Version: (using KDE 4.4.0) OS: Linux Installed from: Archlinux Packages When I select a particular message, KMail crash with this backtrace: Application: KMail (kmail), signal: Segmentation fault [KCrash Handler] #6 0xb625c20d in QAbstractItemView::model() const () from /usr/lib/libQtGui.so.4 #7 0xb62e7be2 in QTreeWidgetItem::insertChild(int, QTreeWidgetItem*) () from /usr/lib/libQtGui.so.4 #8 0xb62e80bd in QTreeWidgetItem::addChild(QTreeWidgetItem*) () from /usr/lib/libQtGui.so.4 #9 0xb62e8500 in QTreeWidgetItem::QTreeWidgetItem(QTreeWidgetItem*, int) () from /usr/lib/libQtGui.so.4 #10 0xb6d24574 in KMMimePartTreeItem::KMMimePartTreeItem(KMMimePartTreeItem*, partNode*, QString const&, QString const&, QString const&, unsigned long long, bool) () from /usr/lib/libkmailprivate.so.4 #11 0xb6d6ebca in partNode::fillMimePartTree(KMMimePartTreeItem*, KMMimePartTree*, QString const&, QString const&, QString const&, unsigned long long, bool) () from /usr/lib/libkmailprivate.so.4 #12 0xb6d5bbbd in KMail::ObjectTreeParser::insertAndParseNewChildNode(partNode&, char const*, char const*, bool, bool) () from /usr/lib/libkmailprivate.so.4 #13 0xb6d5fdb9 in KMail::ObjectTreeParser::processMessageRfc822Subtype(partNode*, KMail::ProcessResult&) () from /usr/lib/libkmailprivate.so.4 #14 0xb6d691eb in (anonymous namespace)::MessageRfc822BodyPartFormatter::process(KMail::ObjectTreeParser*, partNode*, KMail::ProcessResult&) const () from /usr/lib/libkmailprivate.so.4 #15 0xb6d5b1fb in KMail::ObjectTreeParser::parseObjectTree(partNode*) () from /usr/lib/libkmailprivate.so.4 #16 0xb6d5b567 in KMail::ObjectTreeParser::stdChildHandling(partNode*) () from /usr/lib/libkmailprivate.so.4 #17 0xb6d5b961 in KMail::ObjectTreeParser::processMultiPartMixedSubtype(partNode*, KMail::ProcessResult&) () from /usr/lib/libkmailprivate.so.4 #18 0xb6d691ab in (anonymous namespace)::MultiPartMixedBodyPartFormatter::process(KMail::ObjectTreeParser*, partNode*, KMail::ProcessResult&) const () from /usr/lib/libkmailprivate.so.4 #19 0xb6d5b1fb in KMail::ObjectTreeParser::parseObjectTree(partNode*) () from /usr/lib/libkmailprivate.so.4 #20 0xb6bbb3f1 in KMReaderWin::parseMsg(KMMessage*) () from /usr/lib/libkmailprivate.so.4 #21 0xb6baf0c3 in KMReaderWin::displayMessage() () from /usr/lib/libkmailprivate.so.4 #22 0xb6baf2ad in KMReaderWin::updateReaderWin() () from /usr/lib/libkmailprivate.so.4 #23 0xb6bafbb0 in KMReaderWin::update(KMail::Interface::Observable*) () from /usr/lib/libkmailprivate.so.4 #24 0xb6e09562 in KMail::ISubject::notify() () from /usr/lib/libkmailprivate.so.4 #25 0xb6ab93f2 in KMMessage::updateBodyPart(QString, QByteArray const&) () from /usr/lib/libkmailprivate.so.4 #26 0xb6dde150 in KMail::ImapJob::slotGetMessageResult(KJob*) () from /usr/lib/libkmailprivate.so.4 #27 0xb6de00af in KMail::ImapJob::qt_metacall(QMetaObject::Call, int, void**) () from /usr/lib/libkmailprivate.so.4 #28 0xb676aeba in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) () from /usr/lib/libQtCore.so.4 #29 0xb677947f in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib/libQtCore.so.4 #30 0xb726d523 in KJob::result(KJob*) () from /usr/lib/libkdecore.so.5 #31 0xb726d888 in KJob::emitResult() () from /usr/lib/libkdecore.so.5 #32 0xb533ed60 in KIO::SimpleJob::slotFinished() () from /usr/lib/libkio.so.5 #33 0xb533f79d in KIO::TransferJob::slotFinished() () from /usr/lib/libkio.so.5 #34 0xb533d173 in KIO::TransferJob::qt_metacall(QMetaObject::Call, int, void**) () from /usr/lib/libkio.so.5 #35 0xb676aeba in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) () from /usr/lib/libQtCore.so.4 #36 0xb677947f in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib/libQtCore.so.4 #37 0xb54092b7 in KIO::SlaveInterface::finished() () from /usr/lib/libkio.so.5 #38 0xb540c5dd in KIO::SlaveInterface::dispatch(int, QByteArray const&) () from /usr/lib/libkio.so.5 #39 0xb5409773 in KIO::SlaveInterface::dispatch() () from /usr/lib/libkio.so.5 #40 0xb53fcc58 in KIO::Slave::gotInput() () from /usr/lib/libkio.so.5 #41 0xb53fce63 in KIO::Slave::qt_metacall(QMetaObject::Call, int, void**) () from /usr/lib/libkio.so.5 #42 0xb676aeba in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) () from /usr/lib/libQtCore.so.4 #43 0xb677947f in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib/libQtCore.so.4 #44 0xb5307b17 in KIO::Connection::readyRead() () from /usr/lib/libkio.so.5 #45 0xb5309ebe in KIO::ConnectionPrivate::dequeue() () from /usr/lib/libkio.so.5 #46 0xb5309fee in KIO::Connection::qt_metacall(QMetaObject::Call, int, void**) () from /usr/lib/libkio.so.5 #47 0xb676aeba in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) () from /usr/lib/libQtCore.so.4 #48 0xb67753a6 in QMetaCallEvent::placeMetaCall(QObject*) () from /usr/lib/libQtCore.so.4 #49 0xb67764de in QObject::event(QEvent*) () from /usr/lib/libQtCore.so.4 #50 0xb5ccc5dc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4 #51 0xb5cd31ee in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4 #52 0xb75b0e1a in KApplication::notify(QObject*, QEvent*) () from /usr/lib/libkdeui.so.5 #53 0xb6765cbb in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib/libQtCore.so.4 #54 0xb6768693 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/lib/libQtCore.so.4 #55 0xb67687fd in QCoreApplication::sendPostedEvents(QObject*, int) () from /usr/lib/libQtCore.so.4 #56 0xb6791adf in ?? () from /usr/lib/libQtCore.so.4 #57 0xb3fba378 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #58 0xb3fbdbf0 in g_main_context_iterate () from /usr/lib/libglib-2.0.so.0 #59 0xb3fbdd23 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0 #60 0xb67915d5 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4 #61 0xb5d88ae5 in ?? () from /usr/lib/libQtGui.so.4 #62 0xb67642f9 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4 #63 0xb676474a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4 #64 0xb67688bf in QCoreApplication::exec() () from /usr/lib/libQtCore.so.4 #65 0xb5ccc677 in QApplication::exec() () from /usr/lib/libQtGui.so.4 #66 0x0804a8de in _start ()
Same backtrace here using KDE 4.4.0 for Fedora 12: Application: KMail (kmail), signal: Segmentation fault [KCrash Handler] #5 0x00000035df147bd0 in QTreeWidgetItem::addChild(QTreeWidgetItem*) () from /usr/lib64/libQtGui.so.4 #6 0x00000035df147fd3 in QTreeWidgetItem::QTreeWidgetItem(QTreeWidgetItem*, int) () from /usr/lib64/libQtGui.so.4 #7 0x00007f2ac938a639 in KMMimePartTreeItem::KMMimePartTreeItem (this=0x34bc580, parent=0x30eb2f0, node=0x303b570, description=@0x303b601, mimetype=@0x1, encoding=@0x7fff11b70430, size=0, revertOrder=false) at /usr/src/debug/kdepim-4.4.0/kmail/kmmimeparttree.cpp:378 #8 0x00007f2ac93cebf3 in partNode::fillMimePartTree (this=0x303b570, parentItem=0x34bc580, mimePartTree=<value optimized out>, labelDescr=<value optimized out>, labelCntType=<value optimized out>, labelEncoding=<value optimized out>, size=0, revertOrder=false) at /usr/src/debug/kdepim-4.4.0/kmail/partNode.cpp:549 #9 0x00007f2ac93bd59c in KMail::ObjectTreeParser::insertAndParseNewChildNode (this=0x7fff11b70b10, startNode=@0x33558b0, content=<value optimized out>, cntDesc=<value