247745 – Evolution crashes system with malloc loop.

Bug 247745 - Evolution crashes system with malloc loop.

Summary: Evolution crashes system with malloc loop.

Keywords:
Status:	CLOSED WORKSFORME
Alias:	None
Product:	Fedora
Classification:	Fedora
Component:	evolution
Sub Component:
Version:	8
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Matthew Barnes
QA Contact:	desktop-bugs@redhat.com
Docs Contact:
URL:
Whiteboard:
Duplicates (1):	234342 (view as bug list)
Depends On:
Blocks:	F9Target
TreeView+	depends on / blocked

Reported:	2007-07-11 08:23 UTC by David Woodhouse
Modified:	2008-12-15 17:37 UTC (History)
CC List:	3 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2008-12-10 15:40:56 UTC
Type:	---
Dependent Products:

Attachments	(Terms of Use)
autosave file. (7.64 KB, text/plain) 2007-07-11 08:44 UTC, David Woodhouse	no flags	Details
View All

Description David Woodhouse 2007-07-11 08:23:05 UTC

I'm sure I'd reported this before, but can't find it now. Often when editing
mail, especially when I go back and edit rather than just typing from start to
finish, Evolution gets into a loop where it just allocates more and more memory. 

These days, I've started to recognise the slowness and the way the fans ramp up,
and I've learned to type 'killall -9 evolution' before all my xterms stop
responding and I need to either hit Ctrl-Alt-Backspace or reset the entire machine.

Today, I managed to reproduce the problem for a second time when I let Evolution
recover the message I was composing and tried editing it again. And then a third
time. I've never known it be reproducable before.

Program received signal SIGINT, Interrupt.
0x0fe80320 in _int_malloc () from /lib/libc.so.6
(gdb) bt
#0  0x0fe80320 in _int_malloc () from /lib/libc.so.6
#1  0x0fe81b44 in malloc () from /lib/libc.so.6
#2  0x0ef4094c in g_malloc () from /lib/libglib-2.0.so.0
#3  0x011720c8 in ?? () from /usr/lib/libgtkhtml-3.14.so.19
#4  0x01174fd0 in ?? () from /usr/lib/libgtkhtml-3.14.so.19
#5  0x01157c0c in html_object_copy () from /usr/lib/libgtkhtml-3.14.so.19
#6  0x0115bf50 in html_object_dup () from /usr/lib/libgtkhtml-3.14.so.19
#7  0x01178430 in ?? () from /usr/lib/libgtkhtml-3.14.so.19
#8  0x01159ae8 in html_object_split () from /usr/lib/libgtkhtml-3.14.so.19
#9  0x0112ef84 in ?? () from /usr/lib/libgtkhtml-3.14.so.19
#10 0x0112f4e8 in ?? () from /usr/lib/libgtkhtml-3.14.so.19
#11 0x0112f8c4 in ?? () from /usr/lib/libgtkhtml-3.14.so.19
#12 0x01131888 in html_engine_insert_text_with_extra_attributes ()
   from /usr/lib/libgtkhtml-3.14.so.19
#13 0x01131b98 in html_engine_paste_text_with_extra_attributes ()
   from /usr/lib/libgtkhtml-3.14.so.19
#14 0x01131bf8 in html_engine_paste_text () from /usr/lib/libgtkhtml-3.14.so.19
#15 0x0110c870 in ?? () from /usr/lib/libgtkhtml-3.14.so.19
#16 0x0edcd698 in g_cclosure_marshal_VOID__STRING ()
   from /lib/libgobject-2.0.so.0
#17 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#18 0x0edd1c24 in ?? () from /lib/libgobject-2.0.so.0
#19 0x0edd2f7c in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
---Type <return> to continue, or q <return> to quit---
#20 0x0edd57dc in g_signal_emit_by_name () from /lib/libgobject-2.0.so.0
#21 0xf7cc60c8 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#22 0x0edcd698 in g_cclosure_marshal_VOID__STRING ()
   from /lib/libgobject-2.0.so.0
#23 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#24 0x0edd1c24 in ?? () from /lib/libgobject-2.0.so.0
#25 0x0edd2f7c in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#26 0x0edd57dc in g_signal_emit_by_name () from /lib/libgobject-2.0.so.0
#27 0xf7cc44cc in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#28 0xf7cc4d94 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#29 0xf7cc375c in gtk_im_context_filter_keypress ()
   from /usr/lib/libgtk-x11-2.0.so.0
#30 0xf7cc375c in gtk_im_context_filter_keypress ()
   from /usr/lib/libgtk-x11-2.0.so.0
#31 0x01114f40 in ?? () from /usr/lib/libgtkhtml-3.14.so.19
#32 0xf7cedc54 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#33 0x0edbbbcc in ?? () from /lib/libgobject-2.0.so.0
#34 0x0edbd904 in g_closure_invoke () from /lib/libgobject-2.0.so.0
#35 0x0edd1d70 in ?? () from /lib/libgobject-2.0.so.0


