfe_itip_format: assertion 'E_IS_MAIL_PART_ITIP (part)' failed

(evolution:8406): module-itip-formatter-CRITICAL **: emfe_itip_format: assertion 'E_IS_MAIL_PART_ITIP (part)' failed
[Thread 0x7fff9f105700 (LWP 8632) exited]
[Thread 0x7fffb6d09700 (LWP 8631) exited]
[New Thread 0x7fffb6d09700 (LWP 8634)]
Gtk-Message: GtkDialog mapped without a transient parent. This is discouraged.
[Thread 0x7fff9ffff700 (LWP 8633) exited]
[Thread 0x7fffb6d09700 (LWP 8634) exited]
[New Thread 0x7fffb6d09700 (LWP 8640)]
[New Thread 0x7fff9ffff700 (LWP 8641)]
[New Thread 0x7fff9f105700 (LWP 8642)]
[New Thread 0x7fffb5506700 (LWP 8643)]
[Thread 0x7fff9f105700 (LWP 8642) exited]
[Thread 0x7fffb5506700 (LWP 8643) exited]
[Thread 0x7fffb6d09700 (LWP 8640) exited]
[Thread 0x7fff9ffff700 (LWP 8641) exited]
[New Thread 0x7fff9ffff700 (LWP 8666)]

(evolution:8406): evolution-util-CRITICAL **: e_activity_get_alert_sink: assertion 'E_IS_ACTIVITY (activity)' failed

(evolution:8406): evolution-util-CRITICAL **: e_activity_handle_cancellation: assertion 'E_IS_ACTIVITY (activity)' failed

(evolution:8406): evolution-util-CRITICAL **: e_activity_set_state: assertion 'E_IS_ACTIVITY (activity)' failed

(evolution:8406): GLib-GObject-CRITICAL **: g_object_unref: assertion 'G_IS_OBJECT (object)' failed

(evolution:8406): GLib-GObject-CRITICAL **: g_object_unref: assertion 'G_IS_OBJECT (object)' failed

Thread 1 "evolution" received signal SIGSEGV, Segmentation fault.
malloc_consolidate (av=0x7fffeb7abc20 <main_arena>) at malloc.c:4461
4461		  nextsize = chunksize(nextchunk);
(gdb) thread apply all bt full

+ Trace 238480

rax            0x7fffeb7abc80	140737144077440
rbx            0x0	0
rcx            0xd55544f78750	234562206009168
rdx            0x5555597ccad0	93825061931728
rsi            0x271	625
rdi            0x7fffeb7abc20	140737144077344
rbp            0x7fffeb7abc78	0x7fffeb7abc78 <main_arena+88>
rsp            0x7fffffffd320	0x7fffffffd320
r8             0x50	80
r9             0x5555597ccad0	93825061931728
r10            0x7fffeb7abc38	140737144077368
r11            0x7fffeb7abc80	140737144077440
r12            0x55555a476860	93825075210336
r13            0x555559ccc3f0	93825067172848
r14            0x41	65
r15            0x45	69
rip            0x7fffeb4788fd	0x7fffeb4788fd <malloc_consolidate+77>
eflags         0x10202	[ IF RF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0
(gdb)

Created attachment 369810 [details]
mbox testcase for comment 3

Thanks for the test message. I see the critical warnings related to emfe_itip_formatter, but later then it doesn't crash here. I also tried with valgrind (with exported GIGACAGE_ENABLED=0 and G_SLICE=always-malloc), but it didn't show anything as well.

Milan, what would you like me to do / try? :)

I'm afraid that valgrind won't catch it, but it's the easiest thing to try:

  $ export GIGACAGE_ENABLED=0
  $ G_SLICE=always-malloc valgrind --num-callers=30 evolution &>log.txt

Then catching backtrace of all threads "t a a bt" for all g_logv() calls for those critical/runtime warnings would also help. I'd like to see all threads to verify whether other threads had any influence on this. It can be for the warnings at e_activity_get_alert_sink() and below, not for those before it, because those I can reproduce as well.

(In reply to Milan Crha from comment #5)
> ...I see the critical warnings related to emfe_itip_formatter...

Fixed with the below change. The code is called with an Attachment part, instead of Itip part, in this case. I have no idea of the other warnings yet (I was not able to reproduce them).