optimized out>, append=false, addToTextualContent=<value optimized out>) at /usr/src/debug/kdepim-4.4.0/kmail/objecttreeparser.cpp:232 #10 0x00007f2ac93c1390 in KMail::ObjectTreeParser::processMessageRfc822Subtype (this=0x7fff11b70b10, node=0x33558b0) at /usr/src/debug/kdepim-4.4.0/kmail/objecttreeparser.cpp:1582 #11 0x00007f2ac93bccc9 in KMail::ObjectTreeParser::parseObjectTree (this=0x7fff11b70b10, node=0x33558b0) at /usr/src/debug/kdepim-4.4.0/kmail/objecttreeparser.cpp:318 #12 0x00007f2ac93bcfe5 in KMail::ObjectTreeParser::stdChildHandling (this=0x7fff11b70e20, child=0x3355780) at /usr/src/debug/kdepim-4.4.0/kmail/objecttreeparser.cpp:1278 #13 0x00007f2ac93bd394 in KMail::ObjectTreeParser::processMultiPartMixedSubtype (this=0x34bc580, node=<value optimized out>) at /usr/src/debug/kdepim-4.4.0/kmail/objecttreeparser.cpp:1291 #14 0x00007f2ac93bccc9 in KMail::ObjectTreeParser::parseObjectTree (this=0x7fff11b70e20, node=0x3355650) at /usr/src/debug/kdepim-4.4.0/kmail/objecttreeparser.cpp:318 #15 0x00007f2ac9240d40 in KMReaderWin::parseMsg (this=0x2d39170, aMsg=0x34eaaf0) at /usr/src/debug/kdepim-4.4.0/kmail/kmreaderwin.cpp:1611 #16 0x00007f2ac9237090 in KMReaderWin::displayMessage (this=0x2d39170) at /usr/src/debug/kdepim-4.4.0/kmail/kmreaderwin.cpp:1535 #17 0x00007f2ac9237260 in KMReaderWin::updateReaderWin (this=0x2d39170) at /usr/src/debug/kdepim-4.4.0/kmail/kmreaderwin.cpp:1478 #18 0x00007f2ac9237b35 in KMReaderWin::update (this=0x2d39170, observable=<value optimized out>) at /usr/src/debug/kdepim-4.4.0/kmail/kmreaderwin.cpp:903 #19 0x00007f2ac945baa1 in KMail::ISubject::notify (this=0x34eabc0) at /usr/src/debug/kdepim-4.4.0/kmail/isubject.cpp:33 #20 0x00007f2ac915c96c in KMMessage::updateBodyPart (this=0x34eaaf0, partSpecifier= {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 16491}, alloc = 0, size = 0, data = 0x35dca79e3a, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 1152}, alloc = 0, size = 0, data = 0x35dca79e5a, clean = 1, simpletext = 1, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0x3372410, static codecForCStrings = 0x0}, data=<value optimized out>) at /usr/src/debug/kdepim-4.4.0/kmail/kmmessage.cpp:3185 #21 0x00007f2ac94337e9 in KMail::ImapJob::slotGetMessageResult (this=0x3372570, job=<value optimized out>) at /usr/src/debug/kdepim-4.4.0/kmail/imapjob.cpp:435 #22 0x00007f2ac943536b in KMail::ImapJob::qt_metacall (this=0x3372570, _c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x7fff11b718e0) at /usr/src/debug/kdepim-4.4.0/x86_64-redhat-linux-gnu/kmail/imapjob.moc:88 #23 0x00000035dc77991f in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib64/libQtCore.so.4 #24 0x00000035e12f9a62 in KJob::result(KJob*) () from /usr/lib64/libkdecore.so.5 #25 0x00000035e12f9d20 in KJob::emitResult() () from /usr/lib64/libkdecore.so.5 #26 0x00000035e28ef8f3 in KIO::SimpleJob::slotFinished() () from /usr/lib64/libkio.so.5 #27 0x00000035e28f02b7 in KIO::TransferJob::slotFinished() () from /usr/lib64/libkio.so.5 #28 0x00000035e28ee241 in KIO::TransferJob::qt_metacall(QMetaObject::Call, int, void**) () from /usr/lib64/libkio.so.5 #29 0x00000035dc77991f in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib64/libQtCore.so.4 #30 0x00000035e29b0301 in KIO::SlaveInterface::dispatch(int, QByteArray const&) () from /usr/lib64/libkio.so.5 #31 0x00000035e29ad673 in KIO::SlaveInterface::dispatch() () from /usr/lib64/libkio.so.5 #32 0x00000035e29a19f6 in KIO::Slave::gotInput() () from /usr/lib64/libkio.so.5 #33 0x00000035e29a1bcc in KIO::Slave::qt_metacall(QMetaObject::Call, int, void**) () from /usr/lib64/libkio.so.5 #34 0x00000035dc77991f in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib64/libQtCore.so.4 #35 0x00000035e28bebf7 in ?? () from /usr/lib64/libkio.so.5 #36 0x00000035e28bed0d in KIO::Connection::qt_metacall(QMetaObject::Call, int, void**) () from /usr/lib64/libkio.so.5 #37 0x00000035dc776861 in QObject::event(QEvent*) () from /usr/lib64/libQtCore.so.4 #38 0x00000035debabb3c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4 #39 0x00000035debb206b in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4 #40 0x00000035e221f5e6 in KApplication::notify(QObject*, QEvent*) () from /usr/lib64/libkdeui.so.5 #41 0x00000035dc766a6c in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib64/libQtCore.so.4 #42 0x00000035dc7678e7 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/lib64/libQtCore.so.4 #43 0x00000035dc790223 in ?? () from /usr/lib64/libQtCore.so.4 #44 0x00000035d363790e in g_main_context_dispatch () from /lib64/libglib-2.0.so.0 #45 0x00000035d363b0e8 in ?? () from /lib64/libglib-2.0.so.0 #46 0x00000035d363b20a in g_main_context_iteration () from /lib64/libglib-2.0.so.0 #47 0x00000035dc78fd63 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4 #48 0x00000035dec599ce in ?? () from /usr/lib64/libQtGui.so.4 #49 0x00000035dc7653a2 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4 #50 0x00000035dc76577c in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/libQtCore.so.4 #51 0x00000035dc767b99 in QCoreApplication::exec() () from /usr/lib64/libQtCore.so.4 #52 0x00000000004032d2 in main (argc=<value optimized out>, argv=<value optimized out>) at /usr/src/debug/kdepim-4.4.0/kmail/main.cpp:156
Running kmail in valgrind shows memory reads of previoulsy freed memory: ==28684== Syscall param write(buf) points to uninitialised byte(s) ==28684== at 0x35D1E0DD20: __write_nocancel (in /lib64/libpthread-2.10.2.so) ==28684== by 0x35D6E0902E: (within /usr/lib64/libICE.so.6.3.0) ==28684== by 0x35D6E0D8BF: _IceWrite (in /usr/lib64/libICE.so.6.3.0) ==28684== by 0x35D6E0D9A3: IceFlush (in /usr/lib64/libICE.so.6.3.0) ==28684== by 0x35DEC1FFCC: (within /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35DEC2401F: (within /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35DEC349DD: (within /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35DEC356D8: (within /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35D6A0624E: _SmcProcessMessage (in /usr/lib64/libSM.so.6.0.0) ==28684== by 0x35D6E123EB: IceProcessMessages (in /usr/lib64/libICE.so.6.3.0) ==28684== by 0x35DEC2050E: (within /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35DC77991E: QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (in /usr/lib64/libQtCore.so.4.6.2) ==28684== Address 0xd76b4ac is 12 bytes inside a block of size 1,024 alloc'd ==28684== at 0x4A05414: calloc (vg_replace_malloc.c:397) ==28684== by 0x35D6E05D88: IceOpenConnection (in /usr/lib64/libICE.so.6.3.0) ==28684== by 0x35D6A026F2: SmcOpenConnection (in /usr/lib64/libSM.so.6.0.0) ==28684== by 0x35DEC271C7: QSessionManager::QSessionManager(QApplication*, QString&, QString&) (in /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35DEBB644B: QApplicationPrivate::initialize() (in /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35DEBB656A: QApplicationPrivate::construct(_XDisplay*, unsigned long, unsigned long) (in /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35DEBB7287: QApplication::QApplication(int&, char**, bool, int) (in /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x35E2221D4B: KApplication::KApplication(bool, KComponentData