Bug 157115

I can reproduce this crash with the following backrace:

Application: Konqueror (konqueror), signal SIGABRT
Using host libthread_db library "/lib/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 0xb63cfa10 (LWP 8881)]
[KCrash handler]
#6  0xffffe410 in __kernel_vsyscall ()
#7  0xb65fb1f1 in *__GI_raise (sig=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#8  0xb65fc9b8 in *__GI_abort () at abort.c:88
#9  0xb6637b78 in malloc_printerr (action=2, 
    str=0xb66e3ee4 "free(): invalid pointer", ptr=0x22b1) at malloc.c:5892
#10 0xb66397e5 in *__GI___libc_free (mem=0x866ad50) at malloc.c:3586
#11 0xb67e8011 in operator delete ()
   from /usr/lib/gcc/i686-pc-linux-gnu/4.1.2/libstdc++.so.6
#12 0xb67e806d in operator delete[] ()
   from /usr/lib/gcc/i686-pc-linux-gnu/4.1.2/libstdc++.so.6
#13 0xb4ac6107 in ~PNGLoader (this=0x83019e8)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/khtml/imload/decoders/pngloader.cpp:229
#14 0xb4ac0bf5 in khtmlImLoad::Image::processEOF (this=0x86fc1c8)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/khtml/imload/image.cpp:208
#15 0xb49e7f44 in khtml::CachedImage::data (this=0x86fb050, 
    _buffer=@0x861b284, eof=true)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/khtml/misc/loader.cpp:861
#16 0xb49e7419 in khtml::Loader::slotFinished (this=0x82afd98, job=0x86c6f38)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/khtml/misc/loader.cpp:1299
#17 0xb49e7701 in khtml::Loader::qt_metacall (this=0x82afd98, 
    _c=QMetaObject::InvokeMetaMethod, _id=3, _a=0xbffae5cc)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs_build/khtml/loader.moc:126
#18 0xb72ed1f4 in QMetaObject::activate (sender=0x86c6f38, 
    from_signal_index=7, to_signal_index=7, argv=<value optimized out>)
    at kernel/qobject.cpp:3081
#19 0xb72edd94 in QMetaObject::activate (sender=0x86c6f38, m=0xb7bf13a8, 
    local_signal_index=3, argv=0xbffae5cc) at kernel/qobject.cpp:3140
#20 0xb7aeef54 in KJob::result (this=0x86c6f38, _t1=0x86c6f38)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs_build/kdecore/kjob.moc:185
#21 0xb7aef492 in KJob::emitResult (this=0x86c6f38)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/kdecore/jobs/kjob.cpp:290
#22 0xb7ca8098 in KIO::SimpleJob::slotFinished (this=0x86c6f38)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/kio/kio/job.cpp:491
#23 0xb7ca844a in KIO::TransferJob::slotFinished (this=0x86c6f38)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/kio/kio/job.cpp:961
#24 0xb7caefe3 in KIO::TransferJob::qt_metacall (this=0x86c6f38, 
    _c=QMetaObject::InvokeMetaMethod, _id=47, _a=0xbffaec54)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs_build/kio/jobclasses.moc:335
#25 0xb72ed1f4 in QMetaObject::activate (sender=0x83d79d8, 
    from_signal_index=8, to_signal_index=8, argv=<value optimized out>)
    at kernel/qobject.cpp:3081
#26 0xb72edd94 in QMetaObject::activate (sender=0x83d79d8, m=0xb7e19024, 
    local_signal_index=4, argv=0x0) at kernel/qobject.cpp:3140
#27 0xb7d502c6 in KIO::SlaveInterface::finished (this=0x83d79d8)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs_build/kio/slaveinterface.moc:160
#28 0xb7d51e8a in KIO::SlaveInterface::dispatch (this=0x83d79d8, _cmd=104, 
    rawdata=@0xbffaee34)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/kio/kio/slaveinterface.cpp:176
#29 0xb7d52ae6 in KIO::SlaveInterface::dispatch (this=0x83d79d8)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/kio/kio/slaveinterface.cpp:90
#30 0xb7d45157 in KIO::Slave::gotInput (this=0x83d79d8)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/kio/kio/slave.cpp:319
#31 0xb7d466ad in KIO::Slave::qt_metacall (this=0x83d79d8, 
    _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0xbffaf354)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs_build/kio/slave.moc:74
#32 0xb72ed1f4 in QMetaObject::activate (sender=0x82c7bd8, 
    from_signal_index=4, to_signal_index=4, argv=<value optimized out>)
    at kernel/qobject.cpp:3081
#33 0xb72edd94 in QMetaObject::activate (sender=0x82c7bd8, m=0xb7e15f20, 
    local_signal_index=0, argv=0x0) at kernel/qobject.cpp:3140
#34 0xb7c80903 in KIO::Connection::readyRead (this=0x82c7bd8)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs_build/kio/connection.moc:83
#35 0xb7c81786 in KIO::ConnectionPrivate::dequeue (this=0x83d7f08)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/kio/kio/connection.cpp:82
#36 0xb7c82535 in KIO::Connection::qt_metacall (this=0x82c7bd8, 
    _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x8746c48)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs_build/kio/connection.moc:71
#37 0xb72e82f9 in QMetaCallEvent::placeMetaCall (this=0x8697c58, 
    object=0x82c7bd8) at kernel/qobject.cpp:536
#38 0xb72eb017 in QObject::event (this=0x82c7bd8, e=0x22b1)
    at kernel/qobject.cpp:1122
#39 0xb697ae8a in QApplicationPrivate::notify_helper (this=0x8058898, 
    receiver=0x82c7bd8, e=0x8697c58) at kernel/qapplication.cpp:3556
#40 0xb697c77a in QApplication::notify (this=0xbffafd68, receiver=0x82c7bd8, 
    e=0x8697c58) at kernel/qapplication.cpp:3115
#41 0xb78b9c03 in KApplication::notify (this=0xbffafd68, receiver=0x82c7bd8, 
    event=0x8697c58)
    at /var/tmp/portage/kde-base/kdelibs-9999.4/work/kdelibs-9999.4/kdeui/kernel/kapplication.cpp:311
#42 0xb72d9d7b in QCoreApplication::notifyInternal (this=0xbffafd68, 
    receiver=0x82c7bd8, event=0x8697c58) at kernel/qcoreapplication.cpp:530
#43 0xb72db21a in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, 
    event_type=0, data=0x804ce50) at kernel/qcoreapplication.h:200
#44 0xb7303905 in QEventDispatcherUNIX::processEvents (this=0x8058780, 
    flags=@0xbffafa48) at kernel/qeventdispatcher_unix.cpp:858
#45 0xb6a04cce in QEventDispatcherX11::processEvents (this=0x8058780, 
    flags=@0xbffafa74) at kernel/qeventdispatcher_x11.cpp:145
#46 0xb72d9191 in QEventLoop::processEvents (this=0xbffafae0, 
    flags=@0xbffafaa8) at kernel/qeventloop.cpp:140
#47 0xb72d929a in QEventLoop::exec (this=0xbffafae0, flags=@0xbffafae8)
    at kernel/qeventloop.cpp:186
#48 0xb72db626 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:759
#49 0xb697a487 in QApplication::exec () at kernel/qapplication.cpp:3053
#50 0xb7f5e657 in kdemain (argc=2, argv=0xbffb00e4)
    at /var/tmp/portage/kde-base/kdebase-9999.4/work/kdebase-9999.4/apps/konqueror/src/konqmain.cpp:218
#51 0x080487e2 in main (argc=)
    at /var/tmp/portage/kde-base/kdebase-9999.4/work/kdebase_build/apps/konqueror/src/konqueror_dummy.cpp:3
#52 0xb65e7fdc in __libc_start_main (main=0x80487c0 <main>, argc=2, 
    ubp_av=0xbffb00e4, init=0x8048810 <__libc_csu_init>, 
    fini=0x8048800 <__libc_csu_fini>, rtld_fini=0xb7f83100 <_dl_fini>, 
    stack_end=0xbffb00dc) at libc-start.c:229
#53 0x08048731 in _start ()
#0  0xffffe410 in __kernel_vsyscall ()

*** This bug has been marked as a duplicate of 156623 ***