Bug 301793

Application: kontact (4.8.3)
KDE Platform Version: 4.8.3 (4.8.3)
Qt Version: 4.8.2
Operating System: Linux 3.4.0-1.fc17.x86_64 x86_64
Distribution: "Fedora release 17 (Beefy Miracle)"

-- Information about the crash:
- What I was doing when the application crashed:

Both hitting the "A" shortcut key, or clicking the "Reply to All" button in the toolbar causes Kontact to crash.

The crash can be reproduced every time.

-- Backtrace:
Application: Kontact (kontact), signal: Segmentation fault
Using host libthread_db library "/usr/lib64/libthread_db.so.1".
82	T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
[Current thread is 1 (Thread 0x7ff6f76f0880 (LWP 12361))]

Thread 6 (Thread 0x7ff6ea9f5700 (LWP 12362)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:166
#1  0x0000003e0ee1677d in WTF::TCMalloc_PageHeap::scavengerThread (this=0x3e0f8009a0) at wtf/FastMalloc.cpp:2495
#2  0x0000003e0ee16889 in WTF::TCMalloc_PageHeap::runScavengerThread (context=<optimized out>) at wtf/FastMalloc.cpp:1618
#3  0x0000003decc07d14 in start_thread (arg=0x7ff6ea9f5700) at pthread_create.c:309
#4  0x0000003dec4f199d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Thread 5 (Thread 0x7ff6ea0f4700 (LWP 12363)):
#0  0x0000003dec4e8eef in __GI___poll (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>) at ../sysdeps/unix/sysv/linux/poll.c:87
#1  0x0000003c272479b4 in g_main_context_poll (n_fds=1, fds=0x7ff6e40029c0, timeout=6825, context=0x7ff6e40009a0, priority=<optimized out>) at gmain.c:3440
#2  g_main_context_iterate (context=context@entry=0x7ff6e40009a0, block=block@entry=1, dispatch=dispatch@entry=1, self=<error reading variable: Unhandled dwarf expression opcode 0xfa>) at gmain.c:3141
#3  0x0000003c27247ad4 in g_main_context_iteration (context=0x7ff6e40009a0, may_block=1) at gmain.c:3207
#4  0x0000003df61a4506 in QEventDispatcherGlib::processEvents (this=0x7ff6e40008c0, flags=...) at kernel/qeventdispatcher_glib.cpp:426
#5  0x0000003df617513f in QEventLoop::processEvents (this=this@entry=0x7ff6ea0f3d20, flags=...) at kernel/qeventloop.cpp:149
#6  0x0000003df61753c8 in QEventLoop::exec (this=0x7ff6ea0f3d20, flags=...) at kernel/qeventloop.cpp:204
#7  0x0000003df6078650 in QThread::exec (this=<optimized out>) at thread/qthread.cpp:501
#8  0x0000003df607b5eb in QThreadPrivate::start (arg=0x6f9c20) at thread/qthread_unix.cpp:307
#9  0x0000003decc07d14 in start_thread (arg=0x7ff6ea0f4700) at pthread_create.c:309
#10 0x0000003dec4f199d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Thread 4 (Thread 0x7ff69fbc1700 (LWP 12375)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:218
#1  0x0000003df607ba47 in wait (time=30000, this=0x17d3660) at thread/qwaitcondition_unix.cpp:84
#2  QWaitCondition::wait (this=<optimized out>, mutex=0x17d3608, time=30000) at thread/qwaitcondition_unix.cpp:158
#3  0x0000003df606f36f in QThreadPoolThread::run (this=0x17e5ac0) at concurrent/qthreadpool.cpp:141
#4  0x0000003df607b5eb in QThreadPrivate::start (arg=0x17e5ac0) at thread/qthread_unix.cpp:307
#5  0x0000003decc07d14 in start_thread (arg=0x7ff69fbc1700) at pthread_create.c:309
#6  0x0000003dec4f199d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Thread 3 (Thread 0x7ff69e2ea700 (LWP 12377)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:218
#1  0x0000003df607ba47 in wait (time=30000, this=0x36bd040) at thread/qwaitcondition_unix.cpp:84
#2  QWaitCondition::wait (this=<optimized out>, mutex=0x37066c8, time=30000) at thread/qwaitcondition_unix.cpp:158