To reproduce, I put the cursor inside a quoted paragraph and pressed enter a
couple of times to make space for a response; then deleted the '>' marks. I then
selected some text which had already been typed (before the first crash) 
elsewhere in the mail, and pasted it into the space I'd made. Then I deleted the
open-parenthesis at the beginning of the text I'd inserted, and started typing
some more at the beginning of the paragraph. It very quickly went into its
malloc loop.

This problem is always seen when inserting text inside an existing paragraph. I
 thought it had something to do with URLs -- I think I've usually seen it when
there are URLs in the text being edited. But this mail has no URLs in it, unless
you count the email address in the citation ('on blah, foo@bar writes:').

Comment 1 David Woodhouse 2007-07-11 08:44:57 UTC

Created attachment 158926 [details]
autosave file.

To reproduce... start evo, select 'recover'.

Place cursor after 'in mind?' in the penultimate quoted paragraph.
Hit enter a few times to make space; delete the '>' marks. Select the entire
sentence in parentheses from a little further up ('It would actually...') with
the left button. Paste it into your new space with the right button. Delete the
starting parenthesis, start typing 'I agree. To that end...'

Actually it started going AWOL for me when I mistyped 'that'. Perhaps it has
something to do with the spell checker. I'll keep an eye out for that in the
future.

Comment 2 David Woodhouse 2007-07-11 08:46:47 UTC

Backtrace would be nicer if I had a _matching_ gtkhtml3-debuginfo installed. So
I updated to gtkhtml3-3.14.3-1.fc7.

Some backtraces from interrupting it while it's chewing memory (1.4G RSS at this
point)...

