evolution-2.0.0 crash

[Vladimir Grebenschikov]

В ср, 15/09/2004 в 20:25 +0400, Vladimir Grebenschikov пишет:
> В Wed, 15/09/2004 в 16:30 +0400, Vladimir Grebenschikov пишет:
> > Hi
> 
> Ok, in a hour it happens again, evolution - crashed with core. This time
> I am save mailbox causing problem (and cleaning indexes and meta-data
> does not help), now going to rebuild evo with debug and see more details
> in gdb.
> 
> Folder is really big: 16783 messages, but messages small: 19Mb space
> (this is cvs log for long period).
> 
> > today evolution was crashed 
> > (it was not related to upgrade directly)

More details:

% gdb ./work/evolution-2.0.0/shell/.libs/evolution evolution.core
...
Loaded symbols for /libexec/ld-elf.so.1
#0  0x297e91d7 in sort_thread (cp=0xbfadce08) at camel-folder-
thread.c:401
401                     carray[size] = c;
(gdb) bt
#0  0x297e91d7 in sort_thread (cp=0xbfadce08) at camel-folder-
thread.c:401
#1  0x297e94a7 in thread_summary (thread=0x884da80, summary=0x8374adc)
at camel-folder-thread.c:517
#2  0x297e96d4 in camel_folder_thread_messages_new (folder=0x82069a0,
uids=0x87143f0, thread_subject=-1079128568) at camel-folder-thread.c:630
#3  0x29a1a86b in regen_list_regen ()
from /usr/X11R6/lib/evolution/2.0/components/libevolution-mail.so
#4  0x29a0a2e4 in mail_msg_received ()
from /usr/X11R6/lib/evolution/2.0/components/libevolution-mail.so
#5  0x28101eff in thread_received_msg (e=0x8188ec0, m=0x85b1b00) at e-
msgport.c:826
#6  0x28102068 in thread_dispatch (din=0x8188ec0) at e-msgport.c:907
#7  0x286fa009 in _thread_start () from /usr/lib/libc_r.so.5
#8  0x00000000 in ?? ()
(gdb) p size
$1 = 0
(gdb) p carray
$2 = (CamelFolderThreadNode **) 0xbfacc770
(gdb) p carray[0]
Cannot access memory at address 0xbfacc770
(gdb) p c
$3 = (CamelFolderThreadNode *) 0x8c04d50
(gdb) p *c
$4 = {next = 0x8c03120, parent = 0x0, child = 0x0, message = 0x87d8310,
root_subject = 0x0, order = 14387, re = 0}

related code:
394             }
395             if (size<2)
(gdb) 
396                     return;
397             carray = alloca(size*sizeof(CamelFolderThreadNode *));
398             c = *cp;
399             size=0;
400             while (c) {
401                     carray[size] = c;
402                     c = c->next;
403                     size++;
404             }
405             qsort(carray, size, sizeof(CamelFolderThreadNode *),
sort_node);

looks like alloca() returns bad memory region ...

Any ideas ?


 
> > # gdb evolution-2.0 evolution-2.0.core
> > ....
> > Loaded symbols for /libexec/ld-elf.so.1
> > #0  0x297820eb in sort_thread ()
> > from /usr/X11R6/lib/evolution/2.0/libcamel.so.0
> > (gdb) bt
> > #0  0x297820eb in sort_thread ()
> > from /usr/X11R6/lib/evolution/2.0/libcamel.so.0
> > #1  0x297823bb in thread_summary ()
> > from /usr/X11R6/lib/evolution/2.0/libcamel.so.0
> > #2  0x297825e8 in camel_folder_thread_messages_new ()
> > from /usr/X11R6/lib/evolution/2.0/libcamel.so.0
> > #3  0x299b386b in regen_list_regen ()
> >    from /usr/X11R6/lib/evolution/2.0/components/libevolution-mail.so
> > #4  0x299a32e4 in mail_msg_received ()
> >    from /usr/X11R6/lib/evolution/2.0/components/libevolution-mail.so
> > #5  0x28100e4f in thread_received_msg ()
> > from /usr/X11R6/lib/evolution/2.0/libeutil.so.0
> > #6  0x28100fb8 in thread_dispatch ()
> > from /usr/X11R6/lib/evolution/2.0/libeutil.so.0
> > #7  0x286f9009 in _thread_start () from /usr/lib/libc_r.so.5
> > #8  0x00000000 in ?? ()
> > (gdb) 
> > 
> > 
> > It was due to bad folder cmeta or index, I have spend sometime trying to
> > find bad file, unfortunately I have remove it :(
> > 
> > I can't imagine how file can be trashed, I have started evo at morning,
> > than (after 5 hours of work) evo was closed unexpectedly (even without
> > gnome crash wrapper, may be if was Ctrl-Q but I am not sure)
> > 
> > After that evo crashed on on each start while draw mail folders tree.
> > Until I've removed folder with bad meta-data.
> > 
-- 
Vladimir B. Grebenchikov
vova at fbsd.ru