Not identical, but the backtraces look very similar.

*** This bug has been marked as a duplicate of 67404 ***

Thiago: if you resolve as duplicates, please leave the one with a test case open!

*** Bug 67404 has been marked as a duplicate of this bug. ***

I ran through the process under valgrind and couldn't find a problem:
http://bugs.gentoo.org/show_bug.cgi?id=33072

this can mean two things:
1. it's fixed in CVS
2. you did something differently without beeing aware of it

Please either update to KDE CVS or run your build through valgrind too
(I hope the gentoo bugzilla maintainers do not mind :)

In both cases I made use of the Javascript search on the page - did you try that?

I submitted another bug, running konqueror under valgrind, and got the same crash. Then output ends with this:

khtml (render): RenderWidget::detach( 0x4c559540 )
khtml (jscript): Window::clear 0x49378bc0
kparts: 0x4c51a734 emitting activePartChanged (nil)
kparts: KPart::slotWidgetDestroyed(), deleting part somebugs
kparts: Part::~Part 0x4ab6e064
==19292==
==19292== Invalid read of size 4
==19292==    at 0x40FC7535: QObject::inherits(char const*) const (qobject.cpp:581)
==19292==    by 0x49DD3EF4: KHTMLPartBrowserExtension::updateEditActions() (khtml_ext.cpp:273)
==19292==    Address 0x0 is not stack'd, malloc'd or free'd
==19292== Warning: client attempted to close Valgrind's logfile fd (2).
==19292==    Use --logfile-fd=<number> to select an alternative logfile fd.
KCrash: crashing... crashRecursionCounter = 2
KCrash: Application Name = konqueror path = <unknown> pid = 19292

I have another bug to report in case there's anything else I can do to get more information out of this :)

I still can't make sense of that. The updateEditActions function checks
the value it accesses, so I can't think of a reason why it should be 0
later ;(

On second thought: do you use gentoo packages for qt or compile from source?
gentoo adds quite some patches to the package and there is 
http://bugs.kde.org/show_bug.cgi?id=61412 - which triggers a Qt bug from
the exact same function as above.

I'm using Gentoo's qt-3.2.2-r1.

I get this crash too via the gentoo packages.  Gentoo's Qt is built using some of the patches available in qt-copy - do you know which one causes this?

*** Bug 68537 has been marked as a duplicate of this bug. ***

*** Bug 69386 has been marked as a duplicate of this bug. ***

*** Bug 69600 has been marked as a duplicate of this bug. ***

*** Bug 70276 has been marked as a duplicate of this bug. ***

Can't reproduce anymore using qt-3.2.3 and kde 3.2_beta2 packages.

*** Bug 70710 has been marked as a duplicate of this bug. ***

I just had the crash again, using Qt 3.2.3 and KDE 3.2 beta 2 from Gentoo packages:

