Bug 842259 - [abrt] evolution-3.4.3-2.fc17: __GI___libc_malloc: Process /usr/bin/evolution was killed by signal 11 (SIGSEGV)
Summary: [abrt] evolution-3.4.3-2.fc17: __GI___libc_malloc: Process /usr/bin/evolution...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: evolution
Version: 17
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Matthew Barnes
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:65d16661c9e81259c24ee26ef9f...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-07-23 09:20 UTC by Bryn M. Reeves
Modified: 2013-08-01 03:45 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-08-01 03:45:04 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: core_backtrace (155.02 KB, text/plain)
2012-07-23 09:20 UTC, Bryn M. Reeves
no flags Details
File: backtrace (186.04 KB, text/plain)
2012-07-23 09:20 UTC, Bryn M. Reeves
no flags Details
File: gconf_subtree (4.38 KB, text/plain)
2012-07-23 09:20 UTC, Bryn M. Reeves
no flags Details
File: maps (94.54 KB, text/plain)
2012-07-23 09:20 UTC, Bryn M. Reeves
no flags Details
File: dso_list (19.60 KB, text/plain)
2012-07-23 09:20 UTC, Bryn M. Reeves
no flags Details
File: build_ids (7.65 KB, text/plain)
2012-07-23 09:20 UTC, Bryn M. Reeves
no flags Details
test email (605 bytes, text/plain)
2012-07-24 14:12 UTC, Milan Crha
no flags Details

Description Bryn M. Reeves 2012-07-23 09:20:28 UTC
libreport version: 2.0.10
abrt_version:   2.0.10
backtrace_rating: 4
cmdline:        evolution
comment:        Downloading ~378 new messages from IMAP. UI became increasingly slugish (no message display got past 'Formatting message...', then crash.
crash_function: __GI___libc_malloc
executable:     /usr/bin/evolution
kernel:         3.4.5-2.fc17.x86_64
pid:            11023
pwd:            /home/breeves
time:           Mon 23 Jul 2012 10:02:46 AM BST
uid:            4078
username:       breeves

backtrace:      Text file, 190504 bytes
build_ids:      Text file, 7831 bytes
core_backtrace: Text file, 158740 bytes
dso_list:       Text file, 20070 bytes
gconf_subtree:  Text file, 4489 bytes
maps:           Text file, 96804 bytes

cgroup:
:9:perf_event:/
:8:blkio:/
:7:net_cls:/
:6:freezer:/
:5:devices:/
:4:memory:/
:3:cpuacct,cpu:/
:2:cpuset:/
:1:name=systemd:/user/breeves/2

environ:
:XDG_VTNR=1
:SSH_AGENT_PID=1238
:XDG_SESSION_ID=2
:HOSTNAME=hex.usersys.redhat.com
:IMSETTINGS_INTEGRATE_DESKTOP=yes
:SHELL=/bin/bash
:TERM=dumb
:HISTSIZE=1000
:GNOME_KEYRING_CONTROL=/run/user/breeves/keyring-leiUL5
:QT_GRAPHICSSYSTEM_CHECKED=1
:IMSETTINGS_MODULE=none
:USER=breeves
:SSH_AUTH_SOCK=/run/user/breeves/keyring-leiUL5/ssh
:USERNAME=breeves
:MAIL=/var/spool/mail/breeves
:PATH=/usr/lib64/ccache:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/home/breeves/bin
:DESKTOP_SESSION=gnome
:QT_IM_MODULE=xim
:PWD=/home/breeves
:XMODIFIERS=@im=none
:GNOME_KEYRING_PID=1063
:LANG=en_US.UTF-8
:GDMSESSION=gnome
:HISTCONTROL=ignoredups
:XDG_SEAT=seat0
:HOME=/home/breeves
:SHLVL=1
:LOGNAME=breeves
:CVS_RSH=ssh
:DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-WHyEbrSRrf,guid=6bf5303323f4f0185589690000000050
:'LESSOPEN=||/usr/bin/lesspipe.sh %s'
:WINDOWPATH=1
:XDG_RUNTIME_DIR=/run/user/breeves
:DISPLAY=:0
:CCACHE_HASHDIR=
:XAUTHORITY=/var/run/gdm/auth-for-breeves-APhita/database
:_=/usr/bin/gnome-session
:GNOME_DESKTOP_SESSION_ID=this-is-deprecated
:SESSION_MANAGER=local/unix:@/tmp/.ICE-unix/1070,unix/unix:/tmp/.ICE-unix/1070
:GPG_AGENT_INFO=/run/user/breeves/keyring-leiUL5/gpg:0:1
:GJS_DEBUG_OUTPUT=stderr
:'GJS_DEBUG_TOPICS=JS ERROR;JS LOG'
:GIO_LAUNCHED_DESKTOP_FILE=/usr/share/applications/evolution.desktop
:GIO_LAUNCHED_DESKTOP_FILE_PID=11023
:DESKTOP_STARTUP_ID=gnome-shell-1303-hex.usersys.redhat.com-evolution-2_TIME80532186

