evolution crash on -STABLE amd64 x2

[Sean McNeil]

I get the following crash that happens on occasion when quitting:

Program terminated with signal 11, Segmentation fault.
...
#0  0x000000080764898c in kse_thr_interrupt () at kse_thr_interrupt.S:2
2       kse_thr_interrupt.S: No such file or directory.
        in kse_thr_interrupt.S
[New Thread 0xdaa400 (runnable)]
[New Thread 0xc94800 (runnable)]
[New Thread 0x7e2c00 (runnable)]
[New Thread 0x7bdc00 (runnable)]
[New Thread 0x6ac800 (runnable)]
[New Thread 0x6ac400 (LWP 100363)]
[New Thread 0x52d000 (runnable)]
[New LWP 100367]

(gdb) info thr
* 8 LWP 100367  0x000000080764898c in kse_thr_interrupt ()
    at kse_thr_interrupt.S:2
  7 Thread 0x52d000 (runnable)  0x0000000000415a8a in
e_shell_window_set_title
    (window=0x7300b0, component_id=0xa07bc0 "mail",
    title=0x691e00 "Evolution - Mail") at e-shell-window.c:1221
  6 Thread 0x6ac400 (LWP 100363)  0x000000080764894c in kse_release ()
    at kse_release.S:2
  5 Thread 0x6ac800 (runnable)  0x0000000807824efc in select () at
select.S:2
  4 Thread 0x7bdc00 (runnable)  _thr_sched_switch_unlocked
(curthread=0x7bdc00)
    at pthread_md.h:226
  3 Thread 0x7e2c00 (runnable)  _thr_sched_switch_unlocked
(curthread=0x7e2c00)
    at pthread_md.h:226
  2 Thread 0xc94800 (runnable)  _thr_sched_switch_unlocked
(curthread=0xc94800)
    at pthread_md.h:226
  1 Thread 0xdaa400 (runnable)  _thr_sched_switch_unlocked
(curthread=0xdaa400)
    at pthread_md.h:226

thr 7
bt

#0  0x0000000000415a8a in e_shell_window_set_title (window=0x7300b0,
    component_id=0xa07bc0 "mail", title=0x691e00 "Evolution - Mail")
    at e-shell-window.c:1221
#1  0x0000000000415b4b in impl_ShellView_setTitle (_servant=0x7300b0,
    id=0xa07bc0 "mail", title=0xa07bc0 "mail", ev=0x7fffffffe210)
    at e-shell-view.c:48
#2  0x0000000804a048ce in ORBit_c_stub_invoke (obj=0x6a4880,
    methods=0x80075b288, method_index=0, ret=0x0, args=0x7fffffffe490,
    ctx=0x0, ev=0x7fffffffe4b0, class_id=13, method_offset=8,
    skel_impl=0x8006545d0
<_ORBIT_skel_small_GNOME_Evolution_ShellView_setTitle>) at poa.c:2630
#3  0x00000008006559c5 in GNOME_Evolution_ShellView_setTitle
(_obj=0x7300b0,
    component=0xa07bc0 "mail", title=0x80a972f5a "Mail",
ev=0x7fffffffe210)
    at Evolution-stubs.c:27
#4  0x00000008006574cc in e_component_view_set_title (ecv=0x10,
title=0x0)
    at e-component-view.c:136
#5  0x000000080a93ef47 in view_changed_timeout (d=0x9e91b0)
    at mail-component.c:579
#6  0x00000008071c9dfb in g_timeout_dispatch (source=0x7e3780,
    callback=0xa07bc0, user_data=0x691e00) at gmain.c:3292
#7  0x00000008071c6e8d in IA__g_main_context_dispatch (context=0x570b00)
    at gmain.c:1916
#8  0x00000008071c8b3c in g_main_context_iterate (context=0x570b00,
    block=123935200, dispatch=1, self=0x7fffffffe210) at gmain.c:2547
#9  0x00000008071c8ed5 in IA__g_main_loop_run (loop=0x61e950) at
gmain.c:2751
#10 0x00000008044209bb in bonobo_main () at bonobo-main.c:311
#11 0x00000000004179b8 in main (argc=5525504, argv=0x7fffffffe980)
    at main.c:611

thr 5
bt

#0  0x0000000807824efc in select () at select.S:2
#1  0x000000080774e6a8 in _thread_off_tcb ()
from /usr/lib/libpthread.so.2
#2  0x00000000006ac800 in ?? ()
#3  0x0000000100000000 in ?? ()
#4  0x0000000000000000 in ?? ()
#5  0x000000080763ef91 in mutex_unlock_common (m=0x6ac800,
add_reference=0)
    at /usr/src/lib/libpthread/thread/thr_mutex.c:1196
#6  0x00000001006ac800 in ?? ()
#7  0x000000080774e6a8 in _thread_off_tcb ()
from /usr/lib/libpthread.so.2
#8  0x000000080763d88c in mutex_lock_common (curthread=0x1006ac800,
    m=0x80763d88c, abstime=0x80774e6a8)
    at /usr/src/lib/libpthread/thread/thr_mutex.c:730
#9  0x00000008076482dc in _thr_cancel_enter (thread=0x80774e6a8)
    at /usr/src/lib/libpthread/thread/thr_cancel.c:272
#10 0x000000080763153c in __select (numfds=0, readfds=0x6ac800,
    writefds=0x1006ac800, exceptfds=0x6ac800, timeout=0x0)
    at /usr/src/lib/libpthread/thread/thr_select.c:61
#11 0x000000080249fe2c in e_msgport_wait (mp=0x642200) at
e-msgport.c:643
#12 0x00000008024a06cd in thread_dispatch (din=0x4e) at e-msgport.c:1035
#13 0x0000000807639b89 in thread_start (curthread=0x4e,
    start_routine=0x7fffff9fde10, arg=0x4e)
    at /usr/src/lib/libpthread/thread/thr_create.c:341
#14 0x0000000807796dd4 in makectx_wrapper (ucp=0x8005e1060, func=0,
args=0x1)
#15 0x0000000000000000 in ?? ()
#16 0x00000000006ac800 in ?? ()
#17 0x00000008024a05e0 in e_thread_busy () at e-msgport.c:949
#18 0x0000000000642100 in ?? ()
#19 0x0000000000000000 in ?? ()
#20 0x0000000000000000 in ?? ()
#21 0x0000000000000000 in ?? ()
Cannot access memory at address 0x7fffff9fe000

I am thinking it is some sort of race condition on threads.  I am unable
to reproduce it running under gdb.  Does gdb somehow prevent threads
from going to different cpus?