Reproducable balsa 2.2.6 crash sorting mail

[Willem Riede <wriede riede org>]

One of my mail folders is confusing balsa. I can see all 3624 messages in it 
only if I select the non-threaded view. Ask balsa to thread (simple or JWZ) 
and it'll only show four messages in the index. So I was exploring this, to 
see if I could "shake it loose", and one thing I tried was to change the sort 
order. It is currently sorted on the sequence #. I discovered that balsa will 
crash whenever I ask it to sort this mail by date. Independent of what 
threading is selected. I figure, that whatever is wrong with the mailbox that 
makes it all of a sudden no longer want to be shown threaded, balsa should 
never crash. Here's the gdb backtrace. Since this is reproducable, I can do it 
again and poke around if you need more info.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 182894253408 (LWP 20373)]
0x000000000049338f in libbalsa_mailbox_imap_sort (mbox=0xb7e4f0, array=0x176c0f8) at mailbox_imap.c:2533
2533                g_array_index(mimap->sort_ranks, guint, msgno_arr[i] - 1) = i;
(gdb) bt
#0  0x000000000049338f in libbalsa_mailbox_imap_sort (mbox=0xb7e4f0, array=0x176c0f8) at mailbox_imap.c:2533
#1  0x000000000048e4f5 in mbox_sort_helper (mbox=0xb7e4f0, parent=0x1b95ac8) at mailbox.c:2886
#2  0x000000000048ede0 in mbox_set_sort_column_id (sortable=0xb7e4f0, sort_column_id=5,
    order=GTK_SORT_ASCENDING) at mailbox.c:2922
#3  0x00000037b4ff5f16 in gtk_tree_view_column_get_visible () from /usr/lib64/libgtk-x11-2.0.so.0
#4  0x000000390be0bfaa in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#5  0x000000390be21fbd in g_signal_has_handler_pending () from /usr/lib64/libgobject-2.0.so.0
#6  0x000000390be23056 in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
#7  0x000000390be23222 in g_signal_emit_by_name () from /usr/lib64/libgobject-2.0.so.0
#8  0x000000390be0bfaa in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#9  0x000000390be21fbd in g_signal_has_handler_pending () from /usr/lib64/libgobject-2.0.so.0
#10 0x000000390be23056 in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
#11 0x000000390be233a3 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#12 0x00000037b4e6fe48 in gtk_button_get_alignment () from /usr/lib64/libgtk-x11-2.0.so.0
#13 0x000000390be0bfaa in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#14 0x000000390be2188d in g_signal_has_handler_pending () from /usr/lib64/libgobject-2.0.so.0
#15 0x000000390be23056 in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
#16 0x000000390be233a3 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#17 0x00000037b4e6f309 in gtk_button_set_relief () from /usr/lib64/libgtk-x11-2.0.so.0
#18 0x00000037b4f1b546 in gtk_marshal_VOID__UINT_STRING () from /usr/lib64/libgtk-x11-2.0.so.0
#19 0x000000390be0bfaa in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#20 0x000000390be21af5 in g_signal_has_handler_pending () from /usr/lib64/libgobject-2.0.so.0
#21 0x000000390be22cc2 in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
#22 0x000000390be233a3 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#23 0x00000037b5006260 in gtk_widget_activate () from /usr/lib64/libgtk-x11-2.0.so.0
#24 0x00000037b4f1952e in gtk_propagate_event () from /usr/lib64/libgtk-x11-2.0.so.0
#25 0x00000037b4f198b5 in gtk_main_do_event () from /usr/lib64/libgtk-x11-2.0.so.0
#26 0x00000037b5344b50 in gdk_event_get_graphics_expose () from /usr/lib64/libgdk-x11-2.0.so.0
#27 0x000000390b62675d in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#28 0x000000390b628437 in g_main_context_acquire () from /usr/lib64/libglib-2.0.so.0
#29 0x000000390b6287d5 in g_main_loop_run () from /usr/lib64/libglib-2.0.so.0
#30 0x00000037b4f18d11 in gtk_main () from /usr/lib64/libgtk-x11-2.0.so.0
#31 0x000000000045a6d4 in main (argc=1, argv=0x7fbffff7e8) at main.c:689
(gdb)

This is on an Athlon64 running FC3 x86_64. Mail served by Dovecot IMAP.

Regards, Willem Riede.