Bug 150588 – [GTK] Crash calling WebKit.DOM.HTMLElement.remove_child

• Component: WebKitGTK
• Status: RESOLVED WONTFIX

[Michael Gratton]

WebKitGTK+ 2.4.9 (i.e. WebKit1?) is segfaulting after a call to WebKit.DOM.HTMLElement.remove_child in Geary when it is displaying certain HTML email messages. Most messages are fine, it's just these specific ones that are causing it.

Stack trace as follows:

(gdb) bt full
#0  0x00007ffff545ba84 in WebCore::RenderBlockFlow::removeFloatingObject(WebCore::RenderBox&) (value=<optimised out>, this=0xa0)
    at ../Source/WTF/wtf/Vector.h:807
        i = 0
        logicalTop = <optimised out>
        logicalBottom = {m_value = 7360}
        floatingObject = 0x7fff2bf35c08
        it = <optimised out>
#1  0x00007ffff545ba84 in WebCore::RenderBlockFlow::removeFloatingObject(WebCore::RenderBox&) (floatingBox=..., this=0x4c31830)
    at ../Source/WebCore/rendering/RootInlineBox.h:157
        logicalTop = <optimised out>
        logicalBottom = {m_value = 7360}
        floatingObject = 0x7fff2bf35c08
        it = <optimised out>
#2  0x00007ffff545ba84 in WebCore::RenderBlockFlow::removeFloatingObject(WebCore::RenderBox&) (this=this@entry=
    0x7fff2bf21b40, floatBox=...) at ../Source/WebCore/rendering/RenderBlockFlow.cpp:2117
        logicalTop = <optimised out>
        logicalBottom = {m_value = 7360}
        floatingObject = 0x7fff2bf35c08
        it = <optimised out>
#3  0x00007ffff545bc27 in WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout(WebCore::RenderBox*, bool) (this=this@entry=0x7fff2bf21b40, floatToRemove=floatToRemove@entry=0x7fff2bf460b0, inLayout=inLayout@entry=false)
    at ../Source/WebCore/rendering/RenderBlockFlow.cpp:2545
---Type <return> to continue, or q <return> to quit---
        markParents = <optimised out>
        inLayout = <optimised out>
        floatToRemove = 0x7fff2bf460b0
        this = 0x7fff2bf21b40
#4  0x00007ffff54760d5 in WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists() (this=this@entry=0x7fff2bf460b0)
    at ../Source/WebCore/rendering/RenderBox.cpp:260
        parentBlock = 0x7fff2bf21b40
        this = 0x7fff2bf460b0
#5  0x00007ffff54b5eb8 in WebCore::RenderElement::removeChildInternal(WebCore::RenderObject&, WebCore::RenderElement::NotifyChildrenType) (this=0x7fff2bf70a80, oldChild=..., notifyChildren=WebCore::RenderElement::NotifyChildren)
    at ../Source/WebCore/rendering/RenderElement.cpp:598
#6  0x00007ffff5568e68 in WebCore::RenderObject::willBeDestroyed() (this=0x7fff2bf460b0)
    at ../Source/WebCore/rendering/RenderObject.cpp:1841
#7  0x00007ffff556ecd5 in WebCore::RenderObject::destroy() (this=0x7fff2bf460b0)
    at ../Source/WebCore/rendering/RenderObject.cpp:1962
#8  0x00007ffff556edc9 in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers() (this=<optimised out>)
    at ../Source/WebCore/rendering/RenderObject.cpp:1950
        destroyRoot = <optimised out>


#9  0x00007ffff5644592 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=
    ..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:623
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#10 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachT---Type <return> to continue, or q <return> to quit---
ype=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b11e20
#11 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#12 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0xde1d70
#13 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#14 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0xde1d00
#15 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#16 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b82760
#17 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
---Type <return> to continue, or q <return> to quit---
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#18 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b826a0
#19 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#20 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=
    ..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b822d0
#21 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#22 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b82200
#23 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#24 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b82000
---Type <return> to continue, or q <return> to quit---
#25 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#26 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b81f40
#27 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#28 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b81ed0
#29 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#30 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b81e00
#31 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#32 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachT---Type <return> to continue, or q <return> to quit---
ype=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4b81ca0
#33 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#34 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4baf580
#35 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#36 0x00007ffff56443f3 in WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:593
        child = 0x4bfe700
#37 0x00007ffff56444e1 in WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) (current=..., detachType=detachType@entry=WebCore::Style::NormalDetach) at ../Source/WebCore/style/StyleResolveTree.cpp:620
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
#38 0x00007ffff564437c in WebCore::Style::detachRenderTree(WebCore::Element&) (element=...)
    at ../Source/WebCore/style/StyleResolveTree.cpp:911
#39 0x00007ffff4f51f08 in WebCore::ContainerNode::removeBetween(WebCore::Node*, WebCore::Node*, WebCore::Node&) (child=...)
    at ../Source/WebCore/dom/ContainerNode.cpp:113
#40 0x00007ffff4f51f08 in WebCore::ContainerNode::removeBetween(WebCore::Node*, WebCore::Node*, WebCore::Node&) (
---Type <return> to continue, or q <return> to quit---
    this=this@entry=0xed6910, previousChild=previousChild@entry=0x0, nextChild=nextChild@entry=0xed6980, oldChild=...)
    at ../Source/WebCore/dom/ContainerNode.cpp:593
#41 0x00007ffff4f520ed in WebCore::ContainerNode::removeChild(WebCore::Node*, int&) (this=this@entry=0xed6910, oldChild=0x4ba2e00, ec=<optimised out>) at ../Source/WebCore/dom/ContainerNode.cpp:574
        suspendWidgetHierarchyUpdates = {static s_widgetHierarchyUpdateSuspendCount = 16}
        prev = 0x0
        next = 0xed6980
        protect = {m_ptr = 0xed6910}
        child = {m_ptr = 0x4ba2e00}
#42 0x00007ffff4fb202e in WebCore::Node::removeChild(WebCore::Node*, int&) (this=this@entry=0xed6910, oldChild=oldChild@entry=0x4ba2e00, ec=ec@entry=@0x7fffffffda1c: 0) at ../Source/WebCore/dom/Node.cpp:448
#43 0x00007ffff5c5929c in webkit_dom_node_remove_child(WebKitDOMNode*, WebKitDOMNode*, GError**) (self=<optimised out>, oldChild=oldChild@entry=0x7fff5001a510 [WebKitDOMHTMLDivElement], error=error@entry=0x7fffffffda90)
    at DerivedSources/webkitdom/WebKitDOMNode.cpp:490
        state = {m_previousState = 0x0}
        __PRETTY_FUNCTION__ = "WebKitDOMNode* webkit_dom_node_remove_child(WebKitDOMNode*, WebKitDOMNode*, GError**)"
        item = 0xed6910
        convertedOldChild = 0x4ba2e00
        ec = 0