Using host libthread_db library "/lib/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 4640)]
0x4124b7e8 in waitpid () from /lib/libpthread.so.0
#0  0x4124b7e8 in waitpid () from /lib/libpthread.so.0
#1  0x4086a8ac in __JCR_LIST__ () from /usr/kde/3.2/lib/libkdecore.so.4
#2  0x407aefab in KCrash::defaultCrashHandler(int) (sig=11) at kcrash.cpp:246
#3  0x4124a4d3 in __pthread_sighandler () from /lib/libpthread.so.0
#4  <signal handler called>
#5  0x40c37c81 in QObject::inherits(char const*) const (this=0x0, 
    clname=0x421f4b8a "QLineEdit") at kernel/qobject.cpp:581
#6  0x42063fb5 in KHTMLPartBrowserExtension::updateEditActions() (
    this=0x8e6a418) at khtml_ext.cpp:274
#7  0x42063a35 in KHTMLPartBrowserExtension::setExtensionProxy(KParts::BrowserExtension*) (this=0x8e6a418, proxy=0x0) at khtml_ext.cpp:174
#8  0x42050142 in KHTMLPart::slotActiveFrameChanged(KParts::Part*) (
    this=0x8e6a418, part=0x8890988) at khtml_part.cpp:5800
#9  0x42052027 in KHTMLPart::qt_invoke(int, QUObject*) (this=0x86abd90, 
    _id=-1073750524, _o=0x0) at khtml_part.moc:504
#10 0x40c3ab72 in QObject::activate_signal(QConnectionList*, QUObject*) (
    this=0x859e238, clist=0x8ce0330, o=0xbfffddf0) at kernel/qobject.cpp:2333
#11 0x40048b60 in KParts::PartManager::activePartChanged(KParts::Part*) (
    this=0x859e238, t0=0x0) at partmanager.moc:156
#12 0x4004821a in KParts::PartManager::setActivePart(KParts::Part*, QWidget*) (
    this=0x859e238, part=0x0, widget=0x0) at partmanager.cpp:443
#13 0x40047dd9 in KParts::PartManager::removePart(KParts::Part*) (
    this=0x859e238, part=0x8b38030) at partmanager.cpp:347
#14 0x4203abf1 in KHTMLPart::clear() (this=0x86abd90) at khtml_part.cpp:1207
#15 0x4203ca04 in KHTMLPart::begin(KURL const&, int, int) (this=0x86abd90, 
    url=@0x8890a48, xOffset=0, yOffset=0) at khtml_part.cpp:1605
#16 0x4203b463 in KHTMLPart::slotData(KIO::Job*, QMemArray<char> const&) (
    this=0x86abd90, kio_job=0x8affe38, data=@0xbfffe700) at khtml_part.cpp:1325
#17 0x42051d64 in KHTMLPart::qt_invoke(int, QUObject*) (this=0x86abd90, 
    _id=-1073748224, _o=0xbfffe39c) at khtml_part.moc:469
#18 0x40c3ab72 in QObject::activate_signal(QConnectionList*, QUObject*) (
    this=0x8affe38, clist=0x8933e00, o=0xbfffe370) at kernel/qobject.cpp:2333
#19 0x401d70f2 in KIO::TransferJob::data(KIO::Job*, QMemArray<char> const&) (
    this=0x8affe38, t0=0x0, t1=@0x0) at jobclasses.moc:722
#20 0x401c7b37 in KIO::TransferJob::slotData(QMemArray<char> const&) (
    this=0x8affe38, _data=@0x0) at job.cpp:790
#21 0x401d76b4 in KIO::TransferJob::qt_invoke(int, QUObject*) (this=0x8affe38, 
    _id=-1073748828, _o=0x8affe38) at jobclasses.moc:801
#22 0x40c3ab72 in QObject::activate_signal(QConnectionList*, QUObject*) (
