Bug 289693

Created attachment 67103 [details]
New crash information added by DrKonqi

kmail (4.8 rc1) on KDE Platform 4.7.95 (4.8 RC1 (4.7.95) "release 9" using Qt 4.8.0

- What I was doing when the application crashed:

Closed kmail from tray. There where some imap mail deletations pending.

-- Backtrace (Reduced):
#10 0x00007fde0ad99ded in qDeleteAll<QList<Node*>::const_iterator> (end=<optimized out>, begin=<optimized out>) at /usr/include/QtCore/qalgorithms.h:322
#11 qDeleteAll<QList<Node*> > (c=...) at /usr/include/QtCore/qalgorithms.h:330
#12 Akonadi::EntityTreeModel::~EntityTreeModel (this=0x1337a10, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:79
#13 0x00007fde0ad99e79 in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x1337a10, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:83
#14 0x00007fde0fdabe05 in QObjectPrivate::deleteChildren (this=0x12b4760) at kernel/qobject.cpp:1917

Created attachment 67140 [details]
New crash information added by DrKonqi

kmail (4.8 rc1) on KDE Platform 4.7.95 (4.8 RC1 (4.7.95) "release 3" using Qt 4.8.0

- What I was doing when the application crashed:
Quitting KMail 2 from SC 4.8rc1 as stand-alone application.
So far the crash didn't happen again with Kontact.

-- Backtrace (Reduced):
#12 0xb53b7326 in qDeleteAll<QList<Node*>::const_iterator> (end=<optimized out>, begin=<optimized out>) at /usr/include/QtCore/qalgorithms.h:322
#13 qDeleteAll<QList<Node*> > (c=...) at /usr/include/QtCore/qalgorithms.h:330
#14 Akonadi::EntityTreeModel::~EntityTreeModel (this=0x81ee8c0, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:79
#15 0xb53b73e2 in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x81ee8c0, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:83
#16 0xb6d3b731 in QObjectPrivate::deleteChildren (this=0x82c3820) at kernel/qobject.cpp:1917

I confirm this problem. I also noted that if I just launch kmail2 as standalone application and then just exit, it does not crash, while if I do something (move a message, read a message, delete a message, basically everything) it crash on exit

Created attachment 67171 [details]
New crash information added by DrKonqi

kmail (4.8 rc1) on KDE Platform 4.7.95 (4.8 RC1 (4.7.95) using Qt 4.7.4

Hi ! (sorry for my bad english !)

same problem under kubuntu 11.10 and KDE SC 4.8 rc1

-- Backtrace (Reduced):
#15 0x0384a106 in qDeleteAll<QList<Node*>::const_iterator> (end=<optimized out>, begin=<optimized out>) at /usr/include/qt4/QtCore/qalgorithms.h:322
#16 qDeleteAll<QList<Node*> > (c=...) at /usr/include/qt4/QtCore/qalgorithms.h:330
#17 Akonadi::EntityTreeModel::~EntityTreeModel (this=0x8384fc8, __in_chrg=<optimized out>) at ../../akonadi/entitytreemodel.cpp:79
#18 0x0384a1c2 in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x8384fc8, __in_chrg=<optimized out>) at ../../akonadi/entitytreemodel.cpp:83
#19 0x060ad841 in QObjectPrivate::deleteChildren (this=0x840de60) at kernel/qobject.cpp:1955

Created attachment 67192 [details]
New crash information added by DrKonqi

kmail (4.8 rc1) on KDE Platform 4.7.95 (4.8 RC1 (4.7.95) "release 3" using Qt 4.8.0

- What I was doing when the application crashed:

I just quit from KMail 2 (Qt 4.8) and it crashed.

-- Backtrace (Reduced):
#10 0x00007fd5ae76fded in qDeleteAll<QList<Node*>::const_iterator> (end=<optimized out>, begin=<optimized out>) at /usr/include/QtCore/qalgorithms.h:322
#11 qDeleteAll<QList<Node*> > (c=...) at /usr/include/QtCore/qalgorithms.h:330
#12 Akonadi::EntityTreeModel::~EntityTreeModel (this=0x9edc70, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:79
#13 0x00007fd5ae76fe79 in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x9edc70, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:83
#14 0x00007fd5b377e9e5 in QObjectPrivate::deleteChildren (this=0x9b5170) at kernel/qobject.cpp:1908

Created attachment 67218 [details]
New crash information added by DrKonqi

kmail (4.8 rc1) on KDE Platform 4.7.95 (4.8 RC1 (4.7.95) "release 3" using Qt 4.8.0

- What I was doing when the application crashed:

I closed kmail and it crashed. Before that I noticed that clicking on emails in my imap account did not show the content of the selected (unread) email in the preview pane but some previously read email.

-- Backtrace (Reduced):
#12 0xb54b0326 in qDeleteAll<QList<Node*>::const_iterator> (end=<optimized out>, begin=<optimized out>) at /usr/include/QtCore/qalgorithms.h:322
#13 qDeleteAll<QList<Node*> > (c=...) at /usr/include/QtCore/qalgorithms.h:330
#14 Akonadi::EntityTreeModel::~EntityTreeModel (this=0x822a9c8, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:79
#15 0xb54b03e2 in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x822a9c8, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:83
#16 0xb6e35731 in QObjectPrivate::deleteChildren (this=0x82d3258) at kernel/qobject.cpp:1917

Created attachment 67224 [details]
New crash information added by DrKonqi

kmail (4.8 rc1) on KDE Platform 4.7.95 (4.8 RC1 (4.7.95) using Qt 4.8.0

- What I was doing when the application crashed:

kmail crashes on exit. this is a regression from kde 4.7

-- Backtrace (Reduced):
#14 0xb528916a in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x95626e0, __in_chrg=<optimized out>) at /home/hussam/packages/kdepimlibs/src/kdepimlibs/akonadi/entitytreemodel.cpp:80
#15 0xb5289242 in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x95626e0, __in_chrg=<optimized out>) at /home/hussam/packages/kdepimlibs/src/kdepimlibs/akonadi/entitytreemodel.cpp:86
#16 0xb61e3560 in QObjectPrivate::deleteChildren (this=0x9574da8) at kernel/qobject.cpp:1908
#17 0xb61e9cd4 in QObject::~QObject (this=0xbf807f30, __in_chrg=<optimized out>) at kernel/qobject.cpp:927
#18 0xb6f94de3 in KMKernel::~KMKernel (this=0xbf807f30, __in_chrg=<optimized out>) at /home/hussam/packages/kdepim/src/kdepim/kmail/kmkernel.cpp:226

seems fixed here by this commit 
http://quickgit.kde.org/?p=kdepimlibs.git&a=commitdiff&h=fbd983ae6ab38bc904b5f598250901f7664e8a47&hp=79e26c847dd1c20c6a859b990586058a326f02b1

Hmmm, I wrote immediately when I noticed those "fixes" replacing the qDeleteAll with a handwritten loop that this can't be the right fix, and comment #7 proves it isn't. This also affects all the other places all over KDE SC which got that "fix".

The "fix" linked from comment #8 doesn't look any better to me.

The real bug must be elsewhere, either in a place in KDE SC code which executes before the offending snippet, or in Qt. The list must be already corrupt when we reach this place or we wouldn't get these crashes!

Created attachment 67236 [details]
New crash information added

Seeing this crash also on Fedora 16 - 4.7.95 - qt-4.8.0-4.fc16.x86_64 when closing Kontact

patch from comment #8 doesn't seem to help any for me, now get:


Thread 1 (Thread 0x7f689b1ef840 (LWP 8670)):
[KCrash Handler]
#6  0x0000003b01e36285 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#7  0x0000003b01e37b9b in __GI_abort () at abort.c:91
#8  0x0000003b01e75fae in __libc_message (do_abort=2, fmt=0x3b01f74b98 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:198
#9  0x0000003b01e7c2d6 in malloc_printerr (action=3, str=0x3b01f71b69 "free(): invalid pointer", ptr=<optimized out>) at malloc.c:5021
#10 0x00007f689c7c4bbd in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x2074100, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:82
#11 0x00007f689c7c4c49 in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x2074100, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:89
#12 0x0000003f4a58b385 in QObjectPrivate::deleteChildren() () from /usr/lib64/libQtCore.so.4
#13 0x0000003f4a59165c in QObject::~QObject() () from /usr/lib64/libQtCore.so.4
#14 0x0000003f5eee041d in KMKernel::~KMKernel (this=0x7fff9a7ab1c0, __in_chrg=<optimized out>) at /usr/src/debug/kdepim-4.7.95/kmail/kmkernel.cpp:226
#15 0x0000000000402d3e in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kdepim-4.7.95/kmail/main.cpp:128

that said, that's after witnessing symptoms similar to bug #289967 , where kmail seems to get stuck sending items to the trash.

Created attachment 67238 [details]
New crash information added by DrKonqi

kmail (4.8 rc1) on KDE Platform 4.7.95 (4.8 RC1 (4.7.95) "release 10" using Qt 4.8.0

- What I was doing when the application crashed:

Rex, i got this crash even without MALLOC_CHECK set. I've rebuilt RC1 with -DCMAKE_BUILD_TYPE=Debug, don't know is the backtrace more helpfull. Also, the crash is reproduciple every time when i try to delete some messages.

-- Backtrace (Reduced):
#7  0x00007f6b11e91390 in qDeleteAll<QList<Node*>::const_iterator> (begin=..., end=...) at /usr/include/QtCore/qalgorithms.h:322
#8  0x00007f6b11e9178d in qDeleteAll<QList<Node*> > (c=...) at /usr/include/QtCore/qalgorithms.h:330
#9  0x00007f6b11e90a7a in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x82ad30, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:79
#10 0x00007f6b11e90af9 in Akonadi::EntityTreeModel::~EntityTreeModel (this=0x82ad30, __in_chrg=<optimized out>) at /usr/src/debug/kdepimlibs-4.7.95/akonadi/entitytreemodel.cpp:83
#11 0x00007f6b16ee1e05 in QObjectPrivate::deleteChildren (this=0x920340) at kernel/qobject.cpp:1917

fixed in 4.8

*** Bug 289927 has been marked as a duplicate of this bug. ***

*** Bug 289967 has been marked as a duplicate of this bug. ***

Not fixed, see comment #11.

Created attachment 67269 [details]
New crash information added by DrKonqi

kmail (4.8 rc1) on KDE Platform 4.7.95 (4.8 RC1 (4.7.95) using Qt 4.7.4

- What I was doing when the application crashed:

I was exiting Kmail and it crashed. I also had a mail in outbox that it did not send for some odd reason.

-- Backtrace (Reduced):
#6  0x00007fd71ab7b3a5 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#7  0x00007fd71ab7eb0b in __GI_abort () at abort.c:92
[...]
#9  0x00007fd71abbda96 in malloc_printerr (action=3, str=0x7fd71aca10d2 "corrupted double-linked list", ptr=<optimized out>) at malloc.c:6283
#10 0x00007fd71abbe8b3 in _int_free (av=0x7fd71aedf1c0, p=0x3266150) at malloc.c:4973
#11 0x00007fd71abc1d7c in __GI___libc_free (mem=<optimized out>) at malloc.c:3738

*** Bug 290410 has been marked as a duplicate of this bug. ***

(In reply to comment #11)
> patch from comment #8 doesn't seem to help any for me, now get:
> 
> 
Rex, please attach a valgrind log if you have the mentioned commit (which is not in rc1)

Created attachment 67361 [details]
valgrind log of startup, delete a few items, quit

*** Bug 290443 has been marked as a duplicate of this bug. ***

*** Bug 290479 has been marked as a duplicate of this bug. ***

*** Bug 290109 has been marked as a duplicate of this bug. ***

This is the relevant portion of the valgrind log:


==6000== Invalid read of size 4
==6000==    at 0x39B0CFE8DD: Akonadi::EntityTreeModel::data(QModelIndex const&, int) const (entitytreemodel.cpp:237)
==6000==    by 0x3C23033EEA: KSelectionProxyModel::data(QModelIndex const&, int) const (qabstractitemmodel.h:402)
==6000==    by 0x3C21D6A40B: QSortFilterProxyModel::data(QModelIndex const&, int) const (qsortfilterproxymodel.cpp:1718)
==6000==    by 0x39B50974DA: MessageList::StorageModel::itemForRow(int) const (storagemodel.cpp:475)
==6000==    by 0x39B509B807: MessageList::Widget::Private::itemForRow(int) const (widget.cpp:495)
==6000==    by 0x39B509B89C: MessageList::Widget::currentItem() const (widget.cpp:511)
==6000==    by 0x39B50931DB: MessageList::Pane::currentItem() const (pane.cpp:709)
==6000==    by 0x39B4B12B93: KMMainWidget::itemsReceived(QList<Akonadi::Item> const&) (kmmainwidget.cpp:4369)
==6000==    by 0x39B4B2DF5D: KMMainWidget::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (kmmainwidget.moc:481)
==6000==    by 0x3C2058CCD0: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3547)
==6000==    by 0x39B0D30561: Akonadi::ItemFetchJob::itemsReceived(QList<Akonadi::Item> const&) (itemfetchjob.moc:106)
==6000==    by 0x39B0D31623: Akonadi::ItemFetchJob::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (itemfetchjob.cpp:71)
==6000==  Address 0xbba0430 is 16 bytes inside a block of size 24 free'd
==6000==    at 0x4A062BC: operator delete(void*) (vg_replace_malloc.c:387)
==6000==    by 0x39B0D09589: Akonadi::EntityTreeModelPrivate::monitoredItemRemoved(Akonadi::Item const&) (entitytreemodel_p.cpp:1056)
==6000==    by 0x3C2058CCD0: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3547)
==6000==    by 0x39B0D467D4: Akonadi::Monitor::itemRemoved(Akonadi::Item const&) (monitor.moc:210)
==6000==    by 0x39B0D4AB3B: Akonadi::MonitorPrivate::emitItemNotification(Akonadi::NotificationMessage const&, Akonadi::Item const&, Akonadi::Collection const&, Akonadi::Collection const&) (monitor_p.cpp:535)
==6000==    by 0x39B0D4C2E1: Akonadi::MonitorPrivate::emitNotification(Akonadi::NotificationMessage const&) (monitor_p.cpp:288)
==6000==    by 0x39B0CAED60: Akonadi::ChangeRecorderPrivate::emitNotification(Akonadi::NotificationMessage const&) (changerecorder_p.h:60)
==6000==    by 0x39B0D4C44C: Akonadi::MonitorPrivate::dispatchNotifications() (monitor_p.cpp:447)
==6000==    by 0x39B0D4CAD3: Akonadi::MonitorPrivate::slotNotify(QList<Akonadi::NotificationMessage> const&) (monitor_p.cpp:418)
==6000==    by 0x39B0CAF029: Akonadi::ChangeRecorderPrivate::slotNotify(QList<Akonadi::NotificationMessage> const&) (changerecorder_p.h:51)
==6000==    by 0x3C2058CCD0: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (qobject.cpp:3547)
==6000==    by 0x39B0DCD8D1: OrgFreedesktopAkonadiNotificationSourceInterface::notify(QList<Akonadi::NotificationMessage> const&) (notificationsourceinterface.moc:105)

The deletion line is this one I think:
  delete m_childEntities[ collection.id() ].takeAt( row );
(in EntityTreeModelPrivate::monitoredItemRemoved)

And despite the beginRemoveRows/endRemoveRows, somehow this index is still used later on in EntityTreeModel::data. Some intermediate proxy not reacting to row removal correctly?

I wonder how many of those encountering this crash -- and there are many -- migrated from kmail to kmail2. I know I did.  If that's a common element, it would suggest that the migration process itself introduced some kind of baddity.

No migration here, fresh setup.

For me this crash hasn't occurred for a while after I upgraded to RC 2. But before, it was a "daily routine", 10 times a day at least.

How could I surely reproduce in RC 1:
- Go to inbox
- Move some letters to a folder
- Click on an other letter in the inbox and notice KMail cannot not load the body of that letter any more (there'll be just a white area in place of the message body). You can't move more letters to folders, either
- Ctrl + Q
- Crash instantly

After a brief amount of testing so far, I can confirm that 4.7.97 (4.8rc2) indeed fixes this issue for me as well. yay.

(I did get one 'update conflict' from akonadi, but will consider that a separate issue for now)

Is there a repository that contains the rc2 packages?  I have the beta repository on my synaptic list, but updating from there doesn't seem to pick up those packages.

ask your distro?

After updateing to RC2 i cannot reproduce the crash anymore. So i take it as resolved.

Looks fixed here as well after the rc2 update Fedora 16, thanks.

Thank you, it works fine on Gentoo with the current ebuild from the overlay to.

*** Bug 290793 has been marked as a duplicate of this bug. ***