Bug 220371

Summary: Evolution crashes when opening my (server filtered) spam folder if any mail is present
Product: [Fedora] Fedora Reporter: Benjamin Kahn <bkahn>
Component: evolutionAssignee: Matthew Barnes <mbarnes>
Status: CLOSED DUPLICATE QA Contact:
Severity: high Docs Contact:
Priority: medium    
Version: 6   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-05-01 16:27:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Benjamin Kahn 2006-12-20 19:22:58 UTC
Description of problem:
Evolution crashes when opening my (server filtered) spam folder if any mail is
present

Version-Release number of selected component (if applicable):
evolution-2.9.3-4
evolution-data-server-1.9.3-1

How reproducible:
Every time on my machine

Steps to Reproduce:
1. Visit my spam folder when at least one spam was placed there by my mail server.
  
Actual results:
Crash

Expected results:
No crash

Additional info:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208842016 (LWP 14345)]
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x009bce81 in camel_message_info_ptr (mi=0x9e93c00, id=2) at
camel-folder-summary.c:2955
#2  0x05904c19 in ml_tree_value_at (etm=0x9a306e0, path=0x9e93c00, col=20,
model_data=0x9c94818) at message-list.c:1284
#3  0x077080e6 in etmc_value_at (etm=0x9a306e0, node=0x9e93c00, col=20) at
e-tree-memory-callbacks.c:104
#4  0x07709801 in e_tree_model_value_at (etree=0x9a306e0, node=0x9e93c00,
col=20) at e-tree-model.c:783
#5  0x076fbc47 in e_table_sorting_utils_tree_sort (source=0x9a306e0,
sort_info=0x9f1d640, full_header=0x9c96d20, map_table=0xacd7088, 
    count=367) at e-table-sorting-utils.c:287
#6  0x0771023a in resort_node (etta=0x9c9f860, gnode=0x9f1f5a8, recurse=1) at
e-tree-table-adapter.c:183
#7  0x07711625 in generate_tree (etta=0x9c9f860, path=Variable "path" is not
available.
) at e-tree-table-adapter.c:374
#8  0x07711e1c in etta_proxy_node_changed (etm=0x9a306e0, path=0x9d49920,
etta=0x9c9f860) at e-tree-table-adapter.c:483
#9  0x00963819 in g_cclosure_marshal_VOID__POINTER () from /lib/libgobject-2.0.so.0
#10 0x00956f0b in g_closure_invoke () from /lib/libgobject-2.0.so.0
#11 0x00967e83 in g_signal_override_class_closure () from /lib/libgobject-2.0.so.0
#12 0x0096937f in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#13 0x00969539 in g_signal_emit () from /lib/libgobject-2.0.so.0
#14 0x0770aa97 in e_tree_model_node_changed (tree_model=0x9a306e0,
node=0x9d49920) at e-tree-model.c:259
#15 0x07708693 in e_tree_memory_thaw (etmm=0x9a306e0) at e-tree-memory.c:203
#16 0x05905f56 in regen_list_regened (mm=0xab4e178) at message-list.c:2742
#17 0x058f5023 in periodic_processing () at mail-mt.c:459
#18 0x0087d916 in g_source_get_current_time () from /lib/libglib-2.0.so.0
#19 0x0087d342 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#20 0x0088031f in g_main_context_check () from /lib/libglib-2.0.so.0
#21 0x008806c9 in g_main_loop_run () from /lib/libglib-2.0.so.0
#22 0x04f8aa23 in bonobo_main () from /usr/lib/libbonobo-2.so.0
#23 0x0805e46c in main (argc=1, argv=0xbfae0a34) at main.c:611
#24 0x004ce214 in __libc_start_main (main=0x805e0a0 <main>, argc=1,
ubp_av=0xbfae0a34, init=0x805f074 <__libc_csu_init>, 
    fini=0x805f06c <__libc_csu_fini>, rtld_fini=0x4a61f0 <_dl_fini>,
stack_end=0xbfae0a2c) at libc-start.c:231
#25 0x0804fe21 in _start ()

(gdb) up
#1  0x009bce81 in camel_message_info_ptr (mi=0x9e93c00, id=2) at
camel-folder-summary.c:2955
2955                    return ((CamelFolderSummaryClass *)((CamelObject
*)mi->summary)->klass)->info_ptr(mi, id);
(gdb) p ((CamelFolderSummaryClass *)((CamelObject *)mi->summary)->klass)->info_ptr
$5 = (const void *(*)(const CamelMessageInfo *, int)) 0

So the pointer to the info_ptr function is still NULL.  When
camel_message_info_ptr tries to call it, it doesn't exist, and the application
crashes.

Comment 1 Benjamin Kahn 2006-12-20 19:28:35 UTC
Some more information:

(gdb) p  * ((CamelFolderSummaryClass *)((CamelObject *)mi->summary)->klass)
$7 = {parent_class = {parent = 0x9bea070, magic = 2007188717, next = 0x0, child
= 0x1, name = 0x9c78f88 "p��\t�D�w", lock = 0x9c78ec0, 
    object_size = 56872, klass_size = 2503, hooks = 0xd, instance_chunks = 0x1,
instances = 0x1, klass_init = 0, klass_finalise = 0, 
    init = 0, finalise = 0, setv = 0, getv = 0x10, free = 0, meta_get =
0xaa419d10, meta_set = 0, state_read = 0, state_write = 0}, 
  summary_header_load = 0x9c7d640, summary_header_save = 0x9c748e0,
message_info_new_from_header = 0x9c71460, 
  message_info_new_from_parser = 0x9c7df68, message_info_new_from_message =
0x9bea070, message_info_load = 0x77a344ed, message_info_save = 0, 
  meta_message_info_save = 0x1, message_info_free = 0x9c78fec,
message_info_clone = 0x9c78f24, content_info_new_from_header = 0x9c7c640, 
  content_info_new_from_parser = 0xd, content_info_new_from_message = 0x1,
content_info_load = 0x1, content_info_save = 0, 
  content_info_free = 0, next_uid_string = 0, info_ptr = 0, info_uint32 = 0,
info_time = 0x10, info_user_flag = 0, info_user_tag = 0xac9dbe0, 
  info_set_user_flag = 0, info_set_user_tag = 0, info_set_flags = 0}


Comment 2 Matthew Barnes 2007-05-01 16:27:57 UTC
Should be fixed in evolution-2.10.1-10.fc7.

*** This bug has been marked as a duplicate of 238497 ***