Version:            (using Devel)
Installed from:    Compiled sources
OS:                Linux

Encountered while browsing Google News. Middle-clicked a link to a guardian.co.uk article, and then boom. Could not reproduce. Filing this bug report to archive the backtrace in case it helps anyone.

Note: I have a core dump of the browser's state upon segfault (which is what I am examining below); if anyone would like more telemetry from that, please let me know within a few days.

(gdb) thread 3
[Switching to thread 3 (process 24106)]#0  NodeListImpl (this=0x7fff1a107f10,
    n=0x0, type=15, factory=0x2aaaacf75160 <CollectionCache::make()>)
    at /scratch/kdesvn/kdelibs/khtml/misc/shared.h:61
61          void ref() { _ref++;  }
(gdb) where
#0  NodeListImpl (this=0x7fff1a107f10, n=0x0, type=15,
    factory=0x2aaaacf75160 <CollectionCache::make()>)
    at /scratch/kdesvn/kdelibs/khtml/misc/shared.h:61
#1  0x00002aaaacf73ea0 in HTMLCollectionImpl (this=0x7fff1a107f10, _base=0x0,
    _type=15) at /scratch/kdesvn/kdelibs/khtml/html/html_miscimpl.cpp:70
#2  0x00002aaaad0df47a in KJS::FrameArray::getOwnPropertySlot (
    this=0x2aaab16dc600, exec=0x7fff1a108830, propertyName=@0x7fff1a108460,
    slot=@0x7fff1a107fc0)
    at /scratch/kdesvn/kdelibs/khtml/ecma/kjs_window.cpp:2565
#3  0x00002aaaad456d99 in KJS::JSObject::get (this=0x2aaab16dc600,
    exec=0x7fff1a108830, propertyName=@0x7fff1a108460)
    at /scratch/kdesvn/kdelibs/kjs/object.h:584
#4  0x00002aaaad470af6 in KJS::Machine::runBlock (exec=0x7fff1a108830,
    codeBlock=<value optimized out>, parentExec=0x7fff1a109240)
    at codes.def:722
#5  0x00002aaaad450e78 in KJS::FunctionImp::callAsFunction (
    this=0x2aaab16c3600, exec=0x7fff1a109240, thisObj=<value optimized out>,
    args=@0x7fff1a108e20) at /scratch/kdesvn/kdelibs/kjs/function.cpp:143
#6  0x00002aaaad45742f in KJS::JSObject::call (this=0x2aaab16c3600,
    exec=0x7fff1a109240, thisObj=0x2aaab16c37c0, args=@0x7fff1a108e20)
    at /scratch/kdesvn/kdelibs/kjs/object.cpp:99
#7  0x00002aaaad475393 in KJS::Machine::runBlock (exec=0x7fff1a109240,
    codeBlock=<value optimized out>, parentExec=0x7fff1a109c50)
    at codes.def:1206
#8  0x00002aaaad450e78 in KJS::FunctionImp::callAsFunction (
    this=0x2aaab16c3100, exec=0x7fff1a109c50, thisObj=<value optimized out>,
    args=@0x7fff1a109830) at /scratch/kdesvn/kdelibs/kjs/function.cpp:143
#9  0x00002aaaad45742f in KJS::JSObject::call (this=0x2aaab16c3100,
    exec=0x7fff1a109c50, thisObj=0x2aaaaac20180, args=@0x7fff1a109830)
    at /scratch/kdesvn/kdelibs/kjs/object.cpp:99
#10 0x00002aaaad475393 in KJS::Machine::runBlock (exec=0x7fff1a109c50,
    codeBlock=<value optimized out>, parentExec=0x9368210) at codes.def:1206
#11 0x00002aaaad450e78 in KJS::FunctionImp::callAsFunction (
    this=0x2aaab16c1640, exec=0x9368210, thisObj=<value optimized out>,
    args=@0x3ea1688) at /scratch/kdesvn/kdelibs/kjs/function.cpp:143
#12 0x00002aaaad45742f in KJS::JSObject::call (this=0x2aaab16c1640,
    exec=0x9368210, thisObj=0x2aaaaac20180, args=@0x3ea1688)
    at /scratch/kdesvn/kdelibs/kjs/object.cpp:99
#13 0x00002aaaad0ddab0 in KJS::ScheduledAction::execute (this=0x3ea1680,
    window=0x2aaaaac20180)
    at /scratch/kdesvn/kdelibs/khtml/ecma/kjs_window.cpp:2174
#14 0x00002aaaad0df8bb in KJS::WindowQObject::timerEvent (this=0x9734a60)
    at /scratch/kdesvn/kdelibs/khtml/ecma/kjs_window.cpp:2350
#15 0x00002b4491f2c76a in QObject::event (this=0x9734a60, e=0x7fff1a10a790)
    at /scratch/kdesvn/qt-copy/src/corelib/kernel/qobject.cpp:1105
#16 0x00002b44928aa5c5 in QApplicationPrivate::notify_helper (this=0x5196b0,
    receiver=0x9734a60, e=0x7fff1a10a790)
    at /scratch/kdesvn/qt-copy/src/gui/kernel/qapplication.cpp:3800
#17 0x00002b44928aa8e7 in QApplication::notify (this=0x7fff1a10ace0,
    receiver=0x9734a60, e=0x7fff1a10a790)
    at /scratch/kdesvn/qt-copy/src/gui/kernel/qapplication.cpp:3392
#18 0x00002b4491620a1b in KApplication::notify (this=0x7fff1a10ace0,
    receiver=0x9734a60, event=0x7fff1a10a790)
    at /scratch/kdesvn/kdelibs/kdeui/kernel/kapplication.cpp:311
#19 0x00002b4491f198e4 in QCoreApplication::notifyInternal (
    this=0x7fff1a10ace0, receiver=0x9734a60, event=0x7fff1a10a790)
    at /scratch/kdesvn/qt-copy/src/corelib/kernel/qcoreapplication.cpp:587
#20 0x00002b4491f1d1b3 in QCoreApplication::sendEvent (receiver=0x9734a60,
    event=0x7fff1a10a790)
    at ../../include/QtCore/../../../../qt-copy/src/corelib/kernel/qcoreapplication.h:215
#21 0x00002b4491f49db6 in QTimerInfoList::activateTimers (this=0x51ce30)
    at /scratch/kdesvn/qt-copy/src/corelib/kernel/qeventdispatcher_unix.cpp:563
#22 0x00002b4491f46e6b in timerSourceDispatch (source=0x51cdd0)
    at /scratch/kdesvn/qt-copy/src/corelib/kernel/qeventdispatcher_glib.cpp:166
#23 0x00002b4495212913 in g_main_context_dispatch ()
   from /usr/lib/libglib-2.0.so.0
#24 0x00002b449521575d in g_main_context_check ()
   from /usr/lib/libglib-2.0.so.0
#25 0x00002b4495215c7e in g_main_context_iteration ()
   from /usr/lib/libglib-2.0.so.0
#26 0x00002b4491f46852 in QEventDispatcherGlib::processEvents (this=0x514510,
    flags=@0x7fff1a10a990)
    at /scratch/kdesvn/qt-copy/src/corelib/kernel/qeventdispatcher_glib.cpp:325
#27 0x00002b44929496e7 in QGuiEventDispatcherGlib::processEvents (
    this=0x514510, flags=@0x7fff1a10a9f0)
    at /scratch/kdesvn/qt-copy/src/gui/kernel/qguieventdispatcher_glib.cpp:204
#28 0x00002b4491f16878 in QEventLoop::processEvents (this=0x7fff1a10aaa0,
    flags=@0x7fff1a10aa50)
    at /scratch/kdesvn/qt-copy/src/corelib/kernel/qeventloop.cpp:149
#29 0x00002b4491f16a73 in QEventLoop::exec (this=0x7fff1a10aaa0,
    flags=@0x7fff1a10aab0)
    at /scratch/kdesvn/qt-copy/src/corelib/kernel/qeventloop.cpp:196
#30 0x00002b4491f1a16e in QCoreApplication::exec ()
    at /scratch/kdesvn/qt-copy/src/corelib/kernel/qcoreapplication.cpp:849
#31 0x00002b44928aa326 in QApplication::exec ()
    at /scratch/kdesvn/qt-copy/src/gui/kernel/qapplication.cpp:3330
#32 0x00002b4490b82abf in kdemain (argc=<value optimized out>,
    argv=<value optimized out>)
    at /scratch/kdesvn/kdebase/apps/konqueror/src/konqmain.cpp:227
#33 0x00002b44942454ca in __libc_start_main () from /lib/libc.so.6
#34 0x000000000040075a in _start () at ../sysdeps/x86_64/elf/start.S:113
(gdb)
(gdb) p this
$1 = (class DOM::NodeListImpl * const) 0x7fff1a107f10
(gdb) p *this
$2 = {<khtml::Shared<DOM::NodeListImpl>> = {_ref = 0},
  _vptr.NodeListImpl = 0x0, m_refNode = 0x9ad7a0, m_cache = 0x2aaaad464e24}
(gdb)