Bug 701604

Created attachment 496482 [details]
File: maps

Created attachment 496483 [details]
File: build_ids

Created attachment 496484 [details]
File: dsos

Created attachment 496485 [details]
File: backtrace

Thanks for a bug report. This can be related to an upstream bug [1], but as there is some issue in the backtrace itself, then let's start with obvious things.

I would like to ask pango team for their opinion on this.

> #4  0x000000313d82bfef in run_length_encode_types_utf8
> (panded_strongs=read_sleb128: Corrupted DWARF expression.
> ) at fribidi.c:121
> #5  fribidi_analyse_string_utf8 (pmax_level=read_sleb128: Corrupted DWARF
> expression. ) at fribidi.c:493

[1] https://bugzilla.gnome.org/show_bug.cgi?id=625139

No comment.

(In reply to comment #6)
> No comment.

Hmm, I'm not sure what to think about that. Anyway...

Iulian, do you see this crash often, please? If so, could you try to reproduce this under valgrind, to check whether it'll show any memory issues being related to this crash, please? You can install valgrind and run evolution under it like this:
   $ G_SLICE=always-malloc valgrind --num-callers=50 evolution &>log.txt
and then possibly try to reproduce the issue. Valgrind can sometimes avoid the crash itself, while writing memory issues it spot during the run, thus please attach the resulting log.txt file here, and I can examine it. Thanks in advance.

No sorry, just once. Can't reproduce it unfortunately ...

Thanks for the update, Pity you cannot reproduce this. I'm closing this, but please feel free to reopen if you find a way to investigate this further, maybe with a valgrind log as suggested in comment #7.

Reopening.

Since installing Fedora 15/Evolution 3.0, I've hit at least three crashes that abrt has identified as a duplicate of this bug.

When it happens seems to be arbitrary; that is, I haven't identified anything specific that I can do to reproduce it. But in light of the frequency with which it's occurring, I think it warrants further attention.

Created attachment 502831 [details]
Backtrace

Package: evolution-3.0.2-1.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)


Comment
-----
I have no idea - evolution is crashing all of the time now: three times in the past minute.  I was merely downloading and browsing through email.  I think the operation I performed just prior to the crash was to click on a mail folder to change the mail list display to that folder.

I've been an evoltuion user for well over a decade.  Evolution 3 sucks for me.  I can't get any work done.

Package: evolution-3.0.2-1.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)


Comment
-----
Clicked Send/Receive

Could you try with evolution-3.0.2-2 from updates testing, please? I introduced a very bad bug in 3.0.2-1, which is fixed in 3.0.2-2.

Package: evolution-3.0.2-2.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)


Comment
-----
Crash occurred while marking RSS feeds as read using CTRL-A CTRL-K.  Also, Exchange (OWA), IMAP, and POP accounts were in the process of synchronizing.

Package: evolution-3.0.2-2.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)


Comment
-----
Uso el plugin de RSS del repositorio de Fedora

Marco error con el RSS de Smashing Magazine Feed, al momento de querer leer los feeds para ver si veia algo raro fue cuando marco el error

Package: evolution-3.0.2-2.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)


Comment
-----
Unexpected crash, not sure how to reproduce

Package: evolution-3.0.2-2.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)


Comment
-----
select a blogpost from rss feed

OK, so 3.0.2-2 exhibits the issue too. Does the common part of the crasher involve evolution-rss for all reporters? I see that it does for most of you. Valgrind may help us to see what happens to the memory. If anyone of you can try similar steps on your machine, when having run evolution like shown below, then it'll be great. Before running it, please make sure you've installed correct debug info packages (same version as binary packages) for gtkhtml3,  evolution-data-server, evolution and evolution-rss, then run evolution like this:
   $ G_SLICE=always-malloc valgrind --num-callers=50 evolution &>log.txt
and then repeat steps you did previously. Valgrind can avoid certain types of crashes, thus it's possible it will not crash, but it may report a memory issue into the resulting log.txt file. Please attach the file here, for an examination. Thanks in advance.

Package: evolution-3.0.2-2.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)

Comment
-----
out of nowhere

Package: evolution-3.0.2-2.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)

Comment
-----
RSS Reader function crashed immediately after selecting an RSS entry to view.

Package: evolution-3.1.2-2.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Rawhide)

Comment
-----
Skimming some mails, deleting them after reading, switching imapd dirs

Package: evolution-3.1.2-2.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Rawhide)

Comment
-----
Skimming some mails, deleting them after reading, switching imapd dirs

Created attachment 513538 [details]
Another backtrace

Package: evolution-3.0.2-3.fc15
Architecture: x86_64
OS Release: Fedora release 15 (Lovelock)

Comment
-----
Just tried to start evolution

In regards to Milan's comment #19, I do _not_ have evolution-rss installed.