    this=0x87df1a8, clist=0x87aa3f8, o=0xbfffe490) at kernel/qobject.cpp:2333
#23 0x401b746d in KIO::SlaveInterface::data(QMemArray<char> const&) (
    this=0x87df1a8, t0=@0x0) at slaveinterface.moc:194
#24 0x401b5e95 in KIO::SlaveInterface::dispatch(int, QMemArray<char> const&) (
    this=0x87df1a8, _cmd=100, rawdata=@0xbfffe700) at slaveinterface.cpp:246
#25 0x401b5bff in KIO::SlaveInterface::dispatch() (this=0x87df1a8)
    at slaveinterface.cpp:191
#26 0x401b3b15 in KIO::Slave::gotInput() (this=0x87df1a8) at slave.cpp:294
#27 0x401b51f8 in KIO::Slave::qt_invoke(int, QUObject*) (this=0x87df1a8, 
    _id=4, _o=0xbfffe860) at slave.moc:113
#28 0x40c3ab72 in QObject::activate_signal(QConnectionList*, QUObject*) (
    this=0x8e50bf0, clist=0x8d7d910, o=0xbfffe860) at kernel/qobject.cpp:2333
#29 0x40c3af2c in QObject::activate_signal(int, int) (this=0x8e50bf0, 
    signal=2, param=30) at kernel/qobject.cpp:2426
#30 0x41003d1d in QSocketNotifier::activated(int) (this=0x8e50bf0, t0=30)
    at .moc/debug-shared-mt/moc_qsocketnotifier.cpp:85
#31 0x40c5f48d in QSocketNotifier::event(QEvent*) (this=0x8e50bf0, 
    e=0xbfffeb40) at kernel/qsocketnotifier.cpp:271
#32 0x40bca877 in QApplication::internalNotify(QObject*, QEvent*) (
    this=0xbfffefb0, receiver=0x8e50bf0, e=0xbfffeb40)
    at kernel/qapplication.cpp:2582
#33 0x40bc9aba in QApplication::notify(QObject*, QEvent*) (this=0xbfffefb0, 
    receiver=0x8e50bf0, e=0xbfffeb40) at kernel/qapplication.cpp:2305
#34 0x407279de in KApplication::notify(QObject*, QEvent*) (this=0xbfffefb0, 
    receiver=0x8e50bf0, event=0xbfffefb0) at kapplication.cpp:509
#35 0x4004a0d6 in QApplication::sendEvent(QObject*, QEvent*) (receiver=0x0, 
    event=0x421f4b8a) at qapplication.h:492
#36 0x40bb5de7 in QEventLoop::activateSocketNotifiers() (this=0x80d45c8)
    at kernel/qeventloop_unix.cpp:579
#37 0x40b67785 in QEventLoop::processEvents(unsigned) (this=0x80d45c8, flags=4)
    at kernel/qeventloop_x11.cpp:340
#38 0x40be3d8d in QEventLoop::enterLoop() (this=0x80d45c8)
    at kernel/qeventloop.cpp:198
#39 0x40be3ca6 in QEventLoop::exec() (this=0x80d45c8)
    at kernel/qeventloop.cpp:145
#40 0x40bcaa19 in QApplication::exec() (this=0xbfffefb0)
    at kernel/qapplication.cpp:2705
#41 0x41c1a2c3 in kdemain (argc=0, argv=0x0) at konq_main.cc:177
#42 0x408ae916 in kdeinitmain (argc=0, argv=0x0) at konqueror_dummy.cc:2
#43 0x0804e232 in launch (argc=3, _name=0x806370c "konqueror", 
    args=0x8063468 "\f7\006\b", cwd=0x0, envc=0, envs=0x806375b "", 
    reset_env=false, tty=0x0, avoid_loops=false, startup_id_str=0x0)
    at kinit.cpp:604
#44 0x080506f6 in handle_launcher_request (sock=8) at kinit.cpp:1167
#45 0x0804f430 in handle_requests (waitForPid=0) at kinit.cpp:1360
#46 0x0804d5b5 in main (argc=3, argv=0xbffff684, envp=0x0) at kinit.cpp:1797

