Bug 1198758

Summary: [abrt] evolution: WebCore::ScrollView::contentsToWindow(): evolution killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Cornelia Pfeffer <cp>
Component: webkitgtk3Assignee: Matthias Clasen <mclasen>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: kalevlember, lucilanga, mbarnes, mclasen, mcrha, tpopela
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/6030dfc6cd4854e89795bb30b1a3eb5c770b6734
Whiteboard: abrt_hash:5cb96a97f2b0f5c42d31de9b5e23ab2b22d87e06
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-12-02 09:44:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages
none
The spam-mail that makes evolution crash when preview is enabled none

Description Cornelia Pfeffer 2015-03-04 18:55:59 UTC
Description of problem:
a phishing-mail arrived in "spam". When selecting that mail to delete it, Evolution crashed immediately. It seems, it has to do with the preview, because that same mail arrived on another pc in our house, and there we deselected preview and than could select the mail and delete it. Unfortunately, in the case of the pc from what I'm writing now, there is only that one mail in the spam-folder, so everytime i select that folder, Evolution crashes before I can do anything. I'll wait for another spam-mail to do the same as on the other pc, hoping that entering the spam-folder it will be placed on the new mail.

Version-Release number of selected component:
evolution-3.12.11-1.fc21

Additional info:
reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        evolution
crash_function: WebCore::ScrollView::contentsToWindow
executable:     /usr/bin/evolution
kernel:         3.18.7-200.fc21.i686+PAE
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 WebCore::ScrollView::contentsToWindow at Source/WebCore/platform/ScrollView.cpp:824
 #1 WebCore::GtkPluginWidget::frameRectsChanged at Source/WebCore/platform/gtk/GtkPluginWidget.cpp:66
 #2 WebCore::Widget::setFrameRect at Source/WebCore/platform/gtk/WidgetGtk.cpp:110
 #3 WebCore::RenderWidget::setWidgetGeometry at Source/WebCore/rendering/RenderWidget.cpp:137
 #4 WebCore::RenderWidget::updateWidgetGeometry at Source/WebCore/rendering/RenderWidget.cpp:163
 #5 WebCore::RenderWidget::setWidget at Source/WebCore/rendering/RenderWidget.cpp:186
 #6 WebCore::SubframeLoader::loadPlugin at Source/WebCore/loader/SubframeLoader.cpp:458
 #7 WebCore::SubframeLoader::requestPlugin at Source/WebCore/loader/SubframeLoader.cpp:157
 #8 WebCore::SubframeLoader::requestObject at Source/WebCore/loader/SubframeLoader.cpp:225
 #9 WebCore::HTMLPlugInImageElement::requestObject at Source/WebCore/html/HTMLPlugInImageElement.cpp:774

Comment 1 Cornelia Pfeffer 2015-03-04 18:56:08 UTC
Created attachment 998006 [details]
File: backtrace

Comment 2 Cornelia Pfeffer 2015-03-04 18:56:10 UTC
Created attachment 998007 [details]
File: cgroup

Comment 3 Cornelia Pfeffer 2015-03-04 18:56:12 UTC
Created attachment 998008 [details]
File: core_backtrace

Comment 4 Cornelia Pfeffer 2015-03-04 18:56:16 UTC
Created attachment 998009 [details]
File: dso_list

Comment 5 Cornelia Pfeffer 2015-03-04 18:56:17 UTC
Created attachment 998010 [details]
File: environ

Comment 6 Cornelia Pfeffer 2015-03-04 18:56:19 UTC
Created attachment 998011 [details]
File: exploitable

Comment 7 Cornelia Pfeffer 2015-03-04 18:56:20 UTC
Created attachment 998012 [details]
File: limits

Comment 8 Cornelia Pfeffer 2015-03-04 18:56:28 UTC
Created attachment 998013 [details]
File: maps

Comment 9 Cornelia Pfeffer 2015-03-04 18:56:29 UTC
Created attachment 998014 [details]
File: open_fds