const&) (in /usr/lib64/libkdeui.so.5.4.0) ==28684== by 0x35E2228302: KUniqueApplication::KUniqueApplication(bool, bool) (in /usr/lib64/libkdeui.so.5.4.0) ==28684== by 0x35F1012FB6: KontactInterface::PimUniqueApplication::PimUniqueApplication() (in /usr/lib64/libkontactinterface.so.4.4.0) ==28684== by 0x40322A: main (main.cpp:49) The interesting part: ==28684== Address 0x1782f190 is 40 bytes inside a block of size 80 free'd ==28684== at 0x4A05E3F: operator delete(void*) (vg_replace_malloc.c:342) ==28684== by 0x35DF14B648: QTreeWidgetItem::~QTreeWidgetItem() (in /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x4F64002: KMMimePartTreeItem::~KMMimePartTreeItem() (kmmimeparttree.h:105) ==28684== by 0x35DF142B85: (within /usr/lib64/libQtGui.so.4.6.2) ==28684== by 0x4F60025: KMMimePartTree::clearAndResetSortOrder() (kmmimeparttree.cpp:103) ==28684== by 0x4E0EFB0: KMReaderWin::displayMessage() (kmreaderwin.cpp:1517) ==28684== by 0x4E0F25F: KMReaderWin::updateReaderWin() (kmreaderwin.cpp:1478) ==28684== by 0x4E0FB34: KMReaderWin::update(KMail::Interface::Observable*) (kmreaderwin.cpp:903) ==28684== by 0x5033AA0: KMail::ISubject::notify() (isubject.cpp:33) ==28684== by 0x4D3496B: KMMessage::updateBodyPart(QString, QByteArray const&) (kmmessage.cpp:3185) ==28684== by 0x500B7E8: KMail::ImapJob::slotGetMessageResult(KJob*) (imapjob.cpp:435) ==28684== by 0x500D36A: KMail::ImapJob::qt_metacall(QMetaObject::Call, int, void**) (imapjob.moc:88) ==28684== ==28684== Invalid read of size 8 ==28684== at 0x4F6033F: KMMimePartTreeItem::correctSize() (qlist.h:90) ==28684== by 0x4F603B9: KMMimePartTreeItem::correctSize() (kmmimeparttree.cpp:431) ==28684== by 0x4F603B9: KMMimePartTreeItem::correctSize() (kmmimeparttree.cpp:431) ==28684== by 0x4F62783: KMMimePartTreeItem::KMMimePartTreeItem(KMMimePartTreeItem*, partNode*, QString const&, QString const&, QString const&, unsigned long long, bool) (kmmimeparttree.cpp:404) ==28684== by 0x4FA6BF2: partNode::fillMimePartTree(KMMimePartTreeItem*, KMMimePartTree*, QString const&, QString const&, QString const&, unsigned long long, bool) (partNode.cpp:549) ==28684== by 0x4FA6C9B: partNode::fillMimePartTree(KMMimePartTreeItem*, KMMimePartTree*, QString const&, QString const&, QString const&, unsigned long long, bool) (partNode.cpp:561) ==28684== by 0x4FA65D6: partNode::fillMimePartTree(KMMimePartTreeItem*, KMMimePartTree*, QString const&, QString const&, QString const&, unsigned long long, bool) (partNode.cpp:500) ==28684== by 0x4FA6C9B: partNode::fillMimePartTree(KMMimePartTreeItem*, KMMimePartTree*, QString const&, QString const&, QString const&, unsigned long long, bool) (partNode.cpp:561) ==28684== by 0x4F9559B: KMail::ObjectTreeParser::insertAndParseNewChildNode(partNode&, char const*, char const*, bool, bool) (objecttreeparser.cpp:232) ==28684== by 0x4F9938F: KMail::ObjectTreeParser::processMessageRfc822Subtype(partNode*, KMail::ProcessResult&) (objecttreeparser.cpp:1582) ==28684== by 0x4F94CC8: KMail::ObjectTreeParser::parseObjectTree(partNode*) (objecttreeparser.cpp:318) ==28684== by 0x4F94FE4: KMail::ObjectTreeParser::stdChildHandling(partNode*) (objecttreeparser.cpp:1278)
Created attachment 41324 [details] New crash information added by DrKonqi Same for me on gentoo and kde 4.4.1 with gcc-4.3.4 This happens if I try to view a mail in my spam folder (tagged as spam from spamassassin) I can provide said mail if desired.
Martin, please provide the message. Then I'll test if it crashes on my system, too.
*** This bug has been marked as a duplicate of bug 186502 ***