Date: Thu, 19 Nov 2009 16:45:43 +0100
From: Adrian Perez de Castro <aperez@igalia.com>
To: notmuch@notmuchmail.org
Message-ID: <20091119164543.25e7afe5@hikari>
In-Reply-To: <935ead450911181000w2cddfe95qe9efd5bea9f9209d@mail.gmail.com>
References: <935ead450911181000w2cddfe95qe9efd5bea9f9209d@mail.gmail.com>
Organization: Igalia
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAAXNSR0IArs4c6QAAADBQTFRFBwcHFhYWKCgoNzc3SEhIV1dXaGhod3d3iIiIlpaWqKiouLi4x8fH2NjY5+fn/v7+rSjDkgAAAjVJREFUOE9l07tvE0EQwOHfrkV9O+eko7g701BBfECJsIigT2IpooIqaSiRUEB0REj00FBQgYSCkhry+gecUPJybJeIxLumTbilsH2PMNXufDOa3ZVW+1JkpbUmD/8+vXR3c7or4Gz93mH309Kz8/C9/RQge7VfhW/LW+PF8IkrQ7Z6OKmQr1tl+LU/yWP9mxJka9O88fZHPwf/7u0kLyCnX3I4fQhgjAgIfi+HHw5A1Y2ggIMcFKAEnRoL0M3BosI4TI2IATjuT8DvSNJoNNJgkIhxlr9TUHeSpDnfohlIrMBlU+BGmsZqfr69FMfGMw4NoG835+J62riWyjQ/uXlTQjNUIoYegMsBM0pCD8oDas7n4HQsBghXFxJTW42KDs+4XLfjsN0wOYgABqARjMKIHIaAQnmHjsI5Cvi9Cf6k03OoWBkpIP3Q7354+dEimFBKHbMP9oKjwfd9gbrxR5KDToczK4uPF8UgNomKU2GaENRi77zyDKICxKBS4xXYbONPMQMdYZTBwMiMWiUg9g6UJ3OBogzjV8E7sBVwyvfAOYdQhsABzuOxI1MGZbs98Q6Md5UOfbbR2R0eWOesrnRw5ajT6f60LrNhWIHZpBnUWv2s14ukArWWTqTes3YQxRXgFkcMu70TPYqqUBs0YwmO967OVIdTG4bY4a7WLaqgLm5vbHdH5np0Dri//fmg7y8scB4u3+zsuNlH0X+g19bby69b+TYH6isvns8VdQWgxj9tHP8AR5/hSdYqkwsAAAAASUVORK5CYII=
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=PGP-SHA1;
	boundary="Sig_/K8jLgvOapC4j66Shw8d14a6";
	protocol="application/pgp-signature"
Subject: Re: [notmuch] Segfault searching for tags
Precedence: list

--Sig_/K8jLgvOapC4j66Shw8d14a6
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

On Wed, 18 Nov 2009 12:00:10 -0600, Jeffrey wrote:

> Getting the following segfault with 306635c2 on Fedora 12.  Seems to
> be happening with any 'tag:' search that returns results.  For
> example, 'notmuch search tag:inbox' and 'notmuch search tag:unread'
> segfault but 'notmuch search tag:nosuchtag', 'notmuch search
> subject:logwatch' and 'notmuch search video' seem to work fine.
>=20
> Core was generated by `/usr/bin/notmuch search --sort=3Doldest-first tag:=
inbox'.
> Program terminated with signal 11, Segmentation fault.
> \#0  Xapian::TermIterator::operator* (this=3D<value optimized out>)
>     at api/omtermlistiterator.cc:78
> 78	    RETURN(internal->get_termname());
> Current language:  auto
> The current source language is "auto; currently c++".

I have hit what I believe is exactly the same problem. In my case, some
results are printed when I execute "notmuch search tag:inbox", and then
the program crashes in the same exact place.

The thing is that in notmuch_message_get_in_reply_to(), line 288, a NULL
instance of Xapian::TermIterator is dereferenced. In my particular case,
the culpript is a cache file of Claws-Mail, as seen in the following GDB
session:

Program received signal SIGSEGV, Segmentation fault.
Xapian::TermIterator::operator* (this=3D<value optimized out>) at api/omter=
mlistiterator.cc:78
78   RETURN(internal->get_termname()); Current language:  auto
The current source language is "auto; currently c++".
(gdb) bt
#0  Xapian::TermIterator::operator* (this=3D<value optimized out>) at api/o=
mtermlistiterator.cc:78
#1  0x000000000040f611 in _notmuch_message_get_in_reply_to(message=3D0x76dc=
d0) at lib/message.cc:288
#2  0x0000000000412030 in _resolve_thread_relationships (thread=3D0x6a8b80)=
 at lib/thread.cc:157
#3  0x0000000000412454 in _notmuch_thread_create (ctx=3D0x65f1b0, notmuch=
=3D0x62d320, thread_id=3D 0x765530 "01b17ddb4479a0dc0b416bb63b92c43d", quer=
y_string=3D0x65f220 "tag:inbox") at lib/thread.cc:285
#4  0x0000000000411982 in notmuch_query_search_threads (query=3D0x65f1b0, f=
irst=3D100, max_threads=3D-1) at lib/query.cc:218
#5  0x000000000040924d in do_search_threads (ctx=3D0x61f140, query=3D0x65f1=
b0, sort=3DNOTMUCH_SORT_NEWEST_FIRST, first=3D100, max_threads=3D-1) at not=
much-search.c:40
#6  0x00000000004097ef in notmuch_search_command (ctx=3D0x61f140, argc=3D1,=
 argv=3D0x7fffffffe188) at notmuch-search.c:164
#7  0x00000000004066f1 in main (argc=3D3, argv=3D0x7fffffffe178) at notmuch=
.c:400
(gdb) frame 1
#1  0x000000000040f611 in _notmuch_message_get_in_reply_to (message=3D0x76d=
cd0) at lib/message.cc:288
288	    in_reply_to =3D *i;
(gdb) p *message
$1 =3D {notmuch =3D 0x62d320, doc_id =3D 1, frozen =3D 0, message_id =3D 0x=
76db60 "", thread_id =3D 0x0,=20
  in_reply_to =3D 0x0, filename =3D 0x76dc50 "/home/aperez/.mail/inbox/.cla=
ws_cache", message_file =3D 0x0,=20
  replies =3D 0x76d250, doc =3D {internal =3D {dest =3D 0x76d450}}}

As you can see, there "filename" points to a Claws-Mail cache file, which
is a binary file (I can provide a copy if needed). I suspect that this is
related to the fact that the iterator ends up being NULL somehow.

I will experiment a bit more with this issue -- maybe just avoiding adding
files whose name starts with a dot will suffice as temporary fix.

Cheers,

--=20
Adrian Perez de Castro <aperez@igalia.com>
Igalia - Free Software Engineering

--Sig_/K8jLgvOapC4j66Shw8d14a6
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.13 (GNU/Linux)

iEYEARECAAYFAksFaCsACgkQkcVZ2+TJEjuf/ACcDkUJCZFAPp20YPLGP+R/g0n2
k8IAn0qbqWnBm+33Wq4kOP4tGE5jixlm
=Pn2T
-----END PGP SIGNATURE-----

--Sig_/K8jLgvOapC4j66Shw8d14a6--