*** Bug 71055 has been marked as a duplicate of this bug. ***

I found the following invalid read while browsing around on www.email.cz: 
==11334== Invalid read of size 4 
==11334==    at 0x493E666E: KHTMLPart::updateActions() (khtml_part.cpp:3870) 
==11334==    by 0x493F36D0: KHTMLPart::slotActiveFrameChanged(KParts::Part*) 
(khtml_part.cpp:6440) 
==11334==    by 0x493F5D97: KHTMLPart::qt_invoke(int, QUObject*) 
(qucom_p.h:312) 
==11334==    by 0x41105E4E: QObject::activate_signal(QConnectionList*, 
QUObject*) (qobject.cpp:2357) 
==11334==    by 0x403D8F48: 
KParts::PartManager::activePartChanged(KParts::Part*) (partmanager.moc:156) 
==11334==    by 0x403D82F4: KParts::PartManager::setActivePart(KParts::Part*, 
QWidget*) (partmanager.cpp:48 
==11334==    by 0x403D7E1A: KParts::PartManager::removePart(KParts::Part*) 
(partmanager.cpp:388) 
==11334==    by 0x493D8444: KHTMLPart::clear() (khtml_part.cpp:1353) 
==11334==    by 0x493DB073: KHTMLPart::begin(KURL const&, int, int) 
(khtml_part.cpp:1764) 
==11334==    by 0x493DA608: KHTMLPart::htmlError(int, QString const&, KURL 
const&) (khtml_part.cpp:1618) 
==11334==    by 0x493D3C19: KHTMLPart::openURL(KURL const&) 
(khtml_part.cpp:562) 
==11334==    by 0x493E8A6C: KHTMLPart::processObjectRequest(khtml::ChildFrame*, 
KURL const&, QString const& 
==11334==    by 0x493FE25B: KHTMLRun::foundMimeType(QString const&) 
(khtml_run.cpp:47) 
==11334==    by 0x403EAC31: KParts::BrowserRun::redirectToError(int, QString 
const&) (browserrun.cpp:477) 
==11334==    by 0x403EA8BD: KParts::BrowserRun::handleError(KIO::Job*) 
(jobclasses.h:95) 
==11334==    by 0x493FE3DF: KHTMLRun::handleError(KIO::Job*) (khtml_run.cpp:79) 
==11334==    by 0x403E7DFF: 
KParts::BrowserRun::slotBrowserScanFinished(KIO::Job*) (browserrun.cpp:172) 
==11334==    by 0x403EAF76: KParts::BrowserRun::qt_invoke(int, QUObject*) 
(qucom_p.h:312) 
==11334==    by 0x493FE512: KHTMLRun::qt_invoke(int, QUObject*) 
(khtml_run.moc:77) 
==11334==    by 0x41105E4E: QObject::activate_signal(QConnectionList*, 
QUObject*) (qobject.cpp:2357) 
==11334==    by 0x405CB4F5: KIO::Job::result(KIO::Job*) (jobclasses.moc:156) 
==11334==    by 0x405B38E1: KIO::Job::emitResult() (job.cpp:217) 
==11334==    by 0x405B5250: KIO::SimpleJob::slotFinished() (job.cpp:536) 
==11334==    by 0x405B86E0: KIO::TransferJob::slotFinished() (job.cpp:896) 
==11334==    by 0x405B552C: KIO::SimpleJob::slotError(int, QString const&) 
(job.cpp:547) 
==11334==    Address 0x4DCA92D8 is 172 bytes inside a block of size 184 free'd 
==11334==    at 0x4002A0B3: __builtin_delete (vg_replace_malloc.c:244) 
==11334==    by 0x4002A0D1: operator delete(void*) (vg_replace_malloc.c:253) 
==11334==    by 0x493FC2C3: khtml::ChildFrame::~ChildFrame() 
(qguardedptr.h:125) 
==11334==    by 0x493D83CD: KHTMLPart::clear() (khtml_part.cpp:1356) 
==11334==    by 0x493DB073: KHTMLPart::begin(KURL const&, int, int) 
(khtml_part.cpp:1764) 
==11334==    by 0x493DA608: KHTMLPart::htmlError(int, QString const&, KURL 
const&) (khtml_part.cpp:1618) 
==11334==    by 0x493D3C19: KHTMLPart::openURL(KURL const&) 
(khtml_part.cpp:562) 
==11334==    by 0x493E8A6C: KHTMLPart::processObjectRequest(khtml::ChildFrame*, 
KURL const&, QString const& 
==11334==    by 0x493FE25B: KHTMLRun::foundMimeType(QString const&) 
(khtml_run.cpp:47) 
==11334==    by 0x403EAC31: KParts::BrowserRun::redirectToError(int, QString 
const&) (browserrun.cpp:477) 
==11334==    by 0x403EA8BD: KParts::BrowserRun::handleError(KIO::Job*) 
(jobclasses.h:95) 
==11334==    by 0x493FE3DF: KHTMLRun::handleError(KIO::Job*) (khtml_run.cpp:79) 
==11334==    by 0x403E7DFF: 
KParts::BrowserRun::slotBrowserScanFinished(KIO::Job*) (browserrun.cpp:172) 
==11334==    by 0x403EAF76: KParts::BrowserRun::qt_invoke(int, QUObject*) 
(qucom_p.h:312) 
==11334==    by 0x493FE512: KHTMLRun::qt_invoke(int, QUObject*) 
(khtml_run.moc:77) 
==11334==    by 0x41105E4E: QObject::activate_signal(QConnectionList*, 
QUObject*) (qobject.cpp:2357) 
==11334==    by 0x405CB4F5: KIO::Job::result(KIO::Job*) (jobclasses.moc:156) 
==11334==    by 0x405B38E1: KIO::Job::emitResult() (job.cpp:217) 
==11334==    by 0x405B5250: KIO::SimpleJob::slotFinished() (job.cpp:536) 
==11334==    by 0x405B86E0: KIO::TransferJob::slotFinished() (job.cpp:896) 
==11334==    by 0x405B552C: KIO::SimpleJob::slotError(int, QString const&) 
(job.cpp:547) 

