Bug 842259

Summary: [abrt] evolution-3.4.3-2.fc17: __GI___libc_malloc: Process /usr/bin/evolution was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: Bryn M. Reeves <bmr>
Component: evolutionAssignee: Matthew Barnes <mbarnes>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: lucilanga, mbarnes, mcrha
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:65d16661c9e81259c24ee26ef9f2a7a53400e1ec
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-01 03:45:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: core_backtrace
none
File: backtrace
none
File: gconf_subtree
none
File: maps
none
File: dso_list
none
File: build_ids
none
test email none

Description Bryn M. Reeves 2012-07-23 09:20:28 UTC
libreport version: 2.0.10
abrt_version:   2.0.10
backtrace_rating: 4
cmdline:        evolution
comment:        Downloading ~378 new messages from IMAP. UI became increasingly slugish (no message display got past 'Formatting message...', then crash.
crash_function: __GI___libc_malloc
executable:     /usr/bin/evolution
kernel:         3.4.5-2.fc17.x86_64
pid:            11023
pwd:            /home/breeves
time:           Mon 23 Jul 2012 10:02:46 AM BST
uid:            4078
username:       breeves

backtrace:      Text file, 190504 bytes
build_ids:      Text file, 7831 bytes
core_backtrace: Text file, 158740 bytes
dso_list:       Text file, 20070 bytes
gconf_subtree:  Text file, 4489 bytes
maps:           Text file, 96804 bytes

cgroup:
:9:perf_event:/
:8:blkio:/
:7:net_cls:/
:6:freezer:/
:5:devices:/
:4:memory:/
:3:cpuacct,cpu:/
:2:cpuset:/
:1:name=systemd:/user/breeves/2

environ:
:XDG_VTNR=1
:SSH_AGENT_PID=1238
:XDG_SESSION_ID=2
:HOSTNAME=hex.usersys.redhat.com
:IMSETTINGS_INTEGRATE_DESKTOP=yes
:SHELL=/bin/bash
:TERM=dumb
:HISTSIZE=1000
:GNOME_KEYRING_CONTROL=/run/user/breeves/keyring-leiUL5
:QT_GRAPHICSSYSTEM_CHECKED=1
:IMSETTINGS_MODULE=none
:USER=breeves
:SSH_AUTH_SOCK=/run/user/breeves/keyring-leiUL5/ssh
:USERNAME=breeves
:MAIL=/var/spool/mail/breeves
:PATH=/usr/lib64/ccache:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/home/breeves/bin
:DESKTOP_SESSION=gnome
:QT_IM_MODULE=xim
:PWD=/home/breeves
:XMODIFIERS=@im=none
:GNOME_KEYRING_PID=1063
:LANG=en_US.UTF-8
:GDMSESSION=gnome
:HISTCONTROL=ignoredups
:XDG_SEAT=seat0
:HOME=/home/breeves
:SHLVL=1
:LOGNAME=breeves
:CVS_RSH=ssh
:DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-WHyEbrSRrf,guid=6bf5303323f4f0185589690000000050
:'LESSOPEN=||/usr/bin/lesspipe.sh %s'
:WINDOWPATH=1
:XDG_RUNTIME_DIR=/run/user/breeves
:DISPLAY=:0
:CCACHE_HASHDIR=
:XAUTHORITY=/var/run/gdm/auth-for-breeves-APhita/database
:_=/usr/bin/gnome-session
:GNOME_DESKTOP_SESSION_ID=this-is-deprecated
:SESSION_MANAGER=local/unix:@/tmp/.ICE-unix/1070,unix/unix:/tmp/.ICE-unix/1070
:GPG_AGENT_INFO=/run/user/breeves/keyring-leiUL5/gpg:0:1
:GJS_DEBUG_OUTPUT=stderr
:'GJS_DEBUG_TOPICS=JS ERROR;JS LOG'
:GIO_LAUNCHED_DESKTOP_FILE=/usr/share/applications/evolution.desktop
:GIO_LAUNCHED_DESKTOP_FILE_PID=11023
:DESKTOP_STARTUP_ID=gnome-shell-1303-hex.usersys.redhat.com-evolution-2_TIME80532186