Program received signal SIGINT, Interrupt.
[Switching to Thread 4155187200 (LWP 17392)]
0x0fe81b30 in malloc () from /lib/libc.so.6
(gdb) bt
#0  0x0fe81b30 in malloc () from /lib/libc.so.6
#1  0x0ef4094c in g_malloc () from /lib/libglib-2.0.so.0
#2  0x0e8490e8 in spell_error_new (off=497, len=11) at htmltext.c:3010
#3  0x0e84bff0 in copy (s=0x117ddd98, d=0x11445348) at htmltext.c:180
#4  0x0e82ec2c in html_object_copy (self=0x8, dest=0xb) at htmlobject.c:1043
#5  0x0e832f70 in html_object_dup (object=0x117ddd98) at htmlobject.c:891
#6  0x0e84f450 in object_split (self=0x117ddd98, e=0x1036c230, 
    child=<value optimized out>, offset=15, level=1, left=0xffef0b7c, 
    right=0xffef0b78) at htmltext.c:690
#7  0x0e830b08 in html_object_split (self=0x8, e=0xb, child=0xff955cc, 
    offset=0, level=8, left=0x3aa04b68, right=0x0) at htmlobject.c:939
#8  0x0e805fa4 in split_and_add_empty_texts (e=0xb, level=8, left=0x3aa04b68, 
    right=0x0) at htmlengine-edit-cut-and-paste.c:369
#9  0x0e806508 in insert_object_for_undo (e=0x1036c230, obj=0x157c9ae0, len=1, 
    position_after=1553, level=1, dir=HTML_UNDO_UNDO, check=1)
    at htmlengine-edit-cut-and-paste.c:884
#10 0x0e8068e4 in insert_object (e=0x1036c230, obj=0x157c9ae0, len=1, 
    position_after=1610612736, level=1, dir=HTML_UNDO_UNDO, check=1)
    at htmlengine-edit-cut-and-paste.c:1128
#11 0x0e8088a8 in html_engine_insert_text_with_extra_attributes (e=0x1036c230, 
    text=0x114452b8 "t", len=1, attrs=0x0)
    at htmlengine-edit-cut-and-paste.c:1373
#12 0x0e808bb8 in html_engine_paste_text_with_extra_attributes (e=0x1036c230, 
    text=0x114452b8 "t", len=4294967295, attrs=0x0)
    at htmlengine-edit-cut-and-paste.c:1404
#13 0x0e808c18 in html_engine_paste_text (e=0x8, 
    text=0xb <Address 0xb out of bounds>, len=267998668)
    at htmlengine-edit-cut-and-paste.c:1411
#14 0x0e7e3890 in gtk_html_im_commit_cb (context=<value optimized out>, 
    str=0xb <Address 0xb out of bounds>, html=0x119ff2a0) at gtkhtml.c:3232
#15 0x0edcd698 in g_cclosure_marshal_VOID__STRING ()
   from /lib/libgobject-2.0.so.0
#16 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#17 0x0edd1c24 in ?? () from /lib/libgobject-2.0.so.0
#18 0x0edd2f7c in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#19 0x0edd57dc in g_signal_emit_by_name () from /lib/libgobject-2.0.so.0
#20 0xf7c4b0c8 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#21 0x0edcd698 in g_cclosure_marshal_VOID__STRING ()
   from /lib/libgobject-2.0.so.0
#22 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#23 0x0edd1c24 in ?? () from /lib/libgobject-2.0.so.0
#24 0x0edd2f7c in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#25 0x0edd57dc in g_signal_emit_by_name () from /lib/libgobject-2.0.so.0
#26 0xf7c494cc in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#27 0xf7c49d94 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#28 0xf7c4875c in gtk_im_context_filter_keypress ()
   from /usr/lib/libgtk-x11-2.0.so.0
#29 0xf7c4875c in gtk_im_context_filter_keypress ()
   from /usr/lib/libgtk-x11-2.0.so.0
#30 0x0e7ebf60 in key_press_event (widget=0x119ff2a0, event=0x112bdd40)
    at gtkhtml.c:974
#31 0xf7c72c54 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#32 0x0edbbbcc in ?? () from /lib/libgobject-2.0.so.0
#33 0x0edbd904 in g_closure_invoke () from /lib/libgobject-2.0.so.0
#34 0x0edd1d70 in ?? () from /lib/libgobject-2.0.so.0
#35 0x0edd2d04 in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#36 0x0edd3148 in g_signal_emit () from /lib/libgobject-2.0.so.0
#37 0xf7db7ca0 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
---Type <return> to continue, or q <return> to quit---
#38 0xf7dcae34 in gtk_window_propagate_key_event ()
   from /usr/lib/libgtk-x11-2.0.so.0
#39 0xf7dcefa4 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#40 0x0088c56c in ?? () from /usr/lib/libbonoboui-2.so.0
#41 0xf7c72c54 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#42 0x0edbbbcc in ?? () from /lib/libgobject-2.0.so.0
#43 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#44 0x0edd1d70 in ?? () from /lib/libgobject-2.0.so.0
#45 0x0edd2d04 in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#46 0x0edd3148 in g_signal_emit () from /lib/libgobject-2.0.so.0
#47 0xf7db7ca0 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#48 0xf7c6a4cc in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#49 0xf7c6bda0 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#50 0x0eb20208 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#51 0x0ef37eb4 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#52 0x0ef3bbbc in ?? () from /lib/libglib-2.0.so.0
#53 0x0ef3c024 in g_main_loop_run () from /lib/libglib-2.0.so.0
#54 0xf7f8060c in bonobo_main () from /usr/lib/libbonobo-2.so.0
#55 0x1001846c in main (argc=<value optimized out>, argv=0xffef2664)
    at main.c:586
(gdb) c
Continuing.

