Bug 129844 - Reproducible segfault in evolution
Summary: Reproducible segfault in evolution
Alias: None
Product: Fedora
Classification: Fedora
Component: gtkhtml3
Version: rawhide
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Owen Taylor
QA Contact:
Depends On:
Blocks: FC3Target
TreeView+ depends on / blocked
Reported: 2004-08-13 09:28 UTC by Tim Waugh
Modified: 2007-11-30 22:10 UTC (History)
1 user (show)

Fixed In Version: 3.3.0-3
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2004-09-03 17:18:06 UTC

Attachments (Terms of Use)
gtkhtml3-backtrace (9.14 KB, text/plain)
2004-08-13 09:29 UTC, Tim Waugh
no flags Details

Description Tim Waugh 2004-08-13 09:28:54 UTC
Description of problem:
When composing a message in evolution, I came across a reproducible
way to crash evolution (actually my wife did).  It's crashing in gtkhtml3.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Start evolution, compose new message
2. Start Mozilla: http://www.imdb.com/news/wenn/2004-08-12
3. Highlight the Bjork story, from the beginning of the headline to
the end of the story ("Bjork" [...] "event.")
4. Click in the evolution message being composed
5. Middle-click to paste the selection
6. Put the cursor before the "I" of "Iceland".
7. Press backspace twice.

Actual results:
Backtrace attached.

Comment 1 Tim Waugh 2004-08-13 09:29:46 UTC
Created attachment 102690 [details]

Comment 2 Tim Waugh 2004-08-13 15:27:07 UTC
I've checked a fix into CVS.

Comment 3 Tim Waugh 2004-08-13 16:00:05 UTC
Fixed package is 3.3.0-3.

Comment 4 Owen Taylor 2004-09-03 15:47:28 UTC
I'm not the maintainer of this package upstream or downstream,
but I'm maintaining the 3.3.x branch upstream, and as such,
am a bit upset that a patch went into our package without
being reported or fixed upstream.

I don't think the patch solves the root problem, I'm going to 
investigate a bit more to try to figure out if it's 3.3.x branch 
related or a general bug.

Comment 5 Owen Taylor 2004-09-03 17:18:06 UTC
This is:


I think what is really happening is that the first
press of delete corrupts the internal structures
of GtkHTML, and then the second delete dies in
the assertion failure. I'll leave your patch in
the RPM, but I bet small variations of the procedure
will still crash.

If you look through the GtkHTML bugs, it's clear that
there are a lot of outstanding editor crashers...

Note You need to log in before you can comment on or make changes to this bug.