        ok = <optimised out>
        ecdesc = 
          {typeName = 0xed6910 "\260ȁ\366\377\177", name = 0x7fffffffda80 "\300n\276\004", description = 0x7ffff696cc30 <WebCore::---Type <return> to continue, or q <return> to quit---
JSMainThreadExecState::s_mainThreadState> "", code = 0, type = WebCore::DOMCoreExceptionType}
#44 0x00000000004d0a68 in conversation_viewer_clear (self=self@entry=0xdae2d0 [ConversationViewer], new_folder=new_folder@entry=0x4778440 [GearyImapEngineOtherFolder], account_information=0xa488a0 [GearyAccountInformation])
    at /home/mjg/local/src/geary/src/client/conversation-viewer/conversation-viewer.vala:328
        _tmp12_ = 0x7fff5001a510 [WebKitDOMHTMLDivElement]
        _tmp13_ = 0xe9b190 [WebKitDOMHTMLDivElement]
        _tmp14_ = 0x7fff5001a510 [WebKitDOMHTMLDivElement]
        _tmp7_ = <optimised out>
        _tmp9_ = 0x7fff5001a510
        _tmp11_ = <optimised out>
        _tmp6_ = 0x4be6ec0
        element = 0x7fff5001a510 [WebKitDOMHTMLDivElement]
        _tmp8_ = 0x4be6ec0
        _tmp10_ = 0x7fff5001a510 [WebKitDOMHTMLDivElement]
        _element_it = 0x0
        _tmp1_ = <optimised out>
        _tmp3_ = <optimised out>
        _tmp5_ = 0x4be6ec0
        _tmp0_ = <optimised out>
        _tmp2_ = <optimised out>
        _tmp4_ = 0x4be6ec0
        _tmp17_ = 0x0
---Type <return> to continue, or q <return> to quit---
        _tmp18_ = 0x0
        _tmp19_ = 0x0
        _tmp20_ = 0x0
        _tmp21_ = 0x0
        _tmp22_ = 0x0
        _tmp23_ = 0x0
        _tmp24_ = 0x0
        _inner_error_ = 0x0
        __func__ = "conversation_viewer_clear"
#45 0x00000000004e240e in _conversation_viewer_on_conversations_selected_geary_controller_conversations_selected (current_folder=0x4778440 [GearyImapEngineOtherFolder], conversations=0x7fff88009960, self=0xdae2d0 [ConversationViewer])
    at /home/mjg/local/src/geary/src/client/conversation-viewer/conversation-viewer.vala:470
        _tmp22_ = 0x4778440 [GearyImapEngineOtherFolder]
        _tmp27_ = 0x0
        _tmp30_ = 0
        _tmp35_ = 0x0
        _tmp25_ = <optimised out>
        _tmp33_ = 0x0
        _tmp38_ = 0x0
        _tmp41_ = 0x0
        _tmp23_ = <optimised out>
        _tmp28_ = 0
---Type <return> to continue, or q <return> to quit---
        _tmp31_ = 0x0
        _tmp36_ = 0x0
        _tmp21_ = 0x4778440 [GearyImapEngineOtherFolder]
        _tmp26_ = <optimised out>
        _tmp34_ = 0x0
        _tmp39_ = 0x0
        _tmp24_ = <optimised out>
        _tmp32_ = 0x0
        _tmp37_ = 0x0
        _tmp40_ = 0x0
        _tmp7_ = <optimised out>
        _tmp11_ = 0
        _tmp20_ = <optimised out>
        _tmp8_ = <optimised out>
        _tmp12_ = <optimised out>
        _tmp18_ = 0x7fff88009960
        _tmp0_ = <optimised out>
        _tmp9_ = <optimised out>
        _tmp10_ = <optimised out>
        _tmp13_ = 0x7fff88009960
        _tmp19_ = <optimised out>
#46 0x00000000004e240e in _conversation_viewer_on_conversations_selected_geary_controller_conversations_selected (_sender=<optimise---Type <return> to continue, or q <return> to quit---
d out>, conversations=0x7fff88009960, current_folder=0x4778440 [GearyImapEngineOtherFolder], self=0xdae2d0)
    at /home/mjg/local/src/geary/src/client/conversation-viewer/conversation-viewer.vala:213
#50 0x00007ffff30395f5 in <emit signal 0x695d37 "conversations-selected" on instance 0x9e8120 [GearyController]> (instance=0x9e8120, detailed_signal=0x695d37 "conversations-selected") at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gsignal.c:3479
        var_args = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7fffffffe050, reg_save_area = 0x7fffffffdf60}}
        detail = 0
        signal_id = 18
        itype = 10364832
        __func__ = "g_signal_emit_by_name"
    #47 0x00007ffff301e015 in g_closure_invoke (closure=0xcd4fd0, return_value=return_value@entry=0x0, n_param_values=3, param_values=param_values@entry=0x7fffffffdcf0, invocation_hint=invocation_hint@entry=0x7fffffffdc70)
    at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gclosure.c:801
                marshal = <optimised out>
                marshal_data = <optimised out>
                in_marshal = 0
                real_closure = 0xcd4fb0
                __func__ = "g_closure_invoke"
    #48 0x00007ffff3030061 in signal_emit_unlocked_R (node=node@entry=0x9e7420, detail=detail@entry=0, instance=instance@entry=0x9e8120, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7fffffffdcf0)