Program received signal SIGINT, Interrupt.
0x0ef533f4 in ?? () from /lib/libglib-2.0.so.0
(gdb) bt
#0  0x0ef533f4 in ?? () from /lib/libglib-2.0.so.0
#1  0x0ef54058 in g_slice_alloc () from /lib/libglib-2.0.so.0
#2  0x0ef34e28 in g_list_copy () from /lib/libglib-2.0.so.0
#3  0x0e84bfc4 in copy (s=0x117ddd98, d=0x2f338280) at htmltext.c:176
#4  0x0e82ec2c in html_object_copy (self=0x42e9e540, dest=0x4)
    at htmlobject.c:1043
#5  0x0e832f70 in html_object_dup (object=0x117ddd98) at htmlobject.c:891
#6  0x0e84f450 in object_split (self=0x117ddd98, e=0x1036c230, 
    child=<value optimized out>, offset=16, level=1, left=0xffef0b7c, 
    right=0xffef0b78) at htmltext.c:690
#7  0x0e830b08 in html_object_split (self=0x42e9e540, e=0x4, child=0x42e9e5e8, 
    offset=8, level=8, left=0xe, right=0x4) at htmlobject.c:939
#8  0x0e805fa4 in split_and_add_empty_texts (e=0x4, level=8, left=0xe, 
    right=0x4) at htmlengine-edit-cut-and-paste.c:369
#9  0x0e806508 in insert_object_for_undo (e=0x1036c230, obj=0x2f3381f8, len=1, 
    position_after=1554, level=1, dir=HTML_UNDO_UNDO, check=1)
    at htmlengine-edit-cut-and-paste.c:884
#10 0x0e8068e4 in insert_object (e=0x1036c230, obj=0x2f3381f8, len=1, 
    position_after=0, level=1, dir=HTML_UNDO_UNDO, check=1)
    at htmlengine-edit-cut-and-paste.c:1128
#11 0x0e8088a8 in html_engine_insert_text_with_extra_attributes (e=0x1036c230, 
    text=0x26a136c8 " ", len=1, attrs=0x0)
    at htmlengine-edit-cut-and-paste.c:1373
#12 0x0e808bb8 in html_engine_paste_text_with_extra_attributes (e=0x1036c230, 
    text=0x26a136c8 " ", len=4294967295, attrs=0x0)
    at htmlengine-edit-cut-and-paste.c:1404
#13 0x0e808c18 in html_engine_paste_text (e=0x42e9e540, 
    text=0x4 <Address 0x4 out of bounds>, len=1122625000)
    at htmlengine-edit-cut-and-paste.c:1411
#14 0x0e7e3890 in gtk_html_im_commit_cb (context=<value optimized out>, 
    str=0x4 <Address 0x4 out of bounds>, html=0x119ff2a0) at gtkhtml.c:3232
#15 0x0edcd698 in g_cclosure_marshal_VOID__STRING ()
   from /lib/libgobject-2.0.so.0
#16 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#17 0x0edd1c24 in ?? () from /lib/libgobject-2.0.so.0
#18 0x0edd2f7c in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#19 0x0edd57dc in g_signal_emit_by_name () from /lib/libgobject-2.0.so.0
#20 0xf7c4b0c8 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#21 0x0edcd698 in g_cclosure_marshal_VOID__STRING ()
   from /lib/libgobject-2.0.so.0
#22 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#23 0x0edd1c24 in ?? () from /lib/libgobject-2.0.so.0
#24 0x0edd2f7c in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#25 0x0edd57dc in g_signal_emit_by_name () from /lib/libgobject-2.0.so.0
#26 0xf7c494cc in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#27 0xf7c49d94 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#28 0xf7c4875c in gtk_im_context_filter_keypress ()
   from /usr/lib/libgtk-x11-2.0.so.0
#29 0xf7c4875c in gtk_im_context_filter_keypress ()
   from /usr/lib/libgtk-x11-2.0.so.0
#30 0x0e7ebf60 in key_press_event (widget=0x119ff2a0, event=0x10e512d8)
    at gtkhtml.c:974
#31 0xf7c72c54 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#32 0x0edbbbcc in ?? () from /lib/libgobject-2.0.so.0
#33 0x0edbd904 in g_closure_invoke () from /lib/libgobject-2.0.so.0
#34 0x0edd1d70 in ?? () from /lib/libgobject-2.0.so.0
#35 0x0edd2d04 in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#36 0x0edd3148 in g_signal_emit () from /lib/libgobject-2.0.so.0
#37 0xf7db7ca0 in gtk_toggle_button_set_active ()
---Type <return> to continue, or q <return> to quit---
   from /usr/lib/libgtk-x11-2.0.so.0
#38 0xf7dcae34 in gtk_window_propagate_key_event ()
   from /usr/lib/libgtk-x11-2.0.so.0
#39 0xf7dcefa4 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#40 0x0088c56c in ?? () from /usr/lib/libbonoboui-2.so.0
#41 0xf7c72c54 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#42 0x0edbbbcc in ?? () from /lib/libgobject-2.0.so.0
#43 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#44 0x0edd1d70 in ?? () from /lib/libgobject-2.0.so.0
#45 0x0edd2d04 in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#46 0x0edd3148 in g_signal_emit () from /lib/libgobject-2.0.so.0
#47 0xf7db7ca0 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#48 0xf7c6a4cc in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#49 0xf7c6bda0 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#50 0x0eb20208 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#51 0x0ef37eb4 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#52 0x0ef3bbbc in ?? () from /lib/libglib-2.0.so.0
#53 0x0ef3c024 in g_main_loop_run () from /lib/libglib-2.0.so.0
#54 0xf7f8060c in bonobo_main () from /usr/lib/libbonobo-2.so.0
#55 0x1001846c in main (argc=<value optimized out>, argv=0xffef2664)
    at main.c:586
(gdb) c
Continuing.

Program received signal SIGINT, Interrupt.
0x0fe80320 in _int_malloc () from /lib/libc.so.6
(gdb) bt
#0  0x0fe80320 in _int_malloc () from /lib/libc.so.6
#1  0x0fe80b34 in _int_memalign () from /lib/libc.so.6
#2  0x0fe81e1c in memalign () from /lib/libc.so.6
#3  0x0fe8207c in posix_memalign () from /lib/libc.so.6
#4  0x0ef534c0 in ?? () from /lib/libglib-2.0.so.0
#5  0x0ef54058 in g_slice_alloc () from /lib/libglib-2.0.so.0
#6  0x0ef34e28 in g_list_copy () from /lib/libglib-2.0.so.0
#7  0x0e84bfc4 in copy (s=0x117ddd98, d=0x2f337fe0) at htmltext.c:176
#8  0x0e82ec2c in html_object_copy (self=0x1245c4f8, dest=0x0)
    at htmlobject.c:1043
#9  0x0e832f70 in html_object_dup (object=0x117ddd98) at htmlobject.c:891
#10 0x0e84f450 in object_split (self=0x117ddd98, e=0x1036c230, 
    child=<value optimized out>, offset=17, level=1, left=0xffef0b7c, 
    right=0xffef0b78) at htmltext.c:690
#11 0x0e830b08 in html_object_split (self=0x1245c4f8, e=0x0, child=0xf8, 
    offset=8, level=-1, left=0x6e0b6df8, right=0xff90a00) at htmlobject.c:939
#12 0x0e805fa4 in split_and_add_empty_texts (e=0x0, level=-1, left=0x6e0b6df8, 
    right=0xff90a00) at htmlengine-edit-cut-and-paste.c:369
#13 0x0e806508 in insert_object_for_undo (e=0x1036c230, obj=0x13580c80, len=1, 
    position_after=1555, level=1, dir=HTML_UNDO_UNDO, check=1)
    at htmlengine-edit-cut-and-paste.c:884
#14 0x0e8068e4 in insert_object (e=0x1036c230, obj=0x13580c80, len=1, 
    position_after=Cannot access memory at address 0xfffffffffffffffc
) at htmlengine-edit-cut-and-paste.c:1128
#15 0x0e8088a8 in html_engine_insert_text_with_extra_attributes (e=0x1036c230, 
    text=0x1245cfe0 "e", len=1, attrs=0x0)
    at htmlengine-edit-cut-and-paste.c:1373
#16 0x0e808bb8 in html_engine_paste_text_with_extra_attributes (e=0x1036c230, 
    text=0x1245cfe0 "e", len=4294967295, attrs=0x0)
    at htmlengine-edit-cut-and-paste.c:1404
#17 0x0e808c18 in html_engine_paste_text (e=0x1245c4f8, text=0x0, len=248)
    at htmlengine-edit-cut-and-paste.c:1411
#18 0x0e7e3890 in gtk_html_im_commit_cb (context=<value optimized out>, 
    str=0x0, html=0x119ff2a0) at gtkhtml.c:3232
#19 0x0edcd698 in g_cclosure_marshal_VOID__STRING ()
   from /lib/libgobject-2.0.so.0
#20 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#21 0x0edd1c24 in ?? () from /lib/libgobject-2.0.so.0
#22 0x0edd2f7c in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#23 0x0edd57dc in g_signal_emit_by_name () from /lib/libgobject-2.0.so.0
#24 0xf7c4b0c8 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#25 0x0edcd698 in g_cclosure_marshal_VOID__STRING ()
   from /lib/libgobject-2.0.so.0
#26 0x0edbd7fc in g_closure_invoke () from /lib/libgobject-2.0.so.0
#27 0x0edd1c24 in ?? () from /lib/libgobject-2.0.so.0
#28 0x0edd2f7c in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
#29 0x0edd57dc in g_signal_emit_by_name () from /lib/libgobject-2.0.so.0
#30 0xf7c494cc in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#31 0xf7c49d94 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#32 0xf7c4875c in gtk_im_context_filter_keypress ()
   from /usr/lib/libgtk-x11-2.0.so.0
#33 0xf7c4875c in gtk_im_context_filter_keypress ()
   from /usr/lib/libgtk-x11-2.0.so.0
#34 0x0e7ebf60 in key_press_event (widget=0x119ff2a0, event=0x112bdc50)
    at gtkhtml.c:974
#35 0xf7c72c54 in gtk_toggle_button_set_active ()
   from /usr/lib/libgtk-x11-2.0.so.0
#36 0x0edbbbcc in ?? () from /lib/libgobject-2.0.so.0
#37 0x0edbd904 in g_closure_invoke () from /lib/libgobject-2.0.so.0
#38 0x0edd1d70 in ?? () from /lib/libgobject-2.0.so.0
#39 0x0edd2d04 in g_signal_emit_valist () from /lib/libgobject-2.0.so.0
---Type <return> to continue, or q <return> to quit---