So far this crash has only happened once for me, but if it would happen again, I'll try running it under valgrind.

Package: evolution-3.2.0-1.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
I just clicked the send message button and the crash took place.

(In reply to comment #26)
> In regards to Milan's comment #19, I do _not_ have evolution-rss installed.
> 
> So far this crash has only happened once for me, but if it would happen again,
> I'll try running it under valgrind.

Thanks, I move this back to need-info, because of lack of a good reproducer. Only note that this might also depend on actions you do before the crash, not only those immediately done, like moving couple messages to a new folder, then replying to one message, then it crashes after pressed Send in a composer window.

Package: evolution-3.2.0-1.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
Died during sending message

Package: evolution-3.2.0-1.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
Launched Evolution and it immediately crashed. I had just installed tracker-evolution-plugin.0.12.3.2.fc16.x86_64

Package: evolution-3.2.0-1.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
Occasional crash occuring on sending an email

Package: evolution-3.2.1-1.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
Hit send on a message

Package: evolution-3.2.1-2.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
Trying to drag an e-mail into a new folder.

Package: evolution-3.2.1-2.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
I've selected 2 messages in the incoming box of an imap account and moved them, using the mouse, into another folder of the same account. I got a brief error message (it did not last enough for let me remember it), then evolution crashed.

Package: evolution-3.2.1-2.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
Clicked on 'send/receive all'

Package: evolution-2.32.3-1.fc14
Architecture: x86_64
OS Release: Fedora release 14 (Laughlin)


How to reproduce
-----
1. On launching the programm from the desktop shortcut
2.
3.


Comment
-----
Very intermittent, only happens occasionally

Package: evolution-3.2.2-1.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
Random crash on sending (again....)

Package: evolution-3.2.2-1.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

Comment
-----
Normal email reply constructed to a facebook address (very long id string).  First email after a system update and reboot.

Nothing obviously different for this mail.  I replied to an all-text email, noticed a problem removing some of the fluff in the original text (could not delete the first quoted line, which was empty, but could delete the rest of the unimportant parts of the quote), and was able to construct a fairly large reply message.  Upon hitting "Send", Evolution aborted immediately.  It is not known what happened to the new message.

rating: 4
Package: evolution-3.2.2-1.fc16
Architecture: x86_64
OS Release: Fedora release 16 (Verne)

The problem is still present in Fedora 16.  This bug needs to be fixed before Fedora 15 expires in 4 months, or shifted to be in Fedora 16 so that it does not get dropped on the floor.

OK, I would move this to Fedora 16, but before that, are you sure this is the same issue as this bug report? I would like to see updated backtrace from Fedora 16, with debug information at least from evolution-data-server, evolution and gtkhtml3, and if you can reproduce this reliably, then even the valgrind log may help here, because this seems like a memory corruption issue. Thanks in advance.

To get backtrace, just run evolution under gdb like this:
   $ gdb evolution --ex r --ex "t a a bt" --ex q
and reproduce the issue. At the end the gdb will ask you whether you want to quit. Answer "y". Then get its output. Make sure it'll not include any private information, like email addresses, passwords or server addresses you do not want to share in public.

To get valgrind log run evolution like this:
   $ G_SLICE=always-malloc valgrind --num-callers=50 evolution &>log.txt
and try to reproduce the issue. Note that evolution will be significantly slower due to all memory checking. Also note that valgrind can avoid certain crashes, which it only logs into the file, thus even if evolution will not crash then the log.txt file can contain information about the issue.

Milan said:
> are you sure this is the same issue as this bug report? I would like to see
> updated backtrace from Fedora 16, with debug information at least from
> evolution-data-server, evolution and gtkhtml3, and if you can reproduce this
> reliably, then even the valgrind log may help here, because this seems like a
> memory corruption issue.

Abrt decided that this was the same bug report, not me.  As noted in a prior update in this bug report, the chances of reproducing this issue on demand are low, as it appears to be a near-random event, possibly a memory corruption issue or something similar.  The only partial common thread in all of the reports is that it appears to be triggered when sending mail, with low probability of occurance.  I've only seen it twice in a year.  So, I'll try, but don't hold your breath...

I wonder how to further narrow this down.

I see it about once per week when sending (always via IMAP).
Unfortunately, under these circumstances running evolution with valgrind is way too slow.

I have the feeling that to bug is more likely to occur with high system and/or network load. Furthermore, I have fairly large folders (about 5k messages in Inbox and Sent). Could the update of the Sent folder cause the crash?