limits:
:Limit                     Soft Limit           Hard Limit           Units     
:Max cpu time              unlimited            unlimited            seconds   
:Max file size             unlimited            unlimited            bytes     
:Max data size             unlimited            unlimited            bytes     
:Max stack size            8388608              unlimited            bytes     
:Max core file size        0                    unlimited            bytes     
:Max resident set          unlimited            unlimited            bytes     
:Max processes             1024                 29852                processes 
:Max open files            1024                 4096                 files     
:Max locked memory         65536                65536                bytes     
:Max address space         unlimited            unlimited            bytes     
:Max file locks            unlimited            unlimited            locks     
:Max pending signals       29852                29852                signals   
:Max msgqueue size         819200               819200               bytes     
:Max nice priority         0                    0                    
:Max realtime priority     0                    0                    
:Max realtime timeout      unlimited            unlimited            us        

open_fds:
:0:/dev/null
:pos:	0
:flags:	0100000
:1:/home/breeves/.xsession-errors
:pos:	8271
:flags:	0102002
:2:/home/breeves/.xsession-errors
:pos:	8271
:flags:	0102002
:3:socket:[471064]
:pos:	0
:flags:	02004002
:4:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:5:socket:[468514]
:pos:	0
:flags:	02004002
:6:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:7:socket:[470286]
:pos:	0
:flags:	02004002
:8:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:9:socket:[469282]
:pos:	0
:flags:	02004002
:10:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:11:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:12:/home/breeves/.pki/nssdb/cert9.db
:pos:	40
:flags:	02100002
:13:/var/tmp/etilqs_JryaelZKSfobgEa (deleted)
:pos:	28
:flags:	02100002
:14:/var/tmp/etilqs_RuDn1l9iUzKJd8y (deleted)
:pos:	2056
:flags:	02500002
:15:/var/tmp/etilqs_ERVOod9Ep5YIrLb (deleted)
:pos:	2048
:flags:	02500002
:16:/home/breeves/.pki/nssdb/key4.db
:pos:	40
:flags:	02100002
:17:/var/tmp/etilqs_bBsEguWTdMWqFL3 (deleted)
:pos:	28
:flags:	02100002
:18:/var/tmp/etilqs_6nYUUncK40YZD5U (deleted)
:pos:	2056
:flags:	02500002
:19:/var/tmp/etilqs_RVaqO97Y9AITRO8 (deleted)
:pos:	2048
:flags:	02500002
:20:/etc/pki/nssdb/cert9.db
:pos:	40
:flags:	02100000
:21:/var/tmp/etilqs_J9hLTObsb2ahKJj (deleted)
:pos:	28
:flags:	02100002
:22:/var/tmp/etilqs_WA6J1YGKRdtonFt (deleted)
:pos:	2048
:flags:	02500002
:23:/etc/pki/nssdb/key4.db
:pos:	40
:flags:	02100000
:24:/var/tmp/etilqs_uvBSW0Jd6EucrTy (deleted)
:pos:	28
:flags:	02100002
:25:/var/tmp/etilqs_TDbY0DnSaX7CIr2 (deleted)
:pos:	2048
:flags:	02500002
:26:socket:[471065]
:pos:	0
:flags:	02004002
:27:/home/breeves/.local/share/evolution/mail/local/folders.db
:pos:	40
:flags:	02100002
:28:/var/tmp/etilqs_htBthCb0ls9XYmq (deleted)
:pos:	28
:flags:	02100002
:29:/home/breeves/.local/share/evolution/mail/vfolder/folders.db
:pos:	40
:flags:	02100002
:30:/var/tmp/etilqs_AhRxnzfUJyXGmLP (deleted)
:pos:	3084
:flags:	02500002
:31:/var/tmp/etilqs_QTcpn1bGJMBMSE5 (deleted)
:pos:	3072
:flags:	02500002
:32:socket:[469285]
:pos:	0
:flags:	02004002
:33:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:34:/home/breeves/.cache/evolution/mail/1342778490.32419.0.redhat.com/folders.db
:pos:	42442752
:flags:	02100002
:35:socket:[469981]
:pos:	0
:flags:	04002
:36:anon_inode:inotify
:pos:	0
:flags:	02004000
:37:socket:[471363]
:pos:	0
:flags:	02004002