Reopening.

*reopening*

Created attachment 8401 [details]
Suggested patch (untested)

CVS commit by waba: 

* Crash fix. The information in d->m_frames became invalid during the deletion
of the frames and before d->m_frames got cleared. Clear d->m_frames first
before deleting the frames.
* Related to the above: It makes no sense to switch to another active frame if
we are going to delete all the frames anyway.
BUG: 67624


  M +21 -8     khtml_part.cpp   1.1055


--- kdelibs/khtml/khtml_part.cpp  #1.1054:1.1055
@@ -1344,7 +1344,14 @@ void KHTMLPart::clear()
   d->m_decoder = 0;
 
+  // We don't want to change between parts if we are going to delete all of them anyway
+  disconnect( partManager(), SIGNAL( activePartChanged( KParts::Part * ) ),
+               this, SLOT( slotActiveFrameChanged( KParts::Part * ) ) );
+
+  if (d->m_frames.count())
   {
-    ConstFrameIt it = d->m_frames.begin();
-    const ConstFrameIt end = d->m_frames.end();
+    KHTMLFrameList frames = d->m_frames;
+    d->m_frames.clear();
+    ConstFrameIt it = frames.begin();
+    const ConstFrameIt end = frames.end();
     for(; it != end; ++it )
     {
@@ -1357,13 +1364,19 @@ void KHTMLPart::clear()
     }
   }
+  
+  if (d->m_objects.count())
   {
-    ConstFrameIt oi = d->m_objects.begin();
-    const ConstFrameIt oiEnd = d->m_objects.end();
+    KHTMLFrameList objects = d->m_objects;
+    d->m_objects.clear();
+    ConstFrameIt oi = objects.begin();
+    const ConstFrameIt oiEnd = objects.end();
 
     for (; oi != oiEnd; ++oi )
       delete *oi;
   }
-  d->m_frames.clear();
-  d->m_objects.clear();
+
+  // Listen to part changes again
+  connect( partManager(), SIGNAL( activePartChanged( KParts::Part * ) ),
+             this, SLOT( slotActiveFrameChanged( KParts::Part * ) ) );
 
   d->m_delayRedirect = 0;
@@ -6396,5 +6409,5 @@ void KHTMLPart::slotPartRemoved( KParts:
 void KHTMLPart::slotActiveFrameChanged( KParts::Part *part )
 {
-//    kdDebug(6050) << "KHTMLPart::slotActiveFrameChanged part=" << part << endl;
+//    kdDebug(6050) << "KHTMLPart::slotActiveFrameChanged this=" << this << "part=" << part << endl;
     if ( part == this )
     {