*** Bug 197513 has been marked as a duplicate of this bug. ***

*** Bug 191913 has been marked as a duplicate of this bug. ***

I don't know if I am experiencing the same exact bug or not, but my description and solution has been similar.

Make sure all threads are stopped. Remove the apps/kmail folder in its entirety. Edit the config/kmailrc file to remove all references to folders and favorite folders. Restart. Wait for crash. Restart. Wait for crash. Repeat over and over until I get lucky enough to get kmail to start. The upgrade to QT 4.5.2-3-f11.x86_64 from fedora today seems to have made it even harder to actually get it running.

If I try to click on an inbox before all the tree views have filled in with + by the top folder name, it is likely to crash as well instead of opening the inbox. I have several deeply nested folders on the IMAP server. I have to wait for it to update all folder trees for the server I'm trying to check the inbox on to reliably get it to work.

Once it has attached to all the dovecot servers I don't have any further troubles with it. It's just the startup that is absolutely frustrating. This is a longstanding problem since going to the 4.x branch of KDE. It isn't something that just cropped up recently. Currently seen on 1.12.0/KDE 4.3.00 from fedora since the above release was a bit older. If I'm extremely lucky, I might get two starts in a row, but that only happens once a month. Thankfully I don't have to log out very often and can just leave it running.

*** Bug 209117 has been marked as a duplicate of this bug. ***

From bug 220960:
-- Information about the crash:
I use KMail as a stand-alone application.

What I did was:
I removed a mail from an IMAP mailbox (gmail).
The mail was already gone from the message list view and the next mail was
selected (an approval mail from KDE's mailing list daemon). The new mail was
then marked as "read" and its content about to be shown in the message view.
Before the mail content was shown, KMail crashed.

 -- Backtrace:
#6  QAbstractItemView::d_func (this=0x7) at itemviews/qabstractitemview.h:353
#7  QAbstractItemView::model (this=0x7) at itemviews/qabstractitemview.cpp:669
#8  0xb585cf5c in QTreeWidgetItem::executePendingSort (this=0x9f34718) at
itemviews/qtreewidget.cpp:2189
#9  0xb6c8eda5 in QTreeWidgetItem::indexOfChild (this=0x9f39520,
parent=0x9f34718, node=0x9ff7ad0, description=..., mimetype=..., encoding=...,
size=0, revertOrder=false)
    at /usr/include/qt4/QtGui/qtreewidget.h:251
#10 KMMimePartTreeItem (this=0x9f39520, parent=0x9f34718, node=0x9ff7ad0,
description=..., mimetype=..., encoding=..., size=0, revertOrder=false)
    at /home/fs/kdesvn/kdepim/kmail/kmmimeparttree.cpp:385
#11 0xb6cd8e8a in partNode::fillMimePartTree (this=0x9ff7ad0,
parentItem=0x9f34718, mimePartTree=0x0, labelDescr=..., labelCntType=...,
labelEncoding=..., size=0, revertOrder=<value optimized out>)
    at /home/fs/kdesvn/kdepim/kmail/partNode.cpp:549
#12 0xb6cc5efd in KMail::ObjectTreeParser::insertAndParseNewChildNode
(this=0xbf8a9670, startNode=..., content=0xb5f87ea0 "", cntDesc=0xb6fc0aa2
"encapsulated message", append=<value optimized out>, 
    addToTextualContent=false) at
/home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:232
#13 0xb6cca1d9 in KMail::ObjectTreeParser::processMessageRfc822Subtype
(this=0xbf8a9670, node=0xa130768) at
/home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:1582
#14 0xb6cd348b in process (this=0xa0479b0, otp=0xbf8a9670, node=0xa130768,
result=...) at /home/fs/kdesvn/kdepim/kmail/bodypartformatter.cpp:116
#15 0xb6cc553b in KMail::ObjectTreeParser::parseObjectTree (this=0xbf8a9670,
node=0xa130768) at /home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:318
#16 0xb6cc58a7 in KMail::ObjectTreeParser::stdChildHandling (this=0xbf8a988c,
child=0x9fb1248) at /home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:1278
#17 0xb6cc5ca1 in KMail::ObjectTreeParser::processMultiPartMixedSubtype
(this=0xbf8a988c, node=0x9f396b0) at
/home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:1291
#18 0xb6cd344b in process (this=0x9dcbcc0, otp=0xbf8a988c, node=0x9f396b0,
result=...) at /home/fs/kdesvn/kdepim/kmail/bodypartformatter.cpp:118
#19 0xb6cc553b in KMail::ObjectTreeParser::parseObjectTree (this=0xbf8a988c,
node=0x9f396b0) at /home/fs/kdesvn/kdepim/kmail/objecttreeparser.cpp:318
#20 0xb6b25d71 in KMReaderWin::parseMsg (this=0x923eff0, aMsg=0xa1e02e8) at
/home/fs/kdesvn/kdepim/kmail/kmreaderwin.cpp:1610
#21 0xb6b19a43 in KMReaderWin::displayMessage (this=0x923eff0) at
/home/fs/kdesvn/kdepim/kmail/kmreaderwin.cpp:1534
#22 0xb6b19c2d in KMReaderWin::updateReaderWin (this=0x923eff0) at
/home/fs/kdesvn/kdepim/kmail/kmreaderwin.cpp:1477
#23 0xb6b1a530 in KMReaderWin::update (this=0x923eff0, observable=0xa1e0358) at
/home/fs/kdesvn/kdepim/kmail/kmreaderwin.cpp:903
#24 0xb6d737c2 in KMail::ISubject::notify (this=0xa1e0358) at
/home/fs/kdesvn/kdepim/kmail/isubject.cpp:33
#25 0xb6a231a2 in KMMessage::updateBodyPart (this=0xa1e02e8, partSpecifier=...,
data=...) at /home/fs/kdesvn/kdepim/kmail/kmmessage.cpp:3185
#26 0xb6d483a0 in KMail::ImapJob::slotGetMessageResult (this=0x926e2f0,
job=0xa023e98) at /home/fs/kdesvn/kdepim/kmail/imapjob.cpp:435
#27 0xb6d4a2ef in KMail::ImapJob::qt_metacall (this=0x926e2f0,
_c=QMetaObject::InvokeMetaMethod, _id=12, _a=0xbf8a9e68) at
/home/fs/kdesvn/build/kdepim/kmail/imapjob.moc:88
...

