*** Bug 122731 has been marked as a duplicate of this bug. ***

*** Bug 124498 has been marked as a duplicate of this bug. ***

In this and both duplicates it's libqt-mt.so* that shows up in backtrace. Could QT version have anything to do with this? I just recently upgraded QT 3.3.5 --> 3.3.6, and I didn't have crashes before. On the other hand, I also upgraded my kernel version 2.6.15.6 --> 2.6.16 at the same time. But I don't see anything else that's broken other than kmail crashing.

By the way, do you have one or several mailboxes and are they set on auto check? I have two set that way.

Hello,
I have QT version of 3.3.6, too. But I had version 3.3.5 when I reported this bug.
Yes, I have multiple accounts with auto-check flag (to be more precise, 4 of them including local mail).

OK. Do you know what compiler flags debian unstable uses for kdepim? I recently recompiled my whole kde bunch with prelinking and combreloc enabled, so that might be one cause in my case. But of course if debian doesn't use any fancy CFLAGS and you still experience this, that's not likely.

Here you are:
CC="cc" CXX="g++" CFLAGS="-g -Wall -O2" CXXFLAGS="-g -Wall -O2" CPPFLAGS="" KMIX=/usr/bin/kmix KTTSD=/usr/bin/kttsd /root/kdepim-3.5.1/build-tree/kdepim-3.5.1/configure  --build=i486-linux-gnu --prefix=/usr --includedir="\${prefix}/include/kde" --mandir="\${prefix}/share/man" --infodir="\${prefix}/share/info" --sysconfdir=/etc --localstatedir=/var --libexecdir="\${prefix}/lib/kdepim" --disable-maintainer-mode --disable-dependency-tracking  --with-qt-dir=/usr/share/qt3 --disable-rpath --with-xinerama --enable-final --disable-debug

Above is the exact call to configure.
And below I put sample compilation output, which I think will contain all the compilation flags (sorry, I couldn't find them in simplier form).
g++ -DHAVE_CONFIG_H -I. -I/root/kdepim-3.5.1/build-tree/kdepim-3.5.1/kabc/kabc2mutt -I../.. -I/usr/include/kde/kabc -I/root/kdepim-3.5.1/build-tree/kdepim-3.5.1/libkdepim -I/usr/include/kde -I/usr/share/qt3/include -I/usr/X11R6/include   -DQT_THREAD_SUPPORT  -D_REENTRANT -D_FILE_OFFSET_BITS=64  -Wno-long-long -Wundef -ansi -D_XOPEN_SOURCE=500 -D_BSD_SOURCE -Wcast-align -Wconversion -Wchar-subscripts -Wall -W -Wpointer-arith -DNDEBUG -DNO_DEBUG -O2 -g -Wall -O2 -Wformat-security -Wmissing-format-attribute -Wno-non-virtual-dtor -fno-exceptions -fno-check-new -fno-common -DQT_CLEAN_NAMESPACE -DQT_NO_ASCII_CAST -DQT_NO_STL -DQT_NO_COMPAT -DQT_NO_TRANSLATION  -c -o kabc2mutt.all_cpp.o `test -f 'kabc2mutt.all_cpp.cpp' || echo '/root/kdepim-3.5.1/build-tree/kdepim-3.5.1/kabc/kabc2mutt/'`kabc2mutt.all_cpp.cpp
/bin/sh ../../libtool --mode=link --tag=CXX g++  -Wno-long-long -Wundef -ansi -D_XOPEN_SOURCE=500 -D_BSD_SOURCE -Wcast-align -Wconversion -Wchar-subscripts -Wall -W -Wpointer-arith -DNDEBUG -DNO_DEBUG -O2 -g -Wall -O2 -Wformat-security -Wmissing-format-attribute -Wno-non-virtual-dtor -fno-exceptions -fno-check-new -fno-common -DQT_CLEAN_NAMESPACE -DQT_NO_ASCII_CAST -DQT_NO_STL -DQT_NO_COMPAT -DQT_NO_TRANSLATION    -o kabc2mutt -L/usr/lib -L/usr/share/qt3/lib -L/usr/X11R6/lib     kabc2mutt.all_cpp.o  -lkabc -lkdecore

By the way - can you reproduce this problem easily?

Doesn't seem like there are any extra flags there.

I don't know of any other way to reproduce this bug other than just waiting until it happens. :)

*** Bug 124220 has been marked as a duplicate of this bug. ***

The problematic code part seems to be popaccount.cpp:777 :
 
if( mMailCheckProgressItem ) { // do this only once...
  bool canceled = kmkernel->mailCheckAborted() || mMailCheckProgressItem->canceled();
  int numMessages = canceled ? indexOfCurrentMsg : idsOfMsgs.count();
  BroadcastStatus::instance()->setStatusMsgTransmissionCompleted(
    this->name(), numMessages, numBytes, numBytesRead, numBytesToRead, mLeaveOnServer, mMailCheckProgressItem );
  mMailCheckProgressItem->setComplete();
  mMailCheckProgressItem = 0;
  checkDone( ( numMessages > 0 ), canceled ? CheckAborted : CheckOK );
}

Since the check is in place, the problem seems that mMailCheckProgressItem is deleted after the if line but before the other functions are called. So it's not easy to reproduce. Does it sound like a good first try at Valgrind's Helgrind? I never used it before but I want to try it.

SVN commit 558673 by kloecker:

Fix progress item related crashes during POP3 fetches.

