Red Hat Bugzilla – Bug 129844
Reproducible segfault in evolution
Last modified: 2007-11-30 17:10:47 EST
Description of problem:
When composing a message in evolution, I came across a reproducible
way to crash evolution (actually my wife did). It's crashing in gtkhtml3.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Start evolution, compose new message
2. Start Mozilla: http://www.imdb.com/news/wenn/2004-08-12
3. Highlight the Bjork story, from the beginning of the headline to
the end of the story ("Bjork" [...] "event.")
4. Click in the evolution message being composed
5. Middle-click to paste the selection
6. Put the cursor before the "I" of "Iceland".
7. Press backspace twice.
Created attachment 102690 [details]
I've checked a fix into CVS.
Fixed package is 3.3.0-3.
I'm not the maintainer of this package upstream or downstream,
but I'm maintaining the 3.3.x branch upstream, and as such,
am a bit upset that a patch went into our package without
being reported or fixed upstream.
I don't think the patch solves the root problem, I'm going to
investigate a bit more to try to figure out if it's 3.3.x branch
related or a general bug.
I think what is really happening is that the first
press of delete corrupts the internal structures
of GtkHTML, and then the second delete dies in
the assertion failure. I'll leave your patch in
the RPM, but I bet small variations of the procedure
will still crash.
If you look through the GtkHTML bugs, it's clear that
there are a lot of outstanding editor crashers...