*** Bug 220960 has been marked as a duplicate of this bug. ***

From bug 222724:
-- Information about the crash:
Kmail often crashes slightly after startup when I select an imap folder.
Restarting the application sometimes helps but often leads to a crash again.

From bug 222666:
-- Information about the crash:
When click on a mail in the mail-list, which is HTML-formatted, Kontact crashes
every time. Kontact crashes not at every HTML-Mail, only a special one.
The crash can be reproduced every time.

From bug 222388 (contains a lot of output and info):
-- Information about the crash:
I have open kmail, go to IMAP folder Drafts, select for view first unread
message from drafts (Created from another computer) and kmail crashes
momentally.
I try this operation four times and see the crash every time.

*** Bug 222724 has been marked as a duplicate of this bug. ***

*** Bug 222666 has been marked as a duplicate of this bug. ***

*** Bug 222388 has been marked as a duplicate of this bug. ***

Bug 224414 got more information too...

*** Bug 225365 has been marked as a duplicate of this bug. ***

Hmmm... this report is already one year old. I didn't encounter it up until my last upgrade to KDE 4.4. I use the openSUSE factory RPMs. I believe this is a high priority bug (and not a normal one) because it makes kmail unusable with messages containing MIME attachments and because of its old old age. It is obvious to me that the crash in a QTreeWidgetItem call has to be because of a lost reference or badly initialized data structure, and it occurs to me only in the call to addChild(). A pity that I don't have a debug compilation at hand...

*** Bug 227642 has been marked as a duplicate of this bug. ***

*** Bug 223765 has been marked as a duplicate of this bug. ***

*** Bug 228836 has been marked as a duplicate of this bug. ***

*** Bug 226977 has been marked as a duplicate of this bug. ***

*** Bug 227207 has been marked as a duplicate of this bug. ***

*** Bug 224414 has been marked as a duplicate of this bug. ***

*** Bug 229154 has been marked as a duplicate of this bug. ***

I have a mail which always crash my kamil if I try to view this mail.
I will add this mail to this bug so that you maybe can reproduce this.

It's important to note that this mail need to be viewed via IMAP (I use the courier imap server). 
If you open the file via open->file from kmail, nothing will crash.

Created attachment 41345 [details]
This mail keeps crashing kmail

Thanks for the mail, Martin. I was able to reproduce it using a Cyrus IMAP server. So this will help the developers track it down.

Running kmail via valgrind and clicking on the message shows invalid memory access.

Hopefully this is not exploitable...

*** Bug 228353 has been marked as a duplicate of this bug. ***

*** Bug 229219 has been marked as a duplicate of this bug. ***

*** Bug 229514 has been marked as a duplicate of this bug. ***

*** Bug 226456 has been marked as a duplicate of this bug. ***

*** Bug 227496 has been marked as a duplicate of this bug. ***

*** Bug 228198 has been marked as a duplicate of this bug. ***

*** Bug 228816 has been marked as a duplicate of this bug. ***

*** Bug 229445 has been marked as a duplicate of this bug. ***

*** Bug 222216 has been marked as a duplicate of this bug. ***

*** Bug 227367 has been marked as a duplicate of this bug. ***

*** Bug 228171 has been marked as a duplicate of this bug. ***

*** Bug 228764 has been marked as a duplicate of this bug. ***

*** Bug 229419 has been marked as a duplicate of this bug. ***

*** Bug 226921 has been marked as a duplicate of this bug. ***

*** Bug 228074 has been marked as a duplicate of this bug. ***

Ok, I'm able to reproduce this, Thanks for the test messages.