limits:
:Limit                     Soft Limit           Hard Limit           Units     
:Max cpu time              unlimited            unlimited            seconds   
:Max file size             unlimited            unlimited            bytes     
:Max data size             unlimited            unlimited            bytes     
:Max stack size            8388608              unlimited            bytes     
:Max core file size        0                    unlimited            bytes     
:Max resident set          unlimited            unlimited            bytes     
:Max processes             1024                 29852                processes 
:Max open files            1024                 4096                 files     
:Max locked memory         65536                65536                bytes     
:Max address space         unlimited            unlimited            bytes     
:Max file locks            unlimited            unlimited            locks     
:Max pending signals       29852                29852                signals   
:Max msgqueue size         819200               819200               bytes     
:Max nice priority         0                    0                    
:Max realtime priority     0                    0                    
:Max realtime timeout      unlimited            unlimited            us        

open_fds:
:0:/dev/null
:pos:	0
:flags:	0100000
:1:/home/breeves/.xsession-errors
:pos:	8271
:flags:	0102002
:2:/home/breeves/.xsession-errors
:pos:	8271
:flags:	0102002
:3:socket:[471064]
:pos:	0
:flags:	02004002
:4:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:5:socket:[468514]
:pos:	0
:flags:	02004002
:6:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:7:socket:[470286]
:pos:	0
:flags:	02004002
:8:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:9:socket:[469282]
:pos:	0
:flags:	02004002
:10:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:11:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:12:/home/breeves/.pki/nssdb/cert9.db
:pos:	40
:flags:	02100002
:13:/var/tmp/etilqs_JryaelZKSfobgEa (deleted)
:pos:	28
:flags:	02100002
:14:/var/tmp/etilqs_RuDn1l9iUzKJd8y (deleted)
:pos:	2056
:flags:	02500002
:15:/var/tmp/etilqs_ERVOod9Ep5YIrLb (deleted)
:pos:	2048
:flags:	02500002
:16:/home/breeves/.pki/nssdb/key4.db
:pos:	40
:flags:	02100002
:17:/var/tmp/etilqs_bBsEguWTdMWqFL3 (deleted)
:pos:	28
:flags:	02100002
:18:/var/tmp/etilqs_6nYUUncK40YZD5U (deleted)
:pos:	2056
:flags:	02500002
:19:/var/tmp/etilqs_RVaqO97Y9AITRO8 (deleted)
:pos:	2048
:flags:	02500002
:20:/etc/pki/nssdb/cert9.db
:pos:	40
:flags:	02100000
:21:/var/tmp/etilqs_J9hLTObsb2ahKJj (deleted)
:pos:	28
:flags:	02100002
:22:/var/tmp/etilqs_WA6J1YGKRdtonFt (deleted)
:pos:	2048
:flags:	02500002
:23:/etc/pki/nssdb/key4.db
:pos:	40
:flags:	02100000
:24:/var/tmp/etilqs_uvBSW0Jd6EucrTy (deleted)
:pos:	28
:flags:	02100002
:25:/var/tmp/etilqs_TDbY0DnSaX7CIr2 (deleted)
:pos:	2048
:flags:	02500002
:26:socket:[471065]
:pos:	0
:flags:	02004002
:27:/home/breeves/.local/share/evolution/mail/local/folders.db
:pos:	40
:flags:	02100002
:28:/var/tmp/etilqs_htBthCb0ls9XYmq (deleted)
:pos:	28
:flags:	02100002
:29:/home/breeves/.local/share/evolution/mail/vfolder/folders.db
:pos:	40
:flags:	02100002
:30:/var/tmp/etilqs_AhRxnzfUJyXGmLP (deleted)
:pos:	3084
:flags:	02500002
:31:/var/tmp/etilqs_QTcpn1bGJMBMSE5 (deleted)
:pos:	3072
:flags:	02500002
:32:socket:[469285]
:pos:	0
:flags:	02004002
:33:anon_inode:[eventfd]
:pos:	0
:flags:	02004002
:34:/home/breeves/.cache/evolution/mail/1342778490.32419.0.redhat.com/folders.db
:pos:	42442752
:flags:	02100002
:35:socket:[469981]
:pos:	0
:flags:	04002
:36:anon_inode:inotify
:pos:	0
:flags:	02004000
:37:socket:[471363]
:pos:	0
:flags:	02004002

