Description Eric Anholt 2006-02-12 01:00:13 UTC

	On my amd64 desktop for the last month or so, evolution has been
	triggering the OOM killer at startup.  It would allocate and page in as
	much of ~64GB as it could, and the backtrace while it was busy doing
	this was (trimmed):

	#0  0x000000080579c4f4 in memset () from /lib/libc.so.6
	#1  0x000000080573a7d6 in reallocf () from /lib/libc.so.6
	#2  0x000000080573bc17 in malloc () from /lib/libc.so.6
	#3  0x00000008069d6ecf in cobject_state_read (obj=0x20f2bb0, fp=0x8058d5b00)
	    at camel-object.c:457
	#4  0x00000008069d9a84 in camel_object_state_read (vo=0x20f2bb0)
	    at camel-object.c:1814
	#5  0x000000080a6439ad in camel_local_folder_construct (lf=0x20f2bb0,
	    parent_store=0x20ef470, full_name=0x8091c0369 "Inbox", flags=1,
	    ex=0x1000000030) at camel-local-folder.c:245
	#6  0x000000080a646d35 in camel_mbox_folder_new (parent_store=0x20ef470,
	    full_name=0x8091c0369 "Inbox", flags=1, ex=0x7fffffffe140)
	    at camel-mbox-folder.c:126
	#7  0x000000080a647c49 in get_folder (store=0x20ef470,
	    folder_name=0x8091c0369 "Inbox", flags=1, ex=0x7fffffffe140)
	    at camel-mbox-store.c:206
	#8  0x0000000808568985 in camel_store_get_folder (store=0x20ef470,
	    folder_name=0x8091c0369 "Inbox", flags=1, ex=0x7fffffffe140)
	    at camel-store.c:261
	#9  0x00000008091940b9 in mc_setup_local_store ()
	   from /usr/X11R6/lib/evolution/2.4/components/libevolution-mail.so
	#10 0x00000008091954e2 in mail_component_get_folder ()
	   from /usr/X11R6/lib/evolution/2.4/components/libevolution-mail.so
	#11 0x000000080919f786 in setup_send_data ()
	   from /usr/X11R6/lib/evolution/2.4/components/libevolution-mail.so
	#12 0x00000008091a0f28 in mail_receive_uri ()
	   from /usr/X11R6/lib/evolution/2.4/components/libevolution-mail.so
	#13 0x00000008091a1151 in auto_timeout ()
	   from /usr/X11R6/lib/evolution/2.4/components/libevolution-mail.so
	#14 0x00000008091a13cf in auto_online ()
	   from /usr/X11R6/lib/evolution/2.4/components/libevolution-mail.so
	li#15 0x00000008069d8edb in camel_object_trigger_event (vo=0x857f52000,
	    name=0x214fc10 "PM\035\002", event_data=0x1) at camel-object.c:1502
	q
	#16 0x0000000808564144 in camel_session_set_online (session=0x857f52000,
	    online=165) at camel-session.c:443
	#17 0x0000000809195b03 in impl_setLineStatus ()
	   from /usr/X11R6/lib/evolution/2.4/components/libevolution-mail.so
	#18 0x00000008029ed76e in ORBit_c_stub_invoke ()
	   from /usr/local/lib/libORBit-2.so.0
	#19 0x0000000800654ad8 in GNOME_Evolution_Component_setLineStatus ()
	   from /usr/X11R6/lib/evolution/2.4/libeshell.so.0
	#20 0x00000000004138b9 in e_shell_attempt_upgrade ()
	#21 0x0000000000414e50 in e_shell_construct ()
	#22 0x0000000000414edb in e_shell_new ()
	#23 0x000000000041674b in es_menu_hook_get_type ()
	#24 0x000000080524c6cd in g_main_context_dispatch ()
	   from /usr/local/lib/libglib-2.0.so.0
	#25 0x000000080524e3a1 in g_main_context_acquire ()
	   from /usr/local/lib/libglib-2.0.so.0
	#26 0x000000080524e745 in g_main_loop_run ()
	   from /usr/local/lib/libglib-2.0.so.0
	#27 0x000000080261a9ab in bonobo_main () from /usr/local/lib/libbonobo-2.so.0
	#28 0x0000000000416c67 in main ()

	Line 457 of camel-object.c is:
	if (!(argv = g_try_malloc (sizeof (*argv) + (count - CAMEL_ARGV_MAX) * sizeof (argv->argv[0]))))

	In my only sample, "count" was 1 (CAMEL_ARGV_MAX is a define of 20).
	I'm thinking there was some issue with type promotion that made it
	try to allocate a negative (i.e. huge) number of bytes, but I haven't
	justified to myself that it was.  Removing the
	"(count - CAMEL_ARGV_MAX) * sizeof (argv->argv[0])" got it to start up.