#3  0x0000003df606f36f in QThreadPoolThread::run (this=0x3704660) at concurrent/qthreadpool.cpp:141
#4  0x0000003df607b5eb in QThreadPrivate::start (arg=0x3704660) at thread/qthread_unix.cpp:307
#5  0x0000003decc07d14 in start_thread (arg=0x7ff69e2ea700) at pthread_create.c:309
#6  0x0000003dec4f199d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Thread 2 (Thread 0x7ff69cd0f700 (LWP 12380)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:218
#1  0x0000003df607ba47 in wait (time=30000, this=0x7ff6940066b0) at thread/qwaitcondition_unix.cpp:84
#2  QWaitCondition::wait (this=<optimized out>, mutex=0x7ff694006658, time=30000) at thread/qwaitcondition_unix.cpp:158
#3  0x0000003df606f36f in QThreadPoolThread::run (this=0x7ff694006980) at concurrent/qthreadpool.cpp:141
#4  0x0000003df607b5eb in QThreadPrivate::start (arg=0x7ff694006980) at thread/qthread_unix.cpp:307
#5  0x0000003decc07d14 in start_thread (arg=0x7ff69cd0f700) at pthread_create.c:309
#6  0x0000003dec4f199d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Thread 1 (Thread 0x7ff6f76f0880 (LWP 12361)):
[KCrash Handler]
#6  deref (this=0x6100760069003c) at ../../src/corelib/arch/qatomic_x86_64.h:133
#7  QFontPrivate::~QFontPrivate (this=0x55e31a0, __in_chrg=<optimized out>) at text/qfont.cpp:279
#8  0x0000003df81e2473 in ~QExplicitlySharedDataPointer (this=<optimized out>, __in_chrg=<optimized out>) at ../../src/corelib/tools/qshareddata.h:166
#9  QFont::~QFont (this=0x55e31a0, __in_chrg=<optimized out>) at text/qfont.cpp:853
#10 0x0000003df8231471 in ~QTextFormatPrivate (this=0x426bca0, __in_chrg=<optimized out>) at text/qtextformat.cpp:168
#11 ~QSharedDataPointer (this=<optimized out>, __in_chrg=<optimized out>) at ../../src/corelib/tools/qshareddata.h:90
#12 QTextFormat::~QTextFormat (this=<optimized out>, __in_chrg=<optimized out>) at text/qtextformat.cpp:791
#13 0x0000003df823eb43 in ~QTextCharFormat (this=0x7fff78a12f40, __in_chrg=<optimized out>) at ../../src/gui/text/qtextformat.h:372
#14 QTextHtmlExporter::emitFragment (this=this@entry=0x7fff78a136e0, fragment=...) at text/qtextdocument.cpp:2529
#15 0x0000003df82401d5 in QTextHtmlExporter::emitBlock (this=this@entry=0x7fff78a136e0, block=...) at text/qtextdocument.cpp:2720
#16 0x0000003df8242f78 in QTextHtmlExporter::emitFrame (this=0x7fff78a136e0, frameIt=...) at text/qtextdocument.cpp:2955
#17 0x0000003df82428e4 in QTextHtmlExporter::emitTable (this=this@entry=0x7fff78a136e0, table=0x5cc0a60) at text/qtextdocument.cpp:2919
#18 0x0000003df8242f1f in QTextHtmlExporter::emitFrame (this=this@entry=0x7fff78a136e0, frameIt=...) at text/qtextdocument.cpp:2950
#19 0x0000003df82438a4 in QTextHtmlExporter::toHtml (this=this@entry=0x7fff78a136e0, encoding=..., mode=mode@entry=QTextHtmlExporter::ExportEntireDocument) at text/qtextdocument.cpp:2136
#20 0x0000003df8243c74 in QTextDocument::toHtml (this=<optimized out>, encoding=...) at text/qtextdocument.cpp:3045
#21 0x0000003df9f0e673 in toHtml (this=<optimized out>) at /usr/include/QtGui/qtextedit.h:193
#22 KRichTextEdit::toCleanHtml (this=<optimized out>) at /usr/src/debug/kdelibs-4.8.3/kdeui/widgets/krichtextedit.cpp:525
#23 0x00007ff6a2229cdb in Message::KMeditor::fillComposerTextPart(Message::TextPart*) const () from /usr/lib64/libmessagecomposer.so.4
#24 0x00007ff6a2214f77 in Message::ComposerViewBase::createSimpleComposer() () from /usr/lib64/libmessagecomposer.so.4
#25 0x00007ff6a2215048 in Message::ComposerViewBase::autoSaveMessage() () from /usr/lib64/libmessagecomposer.so.4
#26 0x00000033cc2e57e9 in KMKernel::dumpDeadLetters() () from /usr/lib64/libkmailprivate.so.4
#27 0x00000033cc2e5ab7 in ?? () from /usr/lib64/libkmailprivate.so.4
#28 0x0000003df9ea41c8 in KCrash::defaultCrashHandler (sig=6) at /usr/src/debug/kdelibs-4.8.3/kdeui/util/kcrash.cpp:307
#29 <signal handler called>
#30 0x0000003dec435965 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#31 0x0000003dec437118 in __GI_abort () at abort.c:91
#32 0x0000003dec47568b in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x3dec578bc8 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:198
#33 0x0000003dec47c80e in malloc_printerr (ptr=0x426bca0, str=0x3dec578c68 "double free or corruption (out)", action=3) at malloc.c:5027
#34 _int_free (av=0x3dec7b0720, p=0x426bc90, have_lock=0) at malloc.c:3948
#35 0x0000003df821d045 in ~QTextCharFormat (this=0x7fff78a14c40, __in_chrg=<optimized out>) at text/qtextformat.h:372
#36 QTextEngine::itemize (this=0x5cb4190) at text/qtextengine.cpp:1615
#37 0x0000003df82245bc in QTextLayout::beginLayout (this=0x5675dd0) at text/qtextlayout.cpp:624
#38 0x0000003df8261b16 in QTextDocumentLayoutPrivate::layoutBlock (this=this@entry=0x35a2750, bl=..., blockPosition=blockPosition@entry=9856, blockFormat=..., layoutStruct=layoutStruct@entry=0x7fff78a17a30, layoutFrom=layoutFrom@entry=0, layoutTo=layoutTo@entry=80, previousBlockFormat=previousBlockFormat@entry=0x0) at text/qtextdocumentlayout.cpp:2590
#39 0x0000003df8269758 in QTextDocumentLayoutPrivate::layoutFlow (this=0x35a2750, it=..., layoutStruct=0x7fff78a17a30, layoutFrom=0, layoutTo=80, width=...) at text/qtextdocumentlayout.cpp:2402
#40 0x0000003df8265284 in QTextDocumentLayoutPrivate::layoutCell (this=this@entry=0x35a2750, t=t@entry=0x5cc0a60, cell=..., width=..., layoutFrom=layoutFrom@entry=0, layoutTo=layoutTo@entry=80, td=td@entry=0x56c84d0, absoluteTableY=absoluteTableY@entry=..., withPageBreaks=false, withPageBreaks@entry=3) at text/qtextdocumentlayout.cpp:1532
#41 0x0000003df8265c31 in QTextDocumentLayoutPrivate::layoutTable (this=this@entry=0x35a2750, table=0x5cc0a60, layoutFrom=layoutFrom@entry=0, layoutTo=layoutTo@entry=80, parentY=..., parentY@entry=...) at text/qtextdocumentlayout.cpp:1642
#42 0x0000003df8267fcc in QTextDocumentLayoutPrivate::layoutFrame (this=this@entry=0x35a2750, f=f@entry=0x5cc0a60, layoutFrom=layoutFrom@entry=0, layoutTo=layoutTo@entry=80, frameWidth=..., frameWidth@entry=..., frameHeight=..., parentY=...) at text/qtextdocumentlayout.cpp:2107
#43 0x0000003df82687cf in QTextDocumentLayoutPrivate::layoutFrame (this=this@entry=0x35a2750, f=f@entry=0x5cc0a60, layoutFrom=layoutFrom@entry=0, layoutTo=layoutTo@entry=80, parentY=...) at text/qtextdocumentlayout.cpp:2049
#44 0x0000003df8269c88 in QTextDocumentLayoutPrivate::layoutFlow (this=0x35a2750, it=..., layoutStruct=0x7fff78a186a0, layoutFrom=0, layoutTo=80, width=...) at text/qtextdocumentlayout.cpp:2311
#45 0x0000003df82682b1 in QTextDocumentLayoutPrivate::layoutFrame (this=this@entry=0x35a2750, f=f@entry=0x426c050, layoutFrom=layoutFrom@entry=0, layoutTo=layoutTo@entry=80, frameWidth=..., frameWidth@entry=..., frameHeight=..., parentY=...) at text/qtextdocumentlayout.cpp:2143
#46 0x0000003df82687cf in QTextDocumentLayoutPrivate::layoutFrame (this=this@entry=0x35a2750, f=f@entry=0x426c050, layoutFrom=layoutFrom@entry=0, layoutTo=layoutTo@entry=80, parentY=parentY@entry=...) at text/qtextdocumentlayout.cpp:2049
#47 0x0000003df826ab11 in QTextDocumentLayout::doLayout (this=this@entry=0x5e8db20, from=from@entry=0, oldLength=oldLength@entry=0, length=length@entry=80) at text/qtextdocumentlayout.cpp:2939
#48 0x0000003df826ba99 in QTextDocumentLayout::documentChanged (this=0x5e8db20, from=0, oldLength=0, length=80) at text/qtextdocumentlayout.cpp:2902
#49 0x0000003df824b664 in QTextDocumentPrivate::finishEdit (this=0x3553ac0) at text/qtextdocument_p.cpp:1220
#50 0x0000003e1161ba3c in insertSignatureHelper (signature=..., textEdit=textEdit@entry=0x5e9adc0, placement=placement@entry=KPIMIdentities::Signature::Start, isHtml=false, addNewlines=addNewlines@entry=true) at /usr/src/debug/kdepimlibs-4.8.3/kpimidentities/signature.cpp:469
#51 0x0000003e1161de15 in KPIMIdentities::Signature::insertIntoTextEdit (this=0x7fff78a18b00, placement=KPIMIdentities::Signature::Start, addedText=..., textEdit=0x5e9adc0) at /usr/src/debug/kdepimlibs-4.8.3/kpimidentities/signature.cpp:517
#52 0x00007ff6a222c014 in Message::SignatureController::insertSignatureHelper(KPIMIdentities::Signature::Placement) () from /usr/lib64/libmessagecomposer.so.4
#53 0x0000003df618acee in QObject::event (this=0x39e5c20, e=<optimized out>) at kernel/qobject.cpp:1195
#54 0x0000003df7fca37c in QApplicationPrivate::notify_helper (this=this@entry=0x6e77d0, receiver=receiver@entry=0x39e5c20, e=e@entry=0x5e2f5c0) at kernel/qapplication.cpp:4551
#55 0x0000003df7fce7fa in QApplication::notify (this=0x7fff78a195b0, receiver=0x39e5c20, e=0x5e2f5c0) at kernel/qapplication.cpp:4412
#56 0x0000003df9e45a56 in KApplication::notify (this=0x7fff78a195b0, receiver=0x39e5c20, event=0x5e2f5c0) at /usr/src/debug/kdelibs-4.8.3/kdeui/kernel/kapplication.cpp:311
#57 0x0000003df61763ee in QCoreApplication::notifyInternal (this=0x7fff78a195b0, receiver=receiver@entry=0x39e5c20, event=event@entry=0x5e2f5c0) at kernel/qcoreapplication.cpp:915
#58 0x0000003df6179ea1 in sendEvent (event=0x5e2f5c0, receiver=0x39e5c20) at kernel/qcoreapplication.h:231
#59 QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x6b2600) at kernel/qcoreapplication.cpp:1539
#60 0x0000003df61a4353 in sendPostedEvents () at kernel/qcoreapplication.h:236
#61 postEventSourceDispatch (s=s@entry=0x6f6530) at kernel/qeventdispatcher_glib.cpp:279
#62 0x0000003c272476e5 in g_main_dispatch (context=0x6f6400) at gmain.c:2539
#63 g_main_context_dispatch (context=context@entry=0x6f6400) at gmain.c:3075
#64 0x0000003c27247a18 in g_main_context_iterate (context=context@entry=0x6f6400, block=block@entry=1, dispatch=dispatch@entry=1, self=<error reading variable: Unhandled dwarf expression opcode 0xfa>) at gmain.c:3146
#65 0x0000003c27247ad4 in g_main_context_iteration (context=0x6f6400, may_block=1) at gmain.c:3207
#66 0x0000003df61a44e6 in QEventDispatcherGlib::processEvents (this=0x6b3ee0, flags=...) at kernel/qeventdispatcher_glib.cpp:424
#67 0x0000003df806a2ee in QGuiEventDispatcherGlib::processEvents (this=<optimized out>, flags=...) at kernel/qguieventdispatcher_glib.cpp:207
#68 0x0000003df617513f in QEventLoop::processEvents (this=this@entry=0x7fff78a19420, flags=...) at kernel/qeventloop.cpp:149
#69 0x0000003df61753c8 in QEventLoop::exec (this=0x7fff78a19420, flags=...) at kernel/qeventloop.cpp:204
#70 0x0000003df617a1b8 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1187
#71 0x0000000000403459 in ?? ()
#72 0x0000003dec421735 in __libc_start_main (main=0x402c60, argc=1, ubp_av=0x7fff78a196f8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff78a196e8) at libc-start.c:226
#73 0x0000000000403991 in _start ()

Reported using DrKonqi