Created commit c110e6be8f in evo master (3.29.1+)
Created commit 77ea359940 in evo gnome-3-28 (3.28.1+)

Created attachment 370049 [details]
Output of: G_SLICE=always-malloc valgrind --num-callers=30 evolution &>bug792688.txt

Heh, this time I got displayed "Printing failed. The printer replied "Operation unsupported" in the UI at least, after valgrind showed "GLib-GObject-CRITICAL **: g_object_unref: assertion 'G_IS_OBJECT (object)' failed".

I have no idea how to combine valgrind and gdb though, sorry...

Thanks, it shows an interesting information.  Valgrind did a great job to survive the memory issue and report about it. I believe this is related to the failure of the print operation, though I do not know why you receive it. The "operation unsupported" error looks like something from gvfs or such, but that's only on the first look (I usually get those when something related to gvfs fails).

Aha, from the comment #0:
> 2) Choose PDF output, to be stored on an attached USB stick
does it crash also when you save to, say, /tmp?

Created attachment 370157 [details] [review]
proposed patch

for evolution;

I think I found the cause of the crash. This should, at least, avoid valgrind claims around g_error_free() call and a double-unref of the 'task' when the operation fails with an error.

I made a test build for you here:
https://koji.fedoraproject.org/koji/taskinfo?taskID=25989598

Could you give it a try, please? Ideally straight with valgrind, whose output should be significantly shorter. Thanks in advance.

(In reply to Milan Crha from comment #11)
> Aha, from the comment #0:
> > 2) Choose PDF output, to be stored on an attached USB stick
> does it crash also when you save to, say, /tmp?

No. It is definitely related to saving to a filesystem mounted via MTP as I cannot save an image from GIMP onto the attached mobile phone either.
But GIMP does not crash. :)

Created attachment 370159 [details]
Valgrind output when using the test build

Using https://koji.fedoraproject.org/koji/taskinfo?taskID=25989598 and G_SLICE=always-malloc valgrind --num-callers=30 evolution &>bug792688-2.txt
and the testcase in comment 3, 

I cannot make it crash anymore. I only get the warning in the UI. Great!

Thanks for giving it a try. The end of the valgrind log shows four runtime warnings, the first being:
> GLib-GObject-WARNING **: invalid cast from 'GTask' to 'GSimpleAsyncResult'
Could you try to catch it and show a backtrace of it (out of valgrind), please? It's just when you've time. I do not see it myself, thus I'm wondering what else is so different on your side that it triggers this.

I'll commit the above proposed patch anyway and close this bug, because it does fix the crash in an error state.

Created commit b0cce4fd8f in evo master (3.29.1+)
Created commit 2996e2e0c4 in evo gnome-3-28 (3.28.1+)

(In reply to Milan Crha from comment #15)
> > GLib-GObject-WARNING **: invalid cast from 'GTask' to 'GSimpleAsyncResult'
> Could you try to catch it and show a backtrace of it (out of valgrind),
> please?

What I got is in bug 794726 (but from a different warning).

*** Bug 794726 has been marked as a duplicate of this bug. ***

(In reply to André Klapper from comment #17)
> (In reply to Milan Crha from comment #15)
> > > GLib-GObject-WARNING **: invalid cast from 'GTask' to 'GSimpleAsyncResult'
> > Could you try to catch it and show a backtrace of it (out of valgrind),
> > please?
> 
> What I got is in bug 794726 (but from a different warning).

Though I'm looking for this specific warning, not a different one.

(In reply to Milan Crha from comment #19)
> Though I'm looking for this specific warning, not a different one.

Have not managed to reproduce that one so far. :(

(In reply to André Klapper from comment #20)
> Have not managed to reproduce that one so far. :(

No problem. I've a special local build of glib2 for Fedora 27, which prints backtraces of runtime warnings in evolution code, when evolution-data-server is built in a specific way. I can provide you scratch builds with that enabled. With it, you could just run evolution and it'll be all. As those backtraces are printed in the g_warning(), and these are part of the system log, then you can even see some backtraces without running evolution from a command line and even for some background evolution-data-server processes. You might want to install debuginfo for eds and evo at least of course.