    at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gsignal.c:3627
                tmp = <optimised out>
                handler = 0xdd9900
---Type <return> to continue, or q <return> to quit---
                accumulator = 0x0
                emission = 
                  {next = 0x7fffffffe1b0, instance = 0x9e8120, ihint = {signal_id = 18, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 4}
                handler_list = 0xdd9900
                return_accu = 0x0
                accu = 
                      {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
                signal_id = 18
                max_sequential_handler_number = 22209
                return_value_altered = 0
    #49 0x00007ffff3038dfc in g_signal_emit_valist (instance=instance@entry=0x9e8120, signal_id=signal_id@entry=18, detail=detail@entry=0, var_args=var_args@entry=0x7fffffffdf18) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gsignal.c:3383
                instance_and_params = 0x7fffffffdcf0
                signal_return_type = <optimised out>
                param_values = 0x7fffffffdd08
                i = <optimised out>
                n_params = <optimised out>
                __func__ = "g_signal_emit_valist"
#51 0x00007ffff3021117 in g_cclosure_marshal_VOID__OBJECTv (closure=0xd57800, return_value=<optimised out>, instance=<optimised out---Type <return> to continue, or q <return> to quit---
>, args=<optimised out>, marshal_data=0x0, n_params=<optimised out>, param_types=0xe14cc0)
    at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gmarshal.c:2102
        cc = 0xd57800
        data1 = <optimised out>
        data2 = <optimised out>
        callback = <optimised out>
        arg0 = 0x7fff88009960
        args_copy = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fffffffe430, reg_save_area = 0x7fffffffe340}}
#52 0x00007ffff301e244 in _g_closure_invoke_va (closure=closure@entry=0xd57800, return_value=return_value@entry=0x0, instance=instance@entry=0xe0f740, args=args@entry=0x7fffffffe2f8, n_params=<optimised out>, param_types=0xe14cc0)
    at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gclosure.c:864
        marshal = <optimised out>
        marshal_data = <optimised out>
        in_marshal = 0
        real_closure = 0xd577e0
        __func__ = "_g_closure_invoke_va"
#53 0x00007ffff3038a46 in g_signal_emit_valist (instance=instance@entry=0xe0f740, signal_id=signal_id@entry=488, detail=detail@entry=0, var_args=var_args@entry=0x7fffffffe2f8) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gsignal.c:3292
        return_accu = <optimised out>
        accu = 
              {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_p---Type <return> to continue, or q <return> to quit---
ointer = 0x0}}}
        accumulator = 0x0
        emission = 
          {next = 0x0, instance = 0xe0f740, ihint = {signal_id = 488, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 13538544}
        signal_id = 488
        instance_type = <optimised out>
        emission_return = 
              {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = 4
        static_scope = 0
        fastpath_handler = <optimised out>
        closure = <optimised out>
        run_type = <optimised out>
        l = <optimised out>
        fastpath = <optimised out>
        instance_and_params = <optimised out>
        signal_return_type = <optimised out>
        param_values = <optimised out>
        i = <optimised out>
---Type <return> to continue, or q <return> to quit---
        n_params = <optimised out>
        __func__ = "g_signal_emit_valist"
#54 0x00007ffff30395f5 in g_signal_emit_by_name (instance=instance@entry=0xe0f740, detailed_signal=detailed_signal@entry=0x695d37 "conversations-selected") at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gsignal.c:3479
        var_args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffe430, reg_save_area = 0x7fffffffe340}}
        detail = 0
        signal_id = 488
        itype = 13538544
        __func__ = "g_signal_emit_by_name"
#55 0x00000000004ca3f6 in ___lambda42__gsource_func (self=0xe0f740 [ConversationListView])
    at /home/mjg/local/src/geary/src/client/conversation-list/conversation-list-view.vala:373
        _tmp35_ = <optimised out>
        _tmp37_ = 0x7fff88009960
        _tmp39_ = 0x7fff88009960
