[Evolution] Bug#699501: evolution: racy tooltip handling leads evolution to segfault

[Cyril Brulebois]

Package: evolution
Version: 3.4.4-1
Severity: important

Hi,

seen in calendar view, didn't check anything else right now.

Steps to reproduce:
 - Create an event in the local calendar.
 - Click the checkbox for this calendar off and on, to make
   sure the checkbox has the focus.
 - Hover the event to get a tooltip displayed.
 - Tap “space” twice:
    - The first one makes the tooltip disappear.
    - The second one triggers the segfault.

Last frames are:
| Program received signal SIGSEGV, Segmentation fault.
| 0x00007ffff6da06e8 in ?? () from /usr/lib/libedataserverui-3.0.so.1
| (gdb) bt
| #0  0x00007ffff6da06e8 in ?? () from /usr/lib/libedataserverui-3.0.so.1
| #1  0x00007ffff6137329 in gtk_cell_area_activate_cell (area=area at entry=0x555556bd2640, widget=widget at entry=0x555556b0c830, 
|     renderer=renderer at entry=0x555556d011c0, event=event at entry=0x0, cell_area=cell_area at entry=0x7fffffffcfc0, flags=flags at entry=0)
|     at /tmp/buildd/gtk+3.0-3.4.2/./gtk/gtkcellarea.c:3406
| #2  0x00007ffff61374ae in gtk_cell_area_real_activate (area=0x555556bd2640, context=0x555556d010c0, widget=0x555556b0c830, 
|     cell_area=0x7fffffffd020, flags=0, edit_only=0) at /tmp/buildd/gtk+3.0-3.4.2/./gtk/gtkcellarea.c:1477
| #3  0x00007ffff62f5e49 in gtk_tree_view_start_editing (tree_view=tree_view at entry=0x555556b0c830, 
|     cursor_path=cursor_path at entry=0x555557035f90, edit_only=edit_only at entry=0) at /tmp/buildd/gtk+3.0-3.4.2/./gtk/gtktreeview.c:15657
| #4  0x00007ffff62f9d85 in gtk_tree_view_real_select_cursor_row (tree_view=tree_view at entry=0x555556b0c830, start_editing=1)
|     at /tmp/buildd/gtk+3.0-3.4.2/./gtk/gtktreeview.c:10723

No dbg package for libedataserverui unfortunately, but the crash
is trivial to reproduce. Please let me know if that's not the
case for you.

Mraw,
KiBi.

-- System Information:
Debian Release: 7.0
  APT prefers testing
  APT policy: (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages evolution depends on:
ii  dbus                     1.6.8-1
ii  debconf [debconf-2.0]    1.5.49
ii  evolution-common         3.4.4-1
ii  evolution-data-server    3.4.4-1
ii  gconf-service            3.2.5-1+build1
ii  gconf2                   3.2.5-1+build1
ii  gnome-icon-theme         3.4.0-2
ii  libatk1.0-0              2.4.0-2
ii  libc6                    2.13-37
ii  libcairo-gobject2        1.12.2-2
ii  libcairo2                1.12.2-2
ii  libcamel-1.2-33          3.4.4-1
ii  libclutter-gtk-1.0-0     1.2.0-2
ii  libdbus-glib-1-2         0.100-1
ii  libebackend-1.2-2        3.4.4-1
ii  libebook-1.2-13          3.4.4-1
ii  libecal-1.2-11           3.4.4-1
ii  libedataserver-1.2-16    3.4.4-1
ii  libedataserverui-3.0-1   3.4.4-1
ii  libenchant1c2a           1.6.0-7
ii  libevolution             3.4.4-1
ii  libgail-3-0              3.4.2-5
ii  libgconf-2-4             3.2.5-1+build1
ii  libgdata13               0.12.0-1
ii  libgdk-pixbuf2.0-0       2.26.1-1
ii  libglib2.0-0             2.33.12+really2.32.4-3
ii  libgnome-desktop-3-2     3.4.2-1
ii  libgtk-3-0               3.4.2-5
ii  libgtkhtml-4.0-0         4.4.4-1
ii  libgtkhtml-editor-4.0-0  4.4.4-1
ii  libgweather-3-0          3.4.1-1+build1
ii  libical0                 0.48-2
ii  libmx-1.0-2              1.4.6-1
ii  libnotify4               0.7.5-1
ii  libnspr4                 2:4.9.2-1
ii  libnspr4-0d              2:4.9.2-1
ii  libnss3                  2:3.13.6-2
ii  libnss3-1d               2:3.13.6-2
ii  libpango1.0-0            1.30.0-1
ii  libsoup2.4-1             2.38.1-2
ii  libsqlite3-0             3.7.13-1
ii  libxml2                  2.8.0+dfsg1-7
ii  psmisc                   22.19-1

Versions of packages evolution recommends:
pn  bogofilter | spamassassin  <none>
pn  evolution-plugins          <none>
pn  evolution-webcal           <none>
pn  yelp                       <none>

Versions of packages evolution suggests:
ii  evolution-dbg                   3.4.4-1
pn  evolution-exchange              <none>
pn  evolution-plugins-experimental  <none>
ii  gnupg                           1.4.12-7
ii  network-manager                 0.9.4.0-8

-- debconf information:
  evolution/kill_processes:
  evolution/needs_shutdown: