Bug 186502

Summary: Crash when selecting message with encapsulated message with online IMAP [QTreeWidget*, KMMimePartTreeItem, partNode::fillMimePartTree, KMail::ObjectTreeParser::insertAndParseNewChildNode]
Product: [Unmaintained] kmail Reporter: Nicolas L. <kde>
Component: generalAssignee: kdepim bugs <kdepim-bugs>
Status: RESOLVED UNMAINTAINED    
Severity: crash CC: akp10, alessio.checcucci, alex.merry, andresbajotierra, anton.komolov, art.alexion, bill, cfarrell1980, chanika, cordlandwehr, daniel.finistauri, dominik, dwash59_2000, endymion+kde, gayleard, h.becker, info, jlewis2, kavol, kaysimon, kde-bugs, kde, lav, macoafi, marcello, mark, martin.nowack, martin, mschiff, MurzNN, nigel.cundy, pavel.krc, philotech, root, schwarzer, sknauss, tassilo, thomas.bigot, thomas.jarosch, tibirna, vadim, w.richert, zenith.federico
Priority: NOR    
Version: unspecified   
Target Milestone: ---   
Platform: Mandriva RPMs   
OS: Unspecified   
Latest Commit: Version Fixed In:
Sentry Crash Report:
Bug Depends on: 153411    
Bug Blocks:    
Attachments: This mail keeps crashing kmail
New crash information added by DrKonqi
New crash information added by DrKonqi
New crash information added by DrKonqi
New crash information added by DrKonqi
Fix crash on display of multipart message

Description Nicolas L. 2009-03-08 00:45:32 UTC
Version:            (using KDE 4.2.1)
Installed from:    Mandriva RPMs

I can't start kmail or kontact with kmail: it crashes at startup.
I have to delete ~/.kde4/share/apps/kmail/imap to be able to start it again
without crash. It works for some days, and one day, it crashes again.


Thread 1 (Thread 0x7fbe54818700 (LWP 14659)):
[KCrash Handler]
#5  0x00007fbe52b4f590 in QTreeWidgetItem::addChild (this=0x1e9a590, child=0x1f81e60) at itemviews/qtreewidget.cpp:1871
#6  0x00007fbe52b4f9b3 in QTreeWidgetItem (this=0x1f81e60, parent=0x1e9a590, type=<value optimized out>) at itemviews/qtreewidget.cpp:1419
#7  0x00007fbe3d7a8662 in KMMimePartTreeItem (this=0x1e9a590, parent=0x1f81e60, node=0x1f85390, description=@0x1, mimetype=@0xbad7d0, encoding=@0x7fff5c866210, size=0, revertOrder=false)
    at /usr/src/debug/kdepim-4.2.0/kmail/kmmimeparttree.cpp:378
#8  0x00007fbe3d7d4b69 in partNode::fillMimePartTree (this=0x1f85390, parentItem=0x1e9a590, mimePartTree=0x0, labelDescr=<value optimized out>, labelCntType=@0x7fff5c8663b0, 
    labelEncoding=@0x7fff5c8663a0, size=0, revertOrder=true) at /usr/src/debug/kdepim-4.2.0/kmail/partNode.cpp:496
#9  0x00007fbe3d7c73c0 in KMail::ObjectTreeParser::insertAndParseNewChildNode (this=0x7fff5c8667f0, startNode=@0x1a82bb0, content=<value optimized out>, cntDesc=<value optimized out>, append=true)
    at /usr/src/debug/kdepim-4.2.0/kmail/objecttreeparser.cpp:217
#10 0x00007fbe3d7c90ff in KMail::ObjectTreeParser::processMessageRfc822Subtype (this=0x7fff5c8667f0, node=0x1a82bb0) at /usr/src/debug/kdepim-4.2.0/kmail/objecttreeparser.cpp:1345
#11 0x00007fbe3d7c6ba2 in KMail::ObjectTreeParser::parseObjectTree (this=0x7fff5c8667f0, node=0x1a82bb0) at /usr/src/debug/kdepim-4.2.0/kmail/objecttreeparser.cpp:282
#12 0x00007fbe3d7c6c5a in KMail::ObjectTreeParser::stdChildHandling (this=0x7fff5c866b20, child=0x1972af0) at /usr/src/debug/kdepim-4.2.0/kmail/objecttreeparser.cpp:1084
#13 0x00007fbe3d7c6f4e in KMail::ObjectTreeParser::processMultiPartMixedSubtype (this=0x7fff5c866b20, node=<value optimized out>) at /usr/src/debug/kdepim-4.2.0/kmail/objecttreeparser.cpp:1097
#14 0x00007fbe3d7c6ba2 in KMail::ObjectTreeParser::parseObjectTree (this=0x7fff5c866b20, node=0x17a9ca0) at /usr/src/debug/kdepim-4.2.0/kmail/objecttreeparser.cpp:282
#15 0x00007fbe3d6afb0d in KMReaderWin::parseMsg (this=0x11c1290, aMsg=0x1e8c7c0) at /usr/src/debug/kdepim-4.2.0/kmail/kmreaderwin.cpp:1622
#16 0x00007fbe3d6a7526 in KMReaderWin::displayMessage (this=0x11c1290) at /usr/src/debug/kdepim-4.2.0/kmail/kmreaderwin.cpp:1555
#17 0x00007fbe3d6a7689 in KMReaderWin::updateReaderWin (this=0x11c1290) at /usr/src/debug/kdepim-4.2.0/kmail/kmreaderwin.cpp:1495
#18 0x00007fbe3d6a93b1 in KMReaderWin::update (this=0x1e9a590, observable=0x1f81e60) at /usr/src/debug/kdepim-4.2.0/kmail/kmreaderwin.cpp:919
#19 0x00007fbe3d843870 in KMail::ISubject::notify (this=0x1e8c7e8) at /usr/src/debug/kdepim-4.2.0/kmail/isubject.cpp:29
#20 0x00007fbe3d5ecff3 in KMMessage::updateBodyPart (this=0x1e8c7c0, partSpecifier=
      {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 25181}, alloc = 0, size = 0, data = 0x60649a, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 661}, alloc = 0, size = 0, data = 0x7fbe5346743a, clean = 1, simpletext = 1, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0x7fff5c8673a0, static codecForCStrings = 0x0}, data=<value optimized out>) at /usr/src/debug/kdepim-4.2.0/kmail/kmmessage.cpp:4126
#21 0x00007fbe3d8276dc in KMail::ImapJob::slotGetMessageResult (this=0x1b537c0, job=<value optimized out>) at /usr/src/debug/kdepim-4.2.0/kmail/imapjob.cpp:435
#22 0x00007fbe3d827fbf in KMail::ImapJob::qt_metacall (this=0x1b537c0, _c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x7fff5c867540)
    at /usr/src/debug/kdepim-4.2.0/build/kmail/imapjob.moc:82
#23 0x00007fbe53186822 in QMetaObject::activate (sender=0x1aacd00, from_signal_index=<value optimized out>, to_signal_index=7, argv=0x1) at kernel/qobject.cpp:3055
#24 0x00007fbe5354bfe2 in KJob::result (this=0x1e9a590, _t1=0x1aacd00) at /usr/src/debug/kdelibs-4.2.0/build/kdecore/kjob.moc:188
#25 0x00007fbe5354c3e3 in KJob::emitResult (this=0x1aacd00) at /usr/src/debug/kdelibs-4.2.0/kdecore/jobs/kjob.cpp:294
#26 0x00007fbe5094e51e in KIO::SimpleJob::slotFinished (this=0x1aacd00) at /usr/src/debug/kdelibs-4.2.0/kio/kio/job.cpp:489
#27 0x00007fbe5094e8a8 in KIO::TransferJob::slotFinished (this=0x1aacd00) at /usr/src/debug/kdelibs-4.2.0/kio/kio/job.cpp:957
#28 0x00007fbe50954a2d in KIO::TransferJob::qt_metacall (this=0x1aacd00, _c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x7fff5c867910)
    at /usr/src/debug/kdelibs-4.2.0/build/kio/jobclasses.moc:343
#29 0x00007fbe53186822 in QMetaObject::activate (sender=0x1829280, from_signal_index=<value optimized out>, to_signal_index=8, argv=0x1) at kernel/qobject.cpp:3055
#30 0x00007fbe509e2c23 in KIO::SlaveInterface::dispatch (this=0x1829280, _cmd=104, rawdata=<value optimized out>) at /usr/src/debug/kdelibs-4.2.0/kio/kio/slaveinterface.cpp:175
#31 0x00007fbe509e3508 in KIO::SlaveInterface::dispatch (this=0x1829280) at /usr/src/debug/kdelibs-4.2.0/kio/kio/slaveinterface.cpp:91
#32 0x00007fbe509d754a in KIO::Slave::gotInput (this=0x1829280) at /usr/src/debug/kdelibs-4.2.0/kio/kio/slave.cpp:322
#33 0x00007fbe509d8640 in KIO::Slave::qt_metacall (this=0x1829280, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x7fff5c867cb0) at /usr/src/debug/kdelibs-4.2.0/build/kio/slave.moc:76
#34 0x00007fbe53186822 in QMetaObject::activate (sender=0xc7ddb0, from_signal_index=<value optimized out>, to_signal_index=4, argv=0x1) at kernel/qobject.cpp:3055
#35 0x00007fbe50927f3b in KIO::ConnectionPrivate::dequeue (this=0x17f6500) at /usr/src/debug/kdelibs-4.2.0/kio/kio/connection.cpp:82
#36 0x00007fbe50928ce2 in KIO::Connection::qt_metacall (this=0xc7ddb0, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x1b0c460) at /usr/src/debug/kdelibs-4.2.0/build/kio/connection.moc:73
#37 0x00007fbe53180e78 in QObject::event (this=0xc7ddb0, e=0x1e95830) at kernel/qobject.cpp:1104
#38 0x00007fbe525dd05d in QApplicationPrivate::notify_helper (this=0x7e7230, receiver=0xc7ddb0, e=0x1e95830) at kernel/qapplication.cpp:4051
#39 0x00007fbe525e523a in QApplication::notify (this=0x7fff5c8686d0, receiver=0xc7ddb0, e=0x1e95830) at kernel/qapplication.cpp:4016
#40 0x00007fbe53aa415e in KApplication::notify (this=0x7fff5c8686d0, receiver=0xc7ddb0, event=0x1e95830) at /usr/src/debug/kdelibs-4.2.0/kdeui/kernel/kapplication.cpp:307
#41 0x00007fbe53170dac in QCoreApplication::notifyInternal (this=0x7fff5c8686d0, receiver=0xc7ddb0, event=0x1e95830) at kernel/qcoreapplication.cpp:597
#42 0x00007fbe53171a1a in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x7ad280) at kernel/qcoreapplication.h:208
#43 0x00007fbe5319a7a3 in postEventSourceDispatch (s=<value optimized out>) at kernel/qcoreapplication.h:213
#44 0x00007fbe4c04ae31 in IA__g_main_context_dispatch (context=0x7cc870) at gmain.c:1814
#45 0x00007fbe4c04e4e0 in g_main_context_iterate (context=0x7cc870, block=1, dispatch=1, self=<value optimized out>) at gmain.c:2448
#46 0x00007fbe4c04e67c in IA__g_main_context_iteration (context=0x7cc870, may_block=1) at gmain.c:2511
#47 0x00007fbe5319a42f in QEventDispatcherGlib::processEvents (this=0x7bb390, flags=<value optimized out>) at kernel/qeventdispatcher_glib.cpp:318
#48 0x00007fbe5267418f in QGuiEventDispatcherGlib::processEvents (this=0x1e9a590, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:197
#49 0x00007fbe5316f652 in QEventLoop::processEvents (this=<value optimized out>, flags={i = 1552320000}) at kernel/qeventloop.cpp:144
#50 0x00007fbe5316fa1d in QEventLoop::exec (this=0x7fff5c868640, flags={i = 1552320080}) at kernel/qeventloop.cpp:195
#51 0x00007fbe53171ce4 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:875
#52 0x000000000040397a in main (argc=1, argv=0x7fff5c868be8) at /usr/src/debug/kdepim-4.2.0/kontact/src/main.cpp:218
Comment 1 Christophe Marin 2009-07-04 15:55:14 UTC
*** Bug 197513 has been marked as a duplicate of this bug. ***
Comment 2 Christophe Marin 2009-08-23 18:19:01 UTC
*** Bug 191913 has been marked as a duplicate of this bug. ***
Comment 3 William Haller 2009-09-03 18:09:25 UTC
I don't know if I am experiencing the same exact bug or not, but my description and solution has been similar.

Make sure all threads are stopped. Remove the apps/kmail folder in its entirety. Edit the config/kmailrc file to remove all references to folders and favorite folders. Restart. Wait for crash. Restart. Wait for crash. Repeat over and over until I get lucky enough to get kmail to start. The upgrade to QT 4.5.2-3-f11.x86_64 from fedora today seems to have made it even harder to actually get it running.

If I try to click on an inbox before all the tree views have filled in with + by the top folder name, it is likely to crash as well instead of opening the inbox. I have several deeply nested folders on the IMAP server. I have to wait for it to update all folder trees for the server I'm trying to check the inbox on to reliably get it to work.

Once it has attached to all the dovecot servers I don't have any further troubles with it. It's just the startup that is absolutely frustrating. This is a longstanding problem since going to the 4.x branch of KDE. It isn't something that just cropped up recently. Currently seen on 1.12.0/KDE 4.3.00 from fedora since the above release was a bit older. If I'm extremely lucky, I might get two starts in a row, but that only happens once a month. Thankfully I don't have to log out very often and can just leave it running.
Comment 4 Christophe Marin 2009-10-01 18:52:33 UTC
*** Bug 209117 has been marked as a duplicate of this bug. ***
Comment 5 Dario Andres 2010-01-02 23:02:54 UTC
From bug 220960:
-- Information about the crash:
I use KMail as a stand-alone application.

What I did was:
I removed a mail from an IMAP mailbox (gmail).
The mail was already gone from the message list view and the next mail was
selected (an approval mail from KDE's mailing list daemon). The new mail was
then marked as "read" and its content about to be shown in the message view.
Before the mail content was shown, KMail crashed.

 -- Backtrace:
#6  QAbstractItemView::d_func (this=0x7) at itemviews/qabstractitemview.h:353
#7  QAbstractItemView::model (this=0x7) at itemviews/qabstractitemview.cpp:669
#8  0xb585cf5c in QTreeWidgetItem::executePendingSort (this=0x9f34718) at
itemviews/qtreewidget.cpp:2189
#9  0xb6c8eda5 in QTreeWidgetItem::indexOfChild (this=0x9f39520,
parent=0x9f34718, node=0x9ff7ad0, description=..., mimetype=..., encoding=...,
size=0, revertOrder=false)
    at /usr/include/qt4/QtGui/qtreewidget.h:251
#10 KMMimePartTreeItem (this=0x9f39520, parent=0x9f34718, node=0x9ff7ad0,
description=..., mimetype=..., encoding=..., size=0, revertOrder=false)
    at /home/fs/kdesvn/kdepim/kmail/kmmimeparttree.cpp:385
#11 0xb6cd8e8a in partNode::fillMimePartTree (this=0x9ff7ad0,
parentItem=0x9f34718, mimePartTree=0x0, labelDescr=..., labelCntType=...,
labelEncoding=..., size=0, revertOrder=<value optimized out>)
    at /home/fs/kdesvn/kdepim/kmail/partNode.cpp:549
#12 0xb6cc5efd in KMail::ObjectTreeParser::insertAndParseNewChildNode
(this=0xbf8a9670, startNode=..., content=0xb5f87ea0 "", cntDesc=0xb6fc0aa2
"encapsulated message", append=<value optimized out>, 
    addToTextualContent=false) at
/home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:232
#13 0xb6cca1d9 in KMail::ObjectTreeParser::processMessageRfc822Subtype
(this=0xbf8a9670, node=0xa130768) at
/home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:1582
#14 0xb6cd348b in process (this=0xa0479b0, otp=0xbf8a9670, node=0xa130768,
result=...) at /home/fs/kdesvn/kdepim/kmail/bodypartformatter.cpp:116
#15 0xb6cc553b in KMail::ObjectTreeParser::parseObjectTree (this=0xbf8a9670,
node=0xa130768) at /home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:318
#16 0xb6cc58a7 in KMail::ObjectTreeParser::stdChildHandling (this=0xbf8a988c,
child=0x9fb1248) at /home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:1278
#17 0xb6cc5ca1 in KMail::ObjectTreeParser::processMultiPartMixedSubtype
(this=0xbf8a988c, node=0x9f396b0) at
/home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:1291
#18 0xb6cd344b in process (this=0x9dcbcc0, otp=0xbf8a988c, node=0x9f396b0,
result=...) at /home/fs/kdesvn/kdepim/kmail/bodypartformatter.cpp:118
#19 0xb6cc553b in KMail::ObjectTreeParser::parseObjectTree (this=0xbf8a988c,
node=0x9f396b0) at /home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:318
#20 0xb6b25d71 in KMReaderWin::parseMsg (this=0x923eff0, aMsg=0xa1e02e8) at
/home/fs/kdesvn/kdepim/kmail/kmreaderwin.cpp:1610
#21 0xb6b19a43 in KMReaderWin::displayMessage (this=0x923eff0) at
/home/fs/kdesvn/kdepim/kmail/kmreaderwin.cpp:1534
#22 0xb6b19c2d in KMReaderWin::updateReaderWin (this=0x923eff0) at
/home/fs/kdesvn/kdepim/kmail/kmreaderwin.cpp:1477
#23 0xb6b1a530 in KMReaderWin::update (this=0x923eff0, observable=0xa1e0358) at
/home/fs/kdesvn/kdepim/kmail/kmreaderwin.cpp:903
#24 0xb6d737c2 in KMail::ISubject::notify (this=0xa1e0358) at
/home/fs/kdesvn/kdepim/kmail/isubject.cpp:33
#25 0xb6a231a2 in KMMessage::updateBodyPart (this=0xa1e02e8, partSpecifier=...,
data=...) at /home/fs/kdesvn/kdepim/kmail/kmmessage.cpp:3185
#26 0xb6d483a0 in KMail::ImapJob::slotGetMessageResult (this=0x926e2f0,
job=0xa023e98) at /home/fs/kdesvn/kdepim/kmail/imapjob.cpp:435
#27 0xb6d4a2ef in KMail::ImapJob::qt_metacall (this=0x926e2f0,
_c=QMetaObject::InvokeMetaMethod, _id=12, _a=0xbf8a9e68) at
/home/fs/kdesvn/build/kdepim/kmail/imapjob.moc:88
...
Comment 6 Dario Andres 2010-01-02 23:03:03 UTC
*** Bug 220960 has been marked as a duplicate of this bug. ***
Comment 7 Dario Andres 2010-01-15 01:13:03 UTC
From bug 222724:
-- Information about the crash:
Kmail often crashes slightly after startup when I select an imap folder.
Restarting the application sometimes helps but often leads to a crash again.

From bug 222666:
-- Information about the crash:
When click on a mail in the mail-list, which is HTML-formatted, Kontact crashes
every time. Kontact crashes not at every HTML-Mail, only a special one.
The crash can be reproduced every time.

From bug 222388 (contains a lot of output and info):
-- Information about the crash:
I have open kmail, go to IMAP folder Drafts, select for view first unread
message from drafts (Created from another computer) and kmail crashes
momentally.
I try this operation four times and see the crash every time.
Comment 8 Dario Andres 2010-01-15 01:13:14 UTC
*** Bug 222724 has been marked as a duplicate of this bug. ***
Comment 9 Dario Andres 2010-01-15 01:13:17 UTC
*** Bug 222666 has been marked as a duplicate of this bug. ***
Comment 10 Dario Andres 2010-01-15 01:13:18 UTC
*** Bug 222388 has been marked as a duplicate of this bug. ***
Comment 11 Dario Andres 2010-01-28 23:02:43 UTC
Bug 224414 got more information too...
Comment 12 Dario Andres 2010-02-04 02:53:52 UTC
*** Bug 225365 has been marked as a duplicate of this bug. ***
Comment 13 Cristian Tibirna 2010-02-19 19:00:01 UTC
Hmmm... this report is already one year old. I didn't encounter it up until my last upgrade to KDE 4.4. I use the openSUSE factory RPMs. I believe this is a high priority bug (and not a normal one) because it makes kmail unusable with messages containing MIME attachments and because of its old old age. It is obvious to me that the crash in a QTreeWidgetItem call has to be because of a lost reference or badly initialized data structure, and it occurs to me only in the call to addChild(). A pity that I don't have a debug compilation at hand...
Comment 14 Thomas McGuire 2010-02-28 19:30:01 UTC
*** Bug 227642 has been marked as a duplicate of this bug. ***
Comment 15 Thomas McGuire 2010-02-28 19:30:07 UTC
*** Bug 223765 has been marked as a duplicate of this bug. ***
Comment 16 Thomas McGuire 2010-02-28 19:30:15 UTC
*** Bug 228836 has been marked as a duplicate of this bug. ***
Comment 17 Thomas McGuire 2010-02-28 19:30:21 UTC
*** Bug 226977 has been marked as a duplicate of this bug. ***
Comment 18 Thomas McGuire 2010-02-28 19:30:32 UTC
*** Bug 227207 has been marked as a duplicate of this bug. ***
Comment 19 Thomas McGuire 2010-02-28 19:37:27 UTC
*** Bug 224414 has been marked as a duplicate of this bug. ***
Comment 20 Thomas McGuire 2010-03-04 15:13:04 UTC
*** Bug 229154 has been marked as a duplicate of this bug. ***
Comment 21 Martin Fernau 2010-03-05 09:47:27 UTC
I have a mail which always crash my kamil if I try to view this mail.
I will add this mail to this bug so that you maybe can reproduce this.

It's important to note that this mail need to be viewed via IMAP (I use the courier imap server). 
If you open the file via open->file from kmail, nothing will crash.
Comment 22 Martin Fernau 2010-03-05 09:48:46 UTC
Created attachment 41345 [details]
This mail keeps crashing kmail
Comment 23 Thomas Jarosch 2010-03-05 10:23:59 UTC
Thanks for the mail, Martin. I was able to reproduce it using a Cyrus IMAP server. So this will help the developers track it down.

Running kmail via valgrind and clicking on the message shows invalid memory access.

Hopefully this is not exploitable...
Comment 24 Thomas McGuire 2010-03-05 11:49:59 UTC
*** Bug 228353 has been marked as a duplicate of this bug. ***
Comment 25 Thomas McGuire 2010-03-05 11:50:16 UTC
*** Bug 229219 has been marked as a duplicate of this bug. ***
Comment 26 Thomas McGuire 2010-03-05 11:50:27 UTC
*** Bug 229514 has been marked as a duplicate of this bug. ***
Comment 27 Thomas McGuire 2010-03-05 11:50:38 UTC
*** Bug 226456 has been marked as a duplicate of this bug. ***
Comment 28 Thomas McGuire 2010-03-05 11:50:50 UTC
*** Bug 227496 has been marked as a duplicate of this bug. ***
Comment 29 Thomas McGuire 2010-03-05 11:51:01 UTC
*** Bug 228198 has been marked as a duplicate of this bug. ***
Comment 30 Thomas McGuire 2010-03-05 11:51:08 UTC
*** Bug 228816 has been marked as a duplicate of this bug. ***
Comment 31 Thomas McGuire 2010-03-05 11:51:16 UTC
*** Bug 229445 has been marked as a duplicate of this bug. ***
Comment 32 Thomas McGuire 2010-03-05 11:51:26 UTC
*** Bug 222216 has been marked as a duplicate of this bug. ***
Comment 33 Thomas McGuire 2010-03-05 11:51:38 UTC
*** Bug 227367 has been marked as a duplicate of this bug. ***
Comment 34 Thomas McGuire 2010-03-05 11:51:45 UTC
*** Bug 228171 has been marked as a duplicate of this bug. ***
Comment 35 Thomas McGuire 2010-03-05 11:51:58 UTC
*** Bug 228764 has been marked as a duplicate of this bug. ***
Comment 36 Thomas McGuire 2010-03-05 11:52:07 UTC
*** Bug 229419 has been marked as a duplicate of this bug. ***
Comment 37 Thomas McGuire 2010-03-05 11:52:25 UTC
*** Bug 226921 has been marked as a duplicate of this bug. ***
Comment 38 Thomas McGuire 2010-03-05 11:52:37 UTC
*** Bug 228074 has been marked as a duplicate of this bug. ***
Comment 39 Thomas McGuire 2010-03-05 12:45:45 UTC
Ok, I'm able to reproduce this, Thanks for the test messages.

- Only happens with Fancy header style
- Only happens with encapsulated messages
- Only happens with Online IMAP (and probably only when attachment loading on demand is enabled)
- Only happens when the ContactSearchJob takes a long time (I artificially introduced a delay there so I could reproduce)
Comment 40 Thomas Jarosch 2010-03-05 13:25:34 UTC
This is good news, Thomas!

It crashes for me with the following settings:
- Normal header style, only the date header is set to "fancy"
- IMAP with full email download (no attachments on demand)
- I don't use any contacts/addressbook (I use kmail instead of kontact),
  at least I didn't touch that stuff in a long time.

The mail that crashes for me is also an encapsulate message.
kmail 4.3.5 doesn't crash on the same message, kmail 4.4.0 instantly dies.

Hope that helps a bit.
Comment 41 Tassilo Horn 2010-03-05 15:50:00 UTC
(In reply to comment #39)
> Ok, I'm able to reproduce this, Thanks for the test messages.

One thing I want to add: It seems to happen only with message previews. If I disable the preview pane, I can select those offending messages in a separate window without any problem.
Comment 42 Christian Esken 2010-03-05 21:44:20 UTC
Adding my setup:

It crashes for me with the following settings:
- Normal header style, only the date header is set to "fancy"
- IMAP with loading attachments on demand
- I don't use any contacts/addressbook (I use kmail instead of kontact),
  at least I didn't touch that stuff in a long time.

When I disable  "load attachemnts on demand", KMail does not crash for me.
Comment 43 Henning Becker 2010-03-06 00:24:28 UTC
(In reply to comment #42)
> Adding my setup:
> 
> It crashes for me with the following settings:
> - Normal header style, only the date header is set to "fancy"
> - IMAP with loading attachments on demand
> - I don't use any contacts/addressbook (I use kmail instead of kontact),
>   at least I didn't touch that stuff in a long time.
> 
> When I disable  "load attachemnts on demand", KMail does not crash for me.

Same here. Disabling the "load attachments on demand" function solves the issue for now.
Comment 44 Ritesh Raj Sarraf 2010-03-09 05:23:40 UTC
Created attachment 41467 [details]
New crash information added by DrKonqi

I started seeing this crash only with KDE 4.4.1. This repeatedly happens on certain email messages.
Comment 45 kavol 2010-03-09 12:38:33 UTC
Created attachment 41472 [details]
New crash information added by DrKonqi

don't know if it is the kmail version or something special about the e-mail causing this, but I've only started seeing this today
Comment 46 Geert Janssens 2010-03-11 10:20:33 UTC
Created attachment 41528 [details]
New crash information added by DrKonqi

The crash happens when I try click on a message that has another message attached.

The circumstances to reproduce are as reported by others:
- Fancy Theme
- Preview pane enabled

And the workaround works fine here as well:
- Disable "Load attachments on demand"
Comment 47 Thomas McGuire 2010-03-11 10:45:13 UTC
SVN commit 1099282 by tmcguire:

Disable photo display, the exec() in the ContactSearchJob is causing too many problems.

In this case, the body parts that were loaded on demand arrived during the exec(), and
modified the MIME tree, which was unexpected by the current parseOTP() run.

BUG: 186502
Comment 48 Thomas McGuire 2010-03-11 10:58:16 UTC
This bug seems to be triggered by two things.

One of the triggers was the contact photo display, that bug was introduced in 4.4.0, and it is where most/all of the recent duplicates come from. Contact photo display is now disabled in KDE SC 4.4.2, therefore working around the problem.

The original problem probably still is there, but at least the recent regression, which was the cause for most/all recent duplicates, is fixed.
Comment 49 Björn Ruberg 2010-03-14 21:30:05 UTC
*** Bug 230083 has been marked as a duplicate of this bug. ***
Comment 50 Björn Ruberg 2010-03-14 21:30:20 UTC
*** Bug 230341 has been marked as a duplicate of this bug. ***
Comment 51 Björn Ruberg 2010-03-14 21:30:34 UTC
*** Bug 230419 has been marked as a duplicate of this bug. ***
Comment 52 Björn Ruberg 2010-03-14 21:30:50 UTC
*** Bug 230446 has been marked as a duplicate of this bug. ***
Comment 53 Björn Ruberg 2010-03-14 22:37:58 UTC
*** Bug 229947 has been marked as a duplicate of this bug. ***
Comment 54 Dario Andres 2010-03-16 12:57:01 UTC
*** Bug 230813 has been marked as a duplicate of this bug. ***
Comment 55 Alex Merry 2010-03-18 14:27:22 UTC
Created attachment 41734 [details]
New crash information added by DrKonqi

Just got this today when opening an email.  kdemod 4.4.1 packages in Archlinux
Comment 56 Björn Ruberg 2010-03-21 12:14:38 UTC
*** Bug 231488 has been marked as a duplicate of this bug. ***
Comment 57 Jonathan Thomas 2010-03-25 18:07:31 UTC
*** Bug 232087 has been marked as a duplicate of this bug. ***
Comment 58 Christophe Marin 2010-03-27 00:10:23 UTC
*** Bug 228820 has been marked as a duplicate of this bug. ***
Comment 59 Thomas Jarosch 2010-04-02 12:43:54 UTC
I gave it another valgrind run and this turned out to be an IMAP server response speed race condition. It's easily triggerable if you run kmail via valgrind as it gets reaaaallly slooooooow.

Here's the command:
valgrind --trace-children=yes --log-file=kmail.crash --free-fill=0 kmail

Backtrace of the bug:
==5906== Invalid read of size 8
==5906==    at 0x9CF9BF9: QTreeWidgetItem::addChild(QTreeWidgetItem*) (in /usr/lib64/libQtGui.so.4.6.2)
==5906==    by 0x9CFA002: QTreeWidgetItem::QTreeWidgetItem(QTreeWidgetItem*, int) (in /usr/lib64/libQtGui.so.4.6.2)
==5906==    by 0x5E36DA8: KMMimePartTreeItem::KMMimePartTreeItem(KMMimePartTreeItem*, partNode*, QString const&, QString const&, QString const&, unsigned long long, bool) (kmmimeparttree.cpp:378)
==5906==    by 0x5E7B362: partNode::fillMimePartTree(KMMimePartTreeItem*, KMMimePartTree*, QString const&, QString const&, QString const&, unsigned long long, bool) (partNode.cpp:549)
==5906==    by 0x5E69D0B: KMail::ObjectTreeParser::insertAndParseNewChildNode(partNode&, char const*, char const*, bool, bool) (objecttreeparser.cpp:232)
==5906==    by 0x5E6DAFF: KMail::ObjectTreeParser::processMessageRfc822Subtype(partNode*, KMail::ProcessResult&) (objecttreeparser.cpp:1582)
==5906==    by 0x5E69438: KMail::ObjectTreeParser::parseObjectTree(partNode*) (objecttreeparser.cpp:318)
==5906==    by 0x5E69754: KMail::ObjectTreeParser::stdChildHandling(partNode*) (objecttreeparser.cpp:1278)
==5906==    by 0x5E69B03: KMail::ObjectTreeParser::processMultiPartMixedSubtype(partNode*, KMail::ProcessResult&) (objecttreeparser.cpp:1291)
==5906==    by 0x5E69438: KMail::ObjectTreeParser::parseObjectTree(partNode*) (objecttreeparser.cpp:318)
==5906==    by 0x5CECF3F: KMReaderWin::parseMsg(KMMessage*) (kmreaderwin.cpp:1612)
==5906==    by 0x5CE326F: KMReaderWin::displayMessage() (kmreaderwin.cpp:1536)

==5906==  Address 0x1f2d39c0 is 48 bytes inside a block of size 80 free'd
==5906==    at 0x4C23E3F: operator delete(void*) (vg_replace_malloc.c:342)
==5906==    by 0x9CFD678: QTreeWidgetItem::~QTreeWidgetItem() (in /usr/lib64/libQtGui.so.4.6.2)
==5906==    by 0x5E38772: KMMimePartTreeItem::~KMMimePartTreeItem() (kmmimeparttree.h:105)
==5906==    by 0x9CF4BB5: (within /usr/lib64/libQtGui.so.4.6.2)
==5906==    by 0x5E34795: KMMimePartTree::clearAndResetSortOrder() (kmmimeparttree.cpp:103)
==5906==    by 0x5CE3190: KMReaderWin::displayMessage() (kmreaderwin.cpp:1518)
==5906==    by 0x5CE343F: KMReaderWin::updateReaderWin() (kmreaderwin.cpp:1479)
==5906==    by 0x5CE3D14: KMReaderWin::update(KMail::Interface::Observable*) (kmreaderwin.cpp:904)
==5906==    by 0x5F08210: KMail::ISubject::notify() (isubject.cpp:33)
==5906==    by 0x5C08BCB: KMMessage::updateBodyPart(QString, QByteArray const&) (kmmessage.cpp:3185)
==5906==    by 0x5EDFF58: KMail::ImapJob::slotGetMessageResult(KJob*) (imapjob.cpp:435)
==5906==    by 0x5EE1ADA: KMail::ImapJob::qt_metacall(QMetaObject::Call, int, void**) (imapjob.moc:88)

If you look close, displayMessage() is currently running while a callback enters displayMessage() again. The first thing displayMessage() does is a clearAndResetSortOrder() which frees the memory the first displayMessage() call is currently working on -> Boom.

Attached is a proof-of-concept workaround patch.
Comment 60 Thomas Jarosch 2010-04-02 12:48:58 UTC
Created attachment 42440 [details]
Fix crash on display of multipart message

This is a proof-of-concept patch. The kWarning() calls should be removed before and if it's included. Also the new lock may have potential side-effects like "message display not updated", though I have seen none yet.

Unfortunately we can't use Qt's blockSignals() in displayMessage() as signals are lost instead of queued. Ideas?
Comment 61 Björn Ruberg 2010-04-05 23:28:04 UTC
*** Bug 233123 has been marked as a duplicate of this bug. ***
Comment 62 Christophe Marin 2010-06-07 19:22:06 UTC
*** Bug 228284 has been marked as a duplicate of this bug. ***
Comment 63 Christophe Marin 2010-06-07 19:22:17 UTC
*** Bug 235176 has been marked as a duplicate of this bug. ***
Comment 64 Christophe Marin 2011-04-24 14:52:18 UTC
*** Bug 267661 has been marked as a duplicate of this bug. ***
Comment 65 Christian Esken 2011-04-25 20:59:51 UTC
I cannot reproduce it anymore since months, even when loading Attachments on demand. Removing my CC.
Comment 66 Myriam Schweingruber 2012-08-19 11:03:22 UTC
Thank you for your report. Kmail1 is currently unmaintained and the code has changed sufficiently in Kmail2 so the backtraces are not really useful anymore. Should you experience the same crash in Kmail 4.8.5 or later, please open a new report for Kmail2. Thank you for your understanding