Comment # 2 on bug 1223622 from Martin Wilck

(gdb) l 120
115     autosave_composer_created_cb (GObject *source_object,
116                                   GAsyncResult *result,
117                                   gpointer user_data)
118     {
119             GTask *task;
120             EMsgComposer *composer;
121             GError *error = NULL;
122     
123             task = G_TASK (user_data);
124             composer = e_msg_composer_new_finish (result, &error);
(gdb) 
125             if (error) {
126                     g_warning ("%s: Failed to create msg composer: %s",
G_STRFUNC, error->message);
127                     g_task_return_error (task, g_steal_pointer (&error));
128             } else {
129                     CreateComposerData *ccd;
130     
131                     ccd = g_task_get_task_data (task);
132                     e_msg_composer_setup_with_message (composer,
ccd->message, TRUE, NULL, NULL, NULL, NULL);   // *** CRASH HERE ***
133                     g_object_set_data_full (
134                             G_OBJECT (composer),
(gdb) 
135                             SNAPSHOT_FILE_KEY, g_object_ref
(ccd->snapshot_file),
136                             (GDestroyNotify) delete_snapshot_file);
137                     g_task_return_pointer (task, g_object_ref_sink
(composer), g_object_unref);
138             }
139     
140             g_object_unref (task);
141     }

The problem is that user_data is a NULL pointer:

(gdb) p user_data
$4 = (gpointer) 0x0

(gdb) up
#1  0x00007f278996d21b in e_simple_async_result_complete
(result=0x564a54818670) at
/usr/src/debug/evolution-3.52.0/src/e-util/e-simple-async-result.c:404
404                     result->priv->callback (result->priv->source_object,
G_ASYNC_RESULT (result), result->priv->callback_user_data);


(gdb) p *result->priv
$9 = {
  source_object = 0x0,
  callback = 0x7f2781e66890 <autosave_composer_created_cb>,
  callback_user_data = 0x0,   // <== ** HERE
  source_tag = 0x7f2782c5d0a0 <e_msg_composer_new>,
  user_data = 0x564a534add80,
  destroy_user_data = 0x7f278f06eb20 <g_object_unref>,
  op_pointer = 0x564a54a9a010,
  destroy_op_pointer = 0x0,
  cancellable = 0x0,
  error = 0x0
}