Comment 3 Christopher Beland 2007-09-12 01:50:48 UTC

This seems to be the same syndrome as bug 234342, though you have a better
theory of what causes it than I did.

Comment 4 David Woodhouse 2007-10-03 15:42:50 UTC

FWIW this happened again today in rawhide.

Comment 5 Matthew Barnes 2007-10-04 16:18:53 UTC

Moving this to F8Target.

Comment 6 Matthew Barnes 2007-10-30 03:35:58 UTC

I think Dan may be on to something.  See bug #353121.

Comment 7 Milan Crha 2007-11-21 10:07:57 UTC

*** Bug 234342 has been marked as a duplicate of this bug. ***

Comment 8 Milan Crha 2008-02-12 10:13:16 UTC

Updating version to Fedora 8, which contains patch from bug #353121 since
gtkhtml3-3.16.3-1.fc8

Comment 10 Bug Zapper 2008-11-26 07:34:16 UTC

This message is a reminder that Fedora 8 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 8.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '8'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 8's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 8 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 11 Matthew Barnes 2008-11-29 06:01:08 UTC

Any sign of this in Fedora 10?  Looks obsolete to me.

Comment 12 Matthew Barnes 2008-12-10 15:40:56 UTC

Closing as INSUFFICIENT_DATA due to lack of response.

Comment 13 Christopher Beland 2008-12-15 16:11:50 UTC

Evolution has not been exploding for me in Fedora 9, so I think it's been fixed.

Comment 14 Matthew Barnes 2008-12-15 17:37:02 UTC

Thanks.  Changing resolution to WORKSFORME.

We'll say it's at least exploding in different ways now, yeah?  ;)

Note You need to log in before you can comment on or make changes to this bug.