var_log_messages:
:Jul 16 12:52:44 hex yum[22562]: Updated: evolution-3.4.3-2.fc17.x86_64
:Jul 16 12:53:47 hex yum[22562]: Updated: evolution-help-3.4.3-2.fc17.noarch
:Jul 16 12:53:47 hex yum[22562]: Updated: evolution-NetworkManager-3.4.3-2.fc17.x86_64
:Jul 23 10:03:05 hex abrt[22755]: Saved core dump of pid 11023 (/usr/bin/evolution) to /var/spool/abrt/ccpp-2012-07-23-10:02:46-11023 (1632366592 bytes)

xsession_errors:
:(evolution-alarm-notify:1319): evolution-alarm-notify-WARNING **: alarm.c:254: Requested removal of nonexistent alarm!
:(evolution:11023): e-data-server-ui-WARNING **: ENameSelector: Could not load "Personal": Cannot open book: Address book does not exist
:(evolution:11023): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed
:(evolution:11023): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed
:(evolution:11023): camel-WARNING **: CamelIMAPXFolder::synchronize_message_sync() reported failure without setting its GError
:(evolution:11023): camel-WARNING **: CamelIMAPXFolder::get_message_sync() reported failure without setting its GError
:(evolution:11023): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed
:(evolution:22829): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
:(evolution:22829): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.

Comment 1 Bryn M. Reeves 2012-07-23 09:20:34 UTC
Created attachment 599727 [details]
File: core_backtrace

Comment 2 Bryn M. Reeves 2012-07-23 09:20:38 UTC
Created attachment 599728 [details]
File: backtrace

Comment 3 Bryn M. Reeves 2012-07-23 09:20:40 UTC
Created attachment 599729 [details]
File: gconf_subtree

Comment 4 Bryn M. Reeves 2012-07-23 09:20:42 UTC
Created attachment 599730 [details]
File: maps

Comment 5 Bryn M. Reeves 2012-07-23 09:20:45 UTC
Created attachment 599731 [details]
File: dso_list

Comment 6 Bryn M. Reeves 2012-07-23 09:20:47 UTC
Created attachment 599732 [details]
File: build_ids

Comment 7 Bryn M. Reeves 2012-07-24 12:34:41 UTC
"formatting message"

backtrace_rating: 4
Package: evolution-3.4.3-2.fc17
OS Release: Fedora release 17 (Beefy Miracle)

Comment 8 Milan Crha 2012-07-24 14:12:15 UTC
Thanks for a bug report. I do not see from it what can be wrong, evolution only failed to allocate 2KB of memory, while it was formatting a message with inline pgp signature (or encryption, I cannot tell for sure from the snippet I see in the backtrace). I tried to create an inline GPG signature, but it works fine for me if I import it into evolution - maybe it's too short?

My question is, can you reproduce this with that particular message, please?

Comment 9 Milan Crha 2012-07-24 14:12:58 UTC
Created attachment 600037 [details]
test email

This test email works fine for me.

Comment 10 Bryn M. Reeves 2012-07-24 14:18:52 UTC
Thanks Milan - it appears to happen "at random" while reading mails - I assume every time I hit one that has the "problem" formatting. I think the failure is more than just an allocation problem however - the process takes a sig11 during malloc which generally indicates arena corruption.

Maybe there's a problem in an error path?

Anyway; thanks for your analysis so far - I'd wondered if there was a link to pgp signed messages from the backtrace data. I will see if I can get it to trigger any more reliably with this information.

Comment 11 Milan Crha 2012-07-25 07:40:05 UTC
You are right, this kind of crashes usually mean memory corruption. I wanted to get a reproducer first, then involve valgrind, because it's easier to know steps to reproduce than to run evolution under valgrind for an extended period (evolution is very slow when under valgrind). You can run evolution under valgrind with command like this:
  $ G_SLICE=always-malloc valgrind --num-callers=50 evolution &>log.txt
but before that edit /usr/lib64/valgrind/default.supp and add there these 5 lines at the top:
{
   Skip any wcslen calls
   Memcheck:Addr8
   fun:wcslen
}
to avoid false-positives which are triggered with wcslen usage in F17. The log.txt may contain some useful information, even if evolution will not crash, because valgrind can avoid certain crashes.

Comment 12 Fedora End Of Life 2013-07-04 00:14:58 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 13 Fedora End Of Life 2013-08-01 03:45:09 UTC
Fedora 17 changed to end-of-life (EOL) status on 2013-07-30. Fedora 17 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.