BUGS: 110487, 118112, 119112, 121384, 127210, 130303


 M  +4 -1      kmaccount.cpp  
 M  +30 -20    popaccount.cpp  


--- branches/KDE/3.5/kdepim/kmail/kmaccount.cpp #558672:558673
@@ -444,8 +444,11 @@
   if (mTimer)
     mTimer->start(mInterval*60000);
   if ( mMailCheckProgressItem ) {
-    mMailCheckProgressItem->setComplete(); // that will delete it
+    // set mMailCheckProgressItem = 0 before calling setComplete() to prevent
+    // a race condition
+    ProgressItem *savedMailCheckProgressItem = mMailCheckProgressItem;
     mMailCheckProgressItem = 0;
+    savedMailCheckProgressItem->setComplete(); // that will delete it
   }
 
   emit newMailsProcessed( mNewInFolder );
--- branches/KDE/3.5/kdepim/kmail/popaccount.cpp #558672:558673
@@ -348,8 +348,9 @@
 void PopAccount::slotAbortRequested()
 {
   if (stage == Idle) return;
-  disconnect( mMailCheckProgressItem, SIGNAL( progressItemCanceled( KPIM::ProgressItem* ) ),
-           this, SLOT( slotAbortRequested() ) );
+  if ( mMailCheckProgressItem )
+    disconnect( mMailCheckProgressItem, SIGNAL( progressItemCanceled( KPIM::ProgressItem* ) ),
+                this, SLOT( slotAbortRequested() ) );
   stage = Quit;
   if (job) job->kill();
   job = 0;
@@ -655,7 +656,8 @@
     processMsgsTimer.start(processingDelay);
   }
   else if (stage == Retr) {
-    mMailCheckProgressItem->setProgress( 100 );
+    if ( mMailCheckProgressItem )
+      mMailCheckProgressItem->setProgress( 100 );
     processRemainingQueuedMessages();
 
     mHeaderDeleteUids.clear();
@@ -732,20 +734,22 @@
     // If there are messages to delete then delete them
     if ( !idsOfMsgsToDelete.isEmpty() ) {
       stage = Dele;
-      mMailCheckProgressItem->setStatus(
-        i18n( "Fetched 1 message from %1. Deleting messages from server...",
-              "Fetched %n messages from %1. Deleting messages from server...",
-              numMsgs )
-        .arg( mHost ) );
+      if ( mMailCheckProgressItem )
+        mMailCheckProgressItem->setStatus(
+          i18n( "Fetched 1 message from %1. Deleting messages from server...",
+                "Fetched %n messages from %1. Deleting messages from server...",
+                numMsgs )
+          .arg( mHost ) );
       url.setPath("/remove/" + idsOfMsgsToDelete.join(","));
       kdDebug(5006) << "url: " << url.prettyURL() << endl;
     } else {
       stage = Quit;
-      mMailCheckProgressItem->setStatus(
-        i18n( "Fetched 1 message from %1. Terminating transmission...",
-              "Fetched %n messages from %1. Terminating transmission...",
-              numMsgs )
-        .arg( mHost ) );
+      if ( mMailCheckProgressItem )
+        mMailCheckProgressItem->setStatus(
+          i18n( "Fetched 1 message from %1. Terminating transmission...",
+                "Fetched %n messages from %1. Terminating transmission...",
+                numMsgs )
+          .arg( mHost ) );
       url.setPath(QString("/commit"));
       kdDebug(5006) << "url: " << url.prettyURL() << endl;
     }
@@ -760,11 +764,12 @@
       mUidsOfNextSeenMsgsDict.remove( mUidForIdMap[*it] );
     }
     idsOfMsgsToDelete.clear();
-    mMailCheckProgressItem->setStatus(
-      i18n( "Fetched 1 message from %1. Terminating transmission...",
-            "Fetched %n messages from %1. Terminating transmission...",
-            numMsgs )
-      .arg( mHost ) );
+    if ( mMailCheckProgressItem )
+      mMailCheckProgressItem->setStatus(
+        i18n( "Fetched 1 message from %1. Terminating transmission...",
+              "Fetched %n messages from %1. Terminating transmission...",
+              numMsgs )
+        .arg( mHost ) );
     KURL url = getUrl();
     url.setPath(QString("/commit"));
     job = KIO::get( url, false, false );
@@ -783,8 +788,11 @@
       int numMessages = canceled ? indexOfCurrentMsg : idsOfMsgs.count();
       BroadcastStatus::instance()->setStatusMsgTransmissionCompleted(
         this->name(), numMessages, numBytes, numBytesRead, numBytesToRead, mLeaveOnServer, mMailCheckProgressItem );
-      mMailCheckProgressItem->setComplete();
+      // set mMailCheckProgressItem = 0 before calling setComplete() to prevent
+      // a race condition
+      ProgressItem *savedMailCheckProgressItem = mMailCheckProgressItem;
       mMailCheckProgressItem = 0;
+      savedMailCheckProgressItem->setComplete(); // that will delete it
       checkDone( ( numMessages > 0 ), canceled ? CheckAborted : CheckOK );
     }
   }
@@ -873,7 +881,9 @@
       numMsgBytesRead = curMsgLen;
     numBytesRead += numMsgBytesRead - oldNumMsgBytesRead;
     dataCounter++;
-    if (dataCounter % 5 == 0)
+    if ( mMailCheckProgressItem &&
+         ( dataCounter % 5 == 0 ||
+           ( indexOfCurrentMsg + 1 == numMsgs && numMsgBytesRead == curMsgLen ) ) )
     {
       QString msg;
       if (numBytes != numBytesToRead && mLeaveOnServer)