- Only happens with Fancy header style
- Only happens with encapsulated messages
- Only happens with Online IMAP (and probably only when attachment loading on demand is enabled)
- Only happens when the ContactSearchJob takes a long time (I artificially introduced a delay there so I could reproduce)

This is good news, Thomas!

It crashes for me with the following settings:
- Normal header style, only the date header is set to "fancy"
- IMAP with full email download (no attachments on demand)
- I don't use any contacts/addressbook (I use kmail instead of kontact),
  at least I didn't touch that stuff in a long time.

The mail that crashes for me is also an encapsulate message.
kmail 4.3.5 doesn't crash on the same message, kmail 4.4.0 instantly dies.

Hope that helps a bit.

(In reply to comment #39)
> Ok, I'm able to reproduce this, Thanks for the test messages.

One thing I want to add: It seems to happen only with message previews. If I disable the preview pane, I can select those offending messages in a separate window without any problem.

Adding my setup:

It crashes for me with the following settings:
- Normal header style, only the date header is set to "fancy"
- IMAP with loading attachments on demand
- I don't use any contacts/addressbook (I use kmail instead of kontact),
  at least I didn't touch that stuff in a long time.

When I disable  "load attachemnts on demand", KMail does not crash for me.

(In reply to comment #42)
> Adding my setup:
> 
> It crashes for me with the following settings:
> - Normal header style, only the date header is set to "fancy"
> - IMAP with loading attachments on demand
> - I don't use any contacts/addressbook (I use kmail instead of kontact),
>   at least I didn't touch that stuff in a long time.
> 
> When I disable  "load attachemnts on demand", KMail does not crash for me.

Same here. Disabling the "load attachments on demand" function solves the issue for now.

Created attachment 41467 [details]
New crash information added by DrKonqi

I started seeing this crash only with KDE 4.4.1. This repeatedly happens on certain email messages.

Created attachment 41472 [details]
New crash information added by DrKonqi

don't know if it is the kmail version or something special about the e-mail causing this, but I've only started seeing this today

Created attachment 41528 [details]
New crash information added by DrKonqi

The crash happens when I try click on a message that has another message attached.

The circumstances to reproduce are as reported by others:
- Fancy Theme
- Preview pane enabled

And the workaround works fine here as well:
- Disable "Load attachments on demand"

SVN commit 1099282 by tmcguire:

Disable photo display, the exec() in the ContactSearchJob is causing too many problems.

In this case, the body parts that were loaded on demand arrived during the exec(), and
modified the MIME tree, which was unexpected by the current parseOTP() run.

BUG: 186502

This bug seems to be triggered by two things.

One of the triggers was the contact photo display, that bug was introduced in 4.4.0, and it is where most/all of the recent duplicates come from. Contact photo display is now disabled in KDE SC 4.4.2, therefore working around the problem.

The original problem probably still is there, but at least the recent regression, which was the cause for most/all recent duplicates, is fixed.

*** Bug 230083 has been marked as a duplicate of this bug. ***

*** Bug 230341 has been marked as a duplicate of this bug. ***

*** Bug 230419 has been marked as a duplicate of this bug. ***

*** Bug 230446 has been marked as a duplicate of this bug. ***

*** Bug 229947 has been marked as a duplicate of this bug. ***

*** Bug 230813 has been marked as a duplicate of this bug. ***

Created attachment 41734 [details]
New crash information added by DrKonqi

Just got this today when opening an email.  kdemod 4.4.1 packages in Archlinux

*** Bug 231488 has been marked as a duplicate of this bug. ***

*** Bug 232087 has been marked as a duplicate of this bug. ***

*** Bug 228820 has been marked as a duplicate of this bug. ***

I gave it another valgrind run and this turned out to be an IMAP server response speed race condition. It's easily triggerable if you run kmail via valgrind as it gets reaaaallly slooooooow.

Here's the command:
valgrind --trace-children=yes --log-file=kmail.crash --free-fill=0 kmail

Backtrace of the bug:
==5906== Invalid read of size 8
==5906==    at 0x9CF9BF9: QTreeWidgetItem::addChild(QTreeWidgetItem*) (in /usr/lib64/libQtGui.so.4.6.2)
==5906==    by 0x9CFA002: QTreeWidgetItem::QTreeWidgetItem(QTreeWidgetItem*, int) (in /usr/lib64/libQtGui.so.4.6.2)
==5906==    by 0x5E36DA8: KMMimePartTreeItem::KMMimePartTreeItem(KMMimePartTreeItem*, partNode*, QString const&, QString const&, QString const&, unsigned long long, bool) (kmmimeparttree.cpp:378)
==5906==    by 0x5E7B362: partNode::fillMimePartTree(KMMimePartTreeItem*, KMMimePartTree*, QString const&, QString const&, QString const&, unsigned long long, bool) (partNode.cpp:549)
==5906==    by 0x5E69D0B: KMail::ObjectTreeParser::insertAndParseNewChildNode(partNode&, char const*, char const*, bool, bool) (objecttreeparser.cpp:232)
==5906==    by 0x5E6DAFF: KMail::ObjectTreeParser::processMessageRfc822Subtype(partNode*, KMail::ProcessResult&) (objecttreeparser.cpp:1582)
==5906==    by 0x5E69438: KMail::ObjectTreeParser::parseObjectTree(partNode*) (objecttreeparser.cpp:318)
==5906==    by 0x5E69754: KMail::ObjectTreeParser::stdChildHandling(partNode*) (objecttreeparser.cpp:1278)
==5906==    by 0x5E69B03: KMail::ObjectTreeParser::processMultiPartMixedSubtype(partNode*, KMail::ProcessResult&) (objecttreeparser.cpp:1291)
==5906==    by 0x5E69438: KMail::ObjectTreeParser::parseObjectTree(partNode*) (objecttreeparser.cpp:318)
==5906==    by 0x5CECF3F: KMReaderWin::parseMsg(KMMessage*) (kmreaderwin.cpp:1612)
==5906==    by 0x5CE326F: KMReaderWin::displayMessage() (kmreaderwin.cpp:1536)

==5906==  Address 0x1f2d39c0 is 48 bytes inside a block of size 80 free'd
==5906==    at 0x4C23E3F: operator delete(void*) (vg_replace_malloc.c:342)
==5906==    by 0x9CFD678: QTreeWidgetItem::~QTreeWidgetItem() (in /usr/lib64/libQtGui.so.4.6.2)
==5906==    by 0x5E38772: KMMimePartTreeItem::~KMMimePartTreeItem() (kmmimeparttree.h:105)
==5906==    by 0x9CF4BB5: (within /usr/lib64/libQtGui.so.4.6.2)
==5906==    by 0x5E34795: KMMimePartTree::clearAndResetSortOrder() (kmmimeparttree.cpp:103)
==5906==    by 0x5CE3190: KMReaderWin::displayMessage() (kmreaderwin.cpp:1518)
==5906==    by 0x5CE343F: KMReaderWin::updateReaderWin() (kmreaderwin.cpp:1479)
==5906==    by 0x5CE3D14: KMReaderWin::update(KMail::Interface::Observable*) (kmreaderwin.cpp:904)
==5906==    by 0x5F08210: KMail::ISubject::notify() (isubject.cpp:33)
==5906==    by 0x5C08BCB: KMMessage::updateBodyPart(QString, QByteArray const&) (kmmessage.cpp:3185)
==5906==    by 0x5EDFF58: KMail::ImapJob::slotGetMessageResult(KJob*) (imapjob.cpp:435)
==5906==    by 0x5EE1ADA: KMail::ImapJob::qt_metacall(QMetaObject::Call, int, void**) (imapjob.moc:88)

If you look close, displayMessage() is currently running while a callback enters displayMessage() again. The first thing displayMessage() does is a clearAndResetSortOrder() which frees the memory the first displayMessage() call is currently working on -> Boom.

Attached is a proof-of-concept workaround patch.

Created attachment 42440 [details]
Fix crash on display of multipart message

This is a proof-of-concept patch. The kWarning() calls should be removed before and if it's included. Also the new lock may have potential side-effects like "message display not updated", though I have seen none yet.

Unfortunately we can't use Qt's blockSignals() in displayMessage() as signals are lost instead of queued. Ideas?

*** Bug 233123 has been marked as a duplicate of this bug. ***

*** Bug 228284 has been marked as a duplicate of this bug. ***

*** Bug 235176 has been marked as a duplicate of this bug. ***

*** Bug 267661 has been marked as a duplicate of this bug. ***

I cannot reproduce it anymore since months, even when loading Attachments on demand. Removing my CC.

Thank you for your report. Kmail1 is currently unmaintained and the code has changed sufficiently in Kmail2 so the backtraces are not really useful anymore. Should you experience the same crash in Kmail 4.8.5 or later, please open a new report for Kmail2. Thank you for your understanding