Comment 10 Cornelia Pfeffer 2015-03-04 18:56:31 UTC
Created attachment 998015 [details]
File: proc_pid_status

Comment 11 Cornelia Pfeffer 2015-03-04 18:56:34 UTC
Created attachment 998016 [details]
File: var_log_messages

Comment 12 Milan Crha 2015-03-05 10:02:49 UTC
Thanks for a bug report. Try to use Ctrl+M to disable the preview, though only very quickly after you enter the Spam folder, which is not that easy. Eventually run evolution as this:
   $ evolution --disable-preview

If it'll not help, what is the account type, please? being it a remote account, then deleting the message in the local cache and starting evolution in offline will give you a chance to disable the preview and only then turn in back to online.

As long as it's a spam, I'd be interested in the message, before you delete it, as a reproducer for the crash. You can right-click the message and choose "Save as mbox".

Comment 13 Cornelia Pfeffer 2015-03-05 10:37:24 UTC
(In reply to Milan Crha from comment #12)
> Thanks for a bug report. Try to use Ctrl+M to disable the preview, though
> only very quickly after you enter the Spam folder, which is not that easy.
> Eventually run evolution as this:
>    $ evolution --disable-preview
> 
> If it'll not help, what is the account type, please? being it a remote
> account, then deleting the message in the local cache and starting evolution
> in offline will give you a chance to disable the preview and only then turn
> in back to online.
> 
> As long as it's a spam, I'd be interested in the message, before you delete
> it, as a reproducer for the crash. You can right-click the message and
> choose "Save as mbox".

Dear Milan
I managed in the end clicking with the right mouse-button on the folder and selecting "all messages read", than - I don't really know why - I found myself on another spam message, not the first, and so I had enough time to disable preview and cancel the message. 
When I tried to save it for you, happened another strange thing: I found it in may deleted mails and stupidly clicked on it, before disabling preview. Evolution crashed at once, and reopening it.. the mail had VANISHED. I don't have the slightest idea why... Fortunately, we had that same mail on the other pc. I managed to save it as mbox, as you said, and sent it to my pc. I can tell you, that selecting that message, even being now an attached file, evolution crashed immediately. Even in that way I could select the mail only disabling preview. I send it to your e-mail adress, and I try to attach it also here on this page. Thank you

Comment 14 Cornelia Pfeffer 2015-03-05 10:40:54 UTC
Created attachment 998305 [details]
The spam-mail that makes evolution crash when preview is enabled

Comment 15 Milan Crha 2015-03-05 13:57:38 UTC
Thanks, I can also reproduce the crash, both with the attached message here and with the one you sent me. This seems to me like a webkit bug, but it'll need a bit more investigation to be sure.

Comment 16 Milan Crha 2015-03-05 15:14:00 UTC
I was able to reproduce the crash out of Evolution too, by using only WebKit1 and Gtk3 components, thus I moved the crash to Webkit, as [1]. Please see [1] for any further updates.

[1] https://bugs.webkit.org/show_bug.cgi?id=142343

Comment 17 Cornelia Pfeffer 2015-03-05 16:02:39 UTC
(In reply to Milan Crha from comment #16)
> I was able to reproduce the crash out of Evolution too, by using only
> WebKit1 and Gtk3 components, thus I moved the crash to Webkit, as [1].
> Please see [1] for any further updates.
> 
> [1] https://bugs.webkit.org/show_bug.cgi?id=142343

ok, thank you. Now I must search explanations for "webkit", because I really don't know what it is... Thank you!

Comment 18 Milan Crha 2015-03-05 19:05:33 UTC
Maybe Fedora can use the upstream patch and provide rebuild of webkitgtk3 package with the patch included.

Comment 19 Fedora End Of Life 2015-11-04 10:43:47 UTC
This message is a reminder that Fedora 21 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 21. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '21'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 21 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 20 Fedora End Of Life 2015-12-02 09:44:22 UTC
Fedora 21 changed to end-of-life (EOL) status on 2015-12-01. Fedora 21 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.