        _tmp34_ = 0x7fff50360f50 [GeeHashSet]
        _tmp36_ = <optimised out>
        _tmp38_ = 0x7fff88009960
        _tmp1_ = <optimised out>
Python Exception <class 'TypeError'> iter() returned non-iterator of type '_iterator': 
        _tmp11_ = 0x4c2a040
Python Exception <class 'TypeError'> iter() returned non-iterator of type '_iterator': 
        _tmp23_ = 0x4c2a040
        _tmp32_ = 0x7fff50360f50 [GeeHashSet]
        _tmp2_ = <optimised out>
---Type <return> to continue, or q <return> to quit---
Python Exception <class 'TypeError'> iter() returned non-iterator of type '_iterator': 
        paths = 0x4c2a040
Python Exception <class 'TypeError'> iter() returned non-iterator of type '_iterator': 
        _tmp12_ = 0x4c2a040
        new_selected = 0x7fff50360f50 [GeeHashSet]
        _tmp33_ = <optimised out>
        _tmp0_ = <optimised out>
        _tmp13_ = <optimised out>
        _tmp22_ = 0x7fff50360f50 [GeeHashSet]
        _tmp31_ = 0x474e510
#56 0x00000000004ca3f6 in ___lambda42__gsource_func (self=0xe0f740 [ConversationListView])
    at /home/mjg/local/src/geary/src/client/conversation-list/conversation-list-view.vala:329
#57 0x00000000004ca3f6 in ___lambda42__gsource_func (self=0xe0f740) at conversation-list-view.c:2213
#58 0x00007ffff2d48eaa in g_main_context_dispatch (context=0xa028b0) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./glib/gmain.c:3154
        dispatch = 0x7ffff2d45960 <g_idle_dispatch>
        prev_source = 0x0
        was_in_call = 0
        user_data = 0xe0f740
        callback = 0x4ca0d0 <___lambda42__gsource_func>
        cb_funcs = <optimised out>
        cb_data = 0x4bc8610
        need_destroy = <optimised out>
        source = 0x4b24850
        current = 0xa072c0
---Type <return> to continue, or q <return> to quit---
        i = 0
#59 0x00007ffff2d48eaa in g_main_context_dispatch (context=context@entry=0xa028b0)
    at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./glib/gmain.c:3769
#60 0x00007ffff2d49250 in g_main_context_iterate (context=context@entry=0xa028b0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimised out>) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./glib/gmain.c:3840
        max_priority = 300
        timeout = 0
        some_ready = 1
        nfds = <optimised out>
        allocated_nfds = 15
        fds = 0x4ba4870
#61 0x00007ffff2d492fc in g_main_context_iteration (context=0xa028b0, context@entry=0x0, may_block=may_block@entry=1)
    at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./glib/gmain.c:3901
        retval = <optimised out>
#62 0x00007ffff6a1fb1c in g_application_run (application=0x9e4140 [GearyApplication], argc=argc@entry=2, argv=argv@entry=0x7fffffffe6e8) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gio/gapplication.c:2311
        arguments = 0x9e3140
        status = 0
        __func__ = "g_application_run"
#63 0x00000000004841bf in _vala_main (args=0x7fffffffe6e8, args_length1=2)
    at /home/mjg/local/src/geary/src/client/application/main.vala:25
        result = 0
---Type <return> to continue, or q <return> to quit---
        app = 0x9e4140 [GearyApplication]
        _tmp0_ = 0x9e4140 [GearyApplication]
        ec = 0
        _tmp1_ = 0x7fffffffe6e8
        _tmp1__length1 = 2
        _tmp2_ = 0
#64 0x00007ffff2062a40 in __libc_start_main (main=
    0x4665e0 <main>, argc=2, argv=0x7fffffffe6e8, init=<optimised out>, fini=<optimised out>, rtld_fini=<optimised out>, stack_end=0x7fffffffe6d8) at libc-start.c:289
        result = <optimised out>
        unwind_buf = 
              {cancel_jmp_buf = {{jmp_buf = {0, 3139107078187285569, 4613616, 140737488348896, 0, 0, -3139107431737164735, -3139081921631060927}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x693270 <__libc_csu_init>, 0x7fffffffe6e8}, data = {prev = 0x0, cleanup = 0x0, canceltype = 6894192}}}
        not_first_call = <optimised out>
#65 0x0000000000466619 in _start ()
(gdb)

[Michael Catanzaro]

Since we haven't done security updates for 2.4 in some time, we really need to stop taking bug reports for it, sorry. :/  If you can reproduce with 2.10 and any application (I know porting Geary to 2.10 would be a pain), then please reopen.

Also, if you're affiliated with the Geary devs, please disable HTML mail and show plain text only, in order to reduce security risk to your users until you're able to upgrade to a supported version of WebKit.