var_log_messages:
:Jul 16 12:52:44 hex yum[22562]: Updated: evolution-3.4.3-2.fc17.x86_64
:Jul 16 12:53:47 hex yum[22562]: Updated: evolution-help-3.4.3-2.fc17.noarch
:Jul 16 12:53:47 hex yum[22562]: Updated: evolution-NetworkManager-3.4.3-2.fc17.x86_64
:Jul 23 10:03:05 hex abrt[22755]: Saved core dump of pid 11023 (/usr/bin/evolution) to /var/spool/abrt/ccpp-2012-07-23-10:02:46-11023 (1632366592 bytes)

xsession_errors:
:(evolution-alarm-notify:1319): evolution-alarm-notify-WARNING **: alarm.c:254: Requested removal of nonexistent alarm!
:(evolution:11023): e-data-server-ui-WARNING **: ENameSelector: Could not load "Personal": Cannot open book: Address book does not exist
:(evolution:11023): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed
:(evolution:11023): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed
:(evolution:11023): camel-WARNING **: CamelIMAPXFolder::synchronize_message_sync() reported failure without setting its GError
:(evolution:11023): camel-WARNING **: CamelIMAPXFolder::get_message_sync() reported failure without setting its GError
:(evolution:11023): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed
:(evolution:22829): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
:(evolution:22829): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.

Comment 1 Bryn M. Reeves 2012-07-23 09:20:34 UTC
Created attachment 599727 [details]
File: core_backtrace

Comment 2 Bryn M. Reeves 2012-07-23 09:20:38 UTC
Created attachment 599728 [details]
File: backtrace

Comment 3 Bryn M. Reeves 2012-07-23 09:20:40 UTC
Created attachment 599729 [details]
File: gconf_subtree

Comment 4 Bryn M. Reeves 2012-07-23 09:20:42 UTC
Created attachment 599730 [details]
File: maps

Comment 5 Bryn M. Reeves 2012-07-23 09:20:45 UTC
Created attachment 599731 [details]
File: dso_list

Comment 6 Bryn M. Reeves 2012-07-23 09:20:47 UTC
Created attachment 599732 [details]
File: build_ids

Comment 7 Bryn M. Reeves 2012-07-24 12:34:41 UTC
"formatting message"

backtrace_rating: 4
Package: evolution-3.4.3-2.fc17
OS Release: Fedora release 17 (Beefy Miracle)

Comment 8 Milan Crha 2012-07-24 14:12:15 UTC
Thanks for a bug report. I do not see from it what can be wrong, evolution only failed to allocate 2KB of memory, while it was formatting a message with inline pgp signature (or encryption, I cannot tell for sure from the snippet I see in the backtrace). I tried to create an inline GPG signature, but it works fine for me if I import it into evolution - maybe it's too short?

My question is, can you reproduce this with that particular message, please?

Comment 9 Milan Crha 2012-07-24 14:12:58 UTC
Created attachment 600037 [details]
test email

This test email works fine for me.

Comment 10 Bryn M. Reeves 2012-07-24 14:18:52 UTC
Thanks Milan - it appears to happen "at random" while reading mails - I assume every time I hit one that has the "problem" formatting. I think the failure is more than just an allocation problem however - the process takes a sig11 during malloc which generally indicates arena corruption.

Maybe there's a problem in an error path?

Anyway; thanks for your analysis so far - I'd wondered if there was a link to pgp signed messages from the backtrace data. I will see if I can get it to trigger any more reliably with this information.

Comment 11 Milan Crha 2012-07-25 07:40:05 UTC
You are right, this kind of crashes usually mean memory corruption. I wanted to get a reproducer first, then involve valgrind, because it's easier to know steps to reproduce than to run evolution under valgrind for an extended period (evolution is very slow when under valgrind). You can run evolution under valgrind with command like this:
  $ G_SLICE=always-malloc valgrind --num-callers=50 evolution &>log.txt
but before that edit /usr/lib64/valgrind/default.supp and add there these 5 lines at the top:
{
   Skip any wcslen calls
   Memcheck:Addr8
   fun:wcslen
}
to avoid false-positives which are triggered with wcslen usage in F17. The log.txt may contain some useful information, even if evolution will not crash, because valgrind can avoid certain crashes.

Comment 12 Fedora End Of Life 2013-07-04 00:14:58 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 13 Fedora End Of Life 2013-08-01 03:45:09 UTC
Fedora 17 changed to end-of-life (EOL) status on 2013-07-30. Fedora 17 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.