at-spi-registryd crashed with SIGSEGV in _SmcProcessMessage()

StacktraceTop:?? ()
IceProcessMessages (iceConn=0x0, replyWait=0x0,
process_ice_messages (channel=0x8f62f70, condition=G_IO_IN,
g_io_unix_dispatch (source=0x8f62fb8,
IA__g_main_context_dispatch (context=0x8f3b738)

This happened twice tonight when loging out. After restarting my computer it seems I can not reproduce it. At least not on the two new tries I did.
Bug #423947

Updated bug #423947 with description and backtrace after todays crash as there are new versions involved.
Dare I set this one as duplicate of that?

josa created a nice gdb log in his bug report (which is now a dupe of this one):
http://launchpadlibrarian.net/31983751/gdb_at-spi-registryd%20sep%2017%202009.log

I was able to repro this two times using these steps (can anyone else confirm?):

1. check the checkbox "System::Preferences::Assistive technologies::Enable Assistive Technologies".
2. wait 10-20 second and then logout using the top-right ubuntu shutdown menu
3. SEGV happens _during_ log out

Here is a better gdb trace (with symbols) so we can see the exact line where the crash happens;
it's src/sm_process.c:324.

The offending code is:

    case SM_SaveComplete:

        if (!smcConn->save_yourself_in_progress)
        {
            _IceErrorBadState (iceConn, _SmcOpcode,
                SM_SaveComplete, IceCanContinue);
        }
        else
        {
            CHECK_SIZE_MATCH (iceConn, _SmcOpcode, opcode,
                length, SIZEOF (smSaveCompleteMsg),
                IceFatalToProtocol);

            smcConn->save_yourself_in_progress = False;

            (*smcConn->callbacks.save_complete.callback) (smcConn,
                smcConn->callbacks.save_complete.client_data);
        }
        break;

And the crash happens when the function pointer is called (last statement).

I reported upstream as well now:
https://bugzilla.gnome.org/show_bug.cgi?id=596115

i can confirm this bug .. 9.10 beta i386

Got a crash report on startup after doing a safe-upgrade last night.

Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 437315, so it is being marked as such. Please look at the other bug report to see if there is any missing information that you can provide, or to see if there is a workaround for the bug. Additionally, any further discussion regarding the bug should occur in the other report. Please continue to report any other bugs you may find.

I apologize for the noise here. Bug 437315 should be a duplicate of this one since this bug has an upstream bug task.