Is it possible to run a script that sends many dummy messages to make the crash more likely to happen?

I do not know any hint on reproducer except of trying similar steps under valgrind, even it is fairly slow. The thing is that this is some kid of memory corruption, which can happen in part A and influence completely different part B of the code. The best is that it can influence different parts of the code each run, depending what is currently stored in the memory it corrupts. Valgrind is one tool I know of, which can identify these types of issues. With folder size, I guess it might not be a problem, I have even larger IMAP folders and I do not recall seeing this myself. It's rather some kind of your setup/environment, which uncovers the hidden issue.

Created attachment 549198 [details]
Valgrind run, showing some memory problems

I have not reproduced the specific problem, but running Evolution under valgrind became increasingly slow and eventually locked up for 15+ minutes until I aborted.  Inspecting the logs, I see some memory errors in normal operation, so something is definitely wrong in the memory management.  I'll attached the log.

Thanks for the update. Apart of "usual" valgrind claims I noticed one:

> Thread 1:
> Invalid write of size 8
>    ... g_nullify_pointer (in /lib64/libglib-2.0.so.0.3000.1)

which reminded me of bug #758402. Maybe it's related. The thing is that this write could overwrite anything in memory, which then can break completely unrelated code.

Apart of that I do not see anything unusual, maybe except of html_engine_delete_n, which is new to me. The valgrind log is missing all debug information, which would help narrow the place of the origin much easier. You either do not have them installed, or you have them installed with a different version than the binary package. The packages I'm mostly interested in are gtkhtml3, evolution-data-server and evolution. You can alternatively install also glib2 and gtk3 debug info packages.

Created attachment 549368 [details]
valgrind log with debug symbols, no crash

normal run valgrind log (no crash this time) with debug info added, showing lots of memory leakage, a few invalid heap reads, and one invalid write.

Thanks for the update. The new valgrind log is nice, with all relevant debug information. I believe this is related to bug #758402, thus if you could try to update gtk3, either as stated in bug #766352 comment #34 or by regular update, as this package is part of stable updates since 2011-12-17 (bug #766352 comment #38), then it may prove whether it's it or not.

Still experiencing crash on send using
gtk3-3.2.2-4.fc16.x86_64


Sorry, no valgrind....

Normal email reply constructed and send button pressed.
Evolution abort upon sending.
Upon restarting Evolution, it offers to recover,
and allows my to then successfully send the email.
This has happened twice to me now.
System is an untainted and fully updated F16 desktop.
Critical issue due to it being a highly visible and somewhat nasty bug.


backtrace_rating: 4
Package: evolution-3.2.2-1.fc16
OS Release: Fedora release 16 (Verne)

Created attachment 554966 [details]
File: backtrace

Worte a message and tried to send it.

backtrace_rating: 4
Package: evolution-3.2.2-1.fc16
OS Release: Fedora release 16 (Verne)

Created attachment 555342 [details]
File: backtrace

Evolution crash anytime I want to send a mail through my own smtp server on a mobile network. Everything is fine on a more classical network.

backtrace_rating: 4
Package: evolution-3.2.2-1.fc16
OS Release: Fedora release 16 (Verne)

Created attachment 555544 [details]
File: backtrace

Sent message.

backtrace_rating: 4
Package: evolution-3.2.2-1.fc16
OS Release: Fedora release 16 (Verne)

Created attachment 555554 [details]
File: backtrace

Crash happened while I was moving an email from one folder ot another, in a IMAP+ account.

backtrace_rating: 4
Package: evolution-3.2.2-1.fc16
OS Release: Fedora release 16 (Verne)

Created attachment 556373 [details]
File: backtrace

I had composed a reply to an email message. As soon as I clicked "Send" Evolution crashed.

backtrace_rating: 4
Package: evolution-3.2.2-1.fc16
OS Release: Fedora release 16 (Verne)

Created attachment 556851 [details]
File: backtrace

crash when I open evolution

backtrace_rating: 4
Package: evolution-3.2.3-1.fc16
Architecture: i686
OS Release: Fedora release 16 (Verne)

Created attachment 564272 [details]
File: backtrace

When moving mails to subdirectories via imap+ (server: imap.seznam.cz), sometimes error is raised (orange box: Error syncing changes: mtd: internal error: Unknown flag. JUNK). After that it almost immediately crashes.

backtrace_rating: 4
Package: evolution-3.2.3-1.fc16
OS Release: Fedora release 16 (Verne)

Created attachment 564875 [details]
File: backtrace

Just closing evolution.

backtrace_rating: 4
Package: evolution-3.2.3-2.fc16
OS Release: Fedora release 16 (Verne)

Created attachment 577098 [details]
File: backtrace

This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping