It's seems I'm able to reproduce this anytime by typing a couple of characters and then remove them using the 'backspace' key. The crash happens when I remove the last characters.

Created attachment 41630 [details]
New crash information added by DrKonqi

- What I was doing when the application crashed:

I had text into the typing area and I deleted it using the backspace key. The crash happens when I remove the last characters.

more recent backtrace

Application: Kopete (kopete), signal: Segmentation fault
The current source language is "auto; currently c".
[Current thread is 1 (Thread 0x7f53f9058750 (LWP 2500))]

Thread 3 (Thread 0x7f53df067910 (LWP 2587)):
#0  0x00007f53f2ca23c3 in *__GI___poll (fds=<value optimized out>, nfds=<value optimized out>, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:87
#1  0x00007f53ee70c37c in g_main_context_poll (context=0x292a470, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>)
    at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2904
#2  g_main_context_iterate (context=0x292a470, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2586
#3  0x00007f53ee70c6c0 in IA__g_main_context_iteration (context=0x292a470, may_block=1) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2654
#4  0x00007f53f507625a in QEventDispatcherGlib::processEvents (this=0x2c67ab0, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventdispatcher_glib.cpp:414
#5  0x00007f53f5036268 in QEventLoop::processEvents (this=0x28ee8b0, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventloop.cpp:149
#6  0x00007f53f50363be in QEventLoop::exec (this=0x28ee8b0, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventloop.cpp:201
#7  0x00007f53e0b889d3 in QCA::SyncThread::run (this=0x2b27be0) at /home/bruno/kdeqt/4.6/src/qt/qca2/src/support/syncthread.cpp:195
#8  0x00007f53f4f0cb6d in QThreadPrivate::start (arg=0x2b27be0) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/thread/qthread_unix.cpp:248
#9  0x00007f53f4c55a04 in start_thread (arg=<value optimized out>) at pthread_create.c:300
#10 0x00007f53f2cae80d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#11 0x0000000000000000 in ?? ()

Thread 2 (Thread 0x7f53de866910 (LWP 2588)):
#0  0x00007f53f2ca23c3 in *__GI___poll (fds=<value optimized out>, nfds=<value optimized out>, timeout=2930) at ../sysdeps/unix/sysv/linux/poll.c:87
#1  0x00007f53ee70c37c in g_main_context_poll (context=0x2916490, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>)
    at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2904
#2  g_main_context_iterate (context=0x2916490, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2586
#3  0x00007f53ee70c6c0 in IA__g_main_context_iteration (context=0x2916490, may_block=1) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2654
#4  0x00007f53f507625a in QEventDispatcherGlib::processEvents (this=0x28de130, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventdispatcher_glib.cpp:414
#5  0x00007f53f5036268 in QEventLoop::processEvents (this=0x2a9ae80, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventloop.cpp:149
#6  0x00007f53f50363be in QEventLoop::exec (this=0x2a9ae80, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventloop.cpp:201
#7  0x00007f53e0f61b67 in XMPP::SyncThread::run (this=0x2a9ae40) at /home/bruno/kde4/trunk/src/network/kdenetwork/kopete/protocols/jabber/libiris/iris/irisnet/corelib/netinterface.cpp:151
#8  0x00007f53f4f0cb6d in QThreadPrivate::start (arg=0x2a9ae40) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/thread/qthread_unix.cpp:248
#9  0x00007f53f4c55a04 in start_thread (arg=<value optimized out>) at pthread_create.c:300
#10 0x00007f53f2cae80d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#11 0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7f53f9058750 (LWP 2500)):
[KCrash Handler]
#6  0x00007f53f3ba48b5 in QListData::size (this=0x7f53f4f060e6) at ../../include/QtCore/../../../../../src/qt/qt/src/corelib/tools/qlist.h:90
#7  0x00007f53f3ef7072 in QList<QTextFrame*>::count (this=0x7f53f4f060e6) at ../../include/QtCore/../../../../../src/qt/qt/src/corelib/tools/qlist.h:261
#8  0x00007f53f3ef46b4 in QTextDocumentPrivate::clearFrame (f=0x7fff6863b050) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/text/qtextdocument_p.cpp:1370
#9  0x00007f53f3ef4729 in QTextDocumentPrivate::scan_frames (this=0x7fff6863af30, pos=34859156, charsRemoved=0, charsAdded=1751363872)
    at /home/bruno/kde4/trunk/src/qt/qt/src/gui/text/qtextdocument_p.cpp:1384
#10 0x00007f53f3ef39b0 in QTextDocumentPrivate::finishEdit (this=0x7fff6863af30) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/text/qtextdocument_p.cpp:1144
#11 0x00007f53f3f208ab in QTextCursorPrivate::remove (this=0x3260550) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/text/qtextcursor.cpp:174
#12 0x00007f53f3f2552b in QTextCursor::deletePreviousChar (this=0x31194f0) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/text/qtextcursor.cpp:1418
#13 0x00007f53f3ea1474 in QTextControlPrivate::keyPressEvent (this=0x3119450, e=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/text/qtextcontrol.cpp:1202
#14 0x00007f53f3e9fc7a in QTextControl::processEvent (this=0x311a860, e=0x7fff6863cc50, matrix=..., contextWidget=0x3122590) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/text/qtextcontrol.cpp:918
#15 0x00007f53f3e9fb10 in QTextControl::processEvent (this=0x311a860, e=0x7fff6863cc50, coordinateOffset=..., contextWidget=0x3122590)
    at /home/bruno/kde4/trunk/src/qt/qt/src/gui/text/qtextcontrol.cpp:880
#16 0x00007f53f419fcdb in QTextEditPrivate::sendControlEvent (this=0x363bf80, e=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/widgets/qtextedit_p.h:99
#17 0x00007f53f419ba76 in QTextEdit::keyPressEvent (this=0x3123490, e=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/widgets/qtextedit.cpp:1299
#18 0x00007f53f5b4eb4b in KTextEdit::keyPressEvent (this=0x3123490, event=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/KDE/kdelibs/kdeui/widgets/ktextedit.cpp:1064
#19 0x00007f53f5b3a46b in KRichTextEdit::keyPressEvent (this=0x3123490, event=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/KDE/kdelibs/kdeui/widgets/krichtextedit.cpp:482
#20 0x00007f53f3c2915c in QWidget::event (this=0x3123490, event=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qwidget.cpp:8033
#21 0x00007f53f4102daf in QFrame::event (this=0x3123490, e=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/widgets/qframe.cpp:557
#22 0x00007f53f41bb03c in QAbstractScrollArea::event (this=0x3123490, e=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/widgets/qabstractscrollarea.cpp:989
#23 0x00007f53f419ae6b in QTextEdit::event (this=0x3123490, e=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/widgets/qtextedit.cpp:1070
#24 0x00007f53e2b467e5 in KopeteRichTextWidget::event (this=0x3123490, event=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/network/kdenetwork/kopete/kopete/chatwindow/kopeterichtextwidget.cpp:458
#25 0x00007f53f3bb5912 in QApplicationPrivate::notify_helper (this=0x20e3450, receiver=0x3123490, e=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qapplication.cpp:4304
#26 0x00007f53f3bb31d6 in QApplication::notify (this=0x7fff6863dd20, receiver=0x3123490, e=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qapplication.cpp:3767
#27 0x00007f53f5a666ae in KApplication::notify (this=0x7fff6863dd20, receiver=0x3123490, event=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/KDE/kdelibs/kdeui/kernel/kapplication.cpp:302
#28 0x00007f53f5039270 in QCoreApplication::notifyInternal (this=0x7fff6863dd20, receiver=0x3123490, event=0x7fff6863cc50)
    at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qcoreapplication.cpp:704
#29 0x00007f53f6eea64f in QCoreApplication::sendSpontaneousEvent(QObject*, QEvent*) () from /kdeqt/4.6/lib/libQt3Support.so.4
#30 0x00007f53f3bb5c63 in qt_sendSpontaneousEvent (receiver=0x3123490, event=0x7fff6863cc50) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qapplication.cpp:5283
#31 0x00007f53f3c9b4a4 in QKeyMapper::sendKeyEvent (keyWidget=0x3123490, grab=false, type=QEvent::KeyPress, code=16777219, modifiers=..., text=..., autorepeat=false, count=1, nativeScanCode=22, 
    nativeVirtualKey=65288, nativeModifiers=16) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qkeymapper_x11.cpp:1861
#32 0x00007f53f3c9b184 in QKeyMapperPrivate::translateKeyEvent (this=0x212d910, keyWidget=0x3123490, event=0x7fff6863d8b0, grab=false)
    at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qkeymapper_x11.cpp:1831
#33 0x00007f53f3c61290 in QApplication::x11ProcessEvent (this=0x7fff6863dd20, event=0x7fff6863d8b0) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qapplication_x11.cpp:3394
#34 0x00007f53f3c9d681 in x11EventSourceDispatch (s=0x20e6fd0, callback=0, user_data=0x0) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qguieventdispatcher_glib.cpp:146
#35 0x00007f53ee708bce in g_main_dispatch (context=0x20e5cc0) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:1960
#36 IA__g_main_context_dispatch (context=0x20e5cc0) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2513
#37 0x00007f53ee70c598 in g_main_context_iterate (context=0x20e5cc0, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>)
    at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2591
#38 0x00007f53ee70c6c0 in IA__g_main_context_iteration (context=0x20e5cc0, may_block=1) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2654
#39 0x00007f53f5076237 in QEventDispatcherGlib::processEvents (this=0x209e800, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventdispatcher_glib.cpp:412
#40 0x00007f53f3c9dda4 in QGuiEventDispatcherGlib::processEvents (this=0x209e800, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qguieventdispatcher_glib.cpp:204
#41 0x00007f53f5036268 in QEventLoop::processEvents (this=0x7fff6863dc80, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventloop.cpp:149
#42 0x00007f53f50363be in QEventLoop::exec (this=0x7fff6863dc80, flags=...) at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qeventloop.cpp:201
#43 0x00007f53f5039972 in QCoreApplication::exec () at /home/bruno/kde4/trunk/src/qt/qt/src/corelib/kernel/qcoreapplication.cpp:981
#44 0x00007f53f3bb29b0 in QApplication::exec () at /home/bruno/kde4/trunk/src/qt/qt/src/gui/kernel/qapplication.cpp:3583
#45 0x00000000004152d6 in main (argc=<value optimized out>, argv=<value optimized out>) at /home/bruno/kde4/trunk/src/network/kdenetwork/kopete/kopete/main.cpp:105

I can confirm this bug (currently using r1108114), and frankly it's quite annoying, because backspacing the last char is something I seem to do frequently and undeliberately, so for some weeks now, Kopete crashes quite a lot on me ;)

I haven't had time to bisect the revision yet, but it didn't happen on my KDE rebuild in late January, but after the next build which was somewhere around February 20., iirc.

Interesting side note: Kopete doesn't crash if I clear the text field by some other means (e.g. deleting the last character with the Delete key, deleting the last word with Ctrl+Backspace, etc.), only by using Backspace on the last character.

Created attachment 42906 [details]
New crash information added by DrKonqi

I can confirm this happens every time when I delete the last character in the chat window. Happens with formatting on and also with formatting off.

Still happens in r1122678 (kdelibs revision 1122567).

By now I'm getting used to pressing Ctrl-Backspace whenever I'm going to delete something in Kopete, on the otherhand, it every time scares the hell out of me when I inattentively backspace-delete the last character in the input field of other applications. Please fix this ;)


Backtrace:

Application: Kopete (kopete), signal: Segmentation fault
Traceback (most recent call last):

[Current thread is 1 (Thread 0x7f1165b8e760 (LWP 31938))]

Thread 3 (Thread 0x7f114b8a4710 (LWP 32023)):
#0  0x00007f11619b72f5 in pthread_mutex_lock () from /lib/libpthread.so.0
#1  0x00007f115d4f271c in IA__g_main_context_prepare (context=0x102d2b0, priority=<value optimized out>) at gmain.c:2282
#2  0x00007f115d4f2ac1 in g_main_context_iterate (context=0x102d2b0, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2571
#3  0x00007f115d4f2ff0 in IA__g_main_context_iteration (context=0x102d2b0, may_block=1) at gmain.c:2654
#4  0x00007f1161d60406 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#5  0x00007f1161d35972 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#6  0x00007f1161d35d44 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#7  0x00007f114dcf203b in QCA::SyncThread::run() () from /usr/lib64/qca2/libqca.so.2
#8  0x00007f1161c442a5 in ?? () from /usr/lib64/qt4/libQtCore.so.4
#9  0x00007f11619b4b74 in start_thread () from /lib/libpthread.so.0
#10 0x00007f115fe0f31d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Thread 2 (Thread 0x7f114b0a3710 (LWP 32024)):
#0  0x00007f115fe05973 in poll () from /lib/libc.so.6
#1  0x00007f115d4f2cac in g_main_context_poll (context=0x12764d0, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2904
#2  g_main_context_iterate (context=0x12764d0, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2586
#3  0x00007f115d4f2ff0 in IA__g_main_context_iteration (context=0x12764d0, may_block=1) at gmain.c:2654
#4  0x00007f1161d60406 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#5  0x00007f1161d35972 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#6  0x00007f1161d35d44 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#7  0x00007f114e13dc62 in XMPP::SyncThread::run (this=0x12058c0) at /var/tmp/portage/kde-base/kopete-9999/work/kopete-9999/kopete/protocols/jabber/libiris/iris/irisnet/corelib/netinterface.cpp:151
#8  0x00007f1161c442a5 in ?? () from /usr/lib64/qt4/libQtCore.so.4
#9  0x00007f11619b4b74 in start_thread () from /lib/libpthread.so.0
#10 0x00007f115fe0f31d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Thread 1 (Thread 0x7f1165b8e760 (LWP 31938)):
[KCrash Handler]
#6  0x0000000000000060 in ?? ()
#7  0x00007f1160ee1c8a in QTextDocumentPrivate::finishEdit (this=0x7fff8bc49910) at text/qtextdocument_p.cpp:1152
#8  0x00007f1160f07237 in QTextCursorPrivate::remove (this=0x1e78f50) at text/qtextcursor.cpp:174
#9  0x00007f1160f0d23c in QTextCursor::deletePreviousChar (this=0x2344e80) at text/qtextcursor.cpp:1418
#10 0x00007f1160eab1da in QTextControlPrivate::keyPressEvent (this=0x2344de0, e=0x7fff8bc4b010) at text/qtextcontrol.cpp:1202
#11 0x00007f1160eaeaac in QTextControl::processEvent (this=0x12cb220, e=0x7fff8bc4b010, matrix=..., contextWidget=0x21b9c20) at text/qtextcontrol.cpp:918
#12 0x00007f1160ea4cda in QTextControl::processEvent (this=0x12cb220, e=0x7fff8bc4b010, coordinateOffset=..., contextWidget=0x21b9c20) at text/qtextcontrol.cpp:880
#13 0x00007f11610ceb2c in QTextEditPrivate::sendControlEvent (this=0x2425ce0, e=0x7fff8bc4b010) at widgets/qtextedit_p.h:99
#14 0x00007f11610ce26d in QTextEdit::keyPressEvent (this=<value optimized out>, e=0x7fff8bc4b010) at widgets/qtextedit.cpp:1299
#15 0x00007f116281d70b in KRichTextEdit::keyPressEvent (this=0x1ef1340, event=0x7fff8bc4b010) at /var/tmp/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kdeui/widgets/krichtextedit.cpp:464
#16 0x00007f1160cb69dd in QWidget::event (this=0x1ef1340, event=0x7fff8bc4b010) at kernel/qwidget.cpp:8033
#17 0x00007f1161057ea6 in QFrame::event (this=0x1ef1340, e=0x7fff8bc4b010) at widgets/qframe.cpp:557
#18 0x00007f11610e2deb in QAbstractScrollArea::event (this=0x1ef1340, e=0x7fff8bc4b010) at widgets/qabstractscrollarea.cpp:989
#19 0x00007f11610ce3e5 in QTextEdit::event (this=0x1ef1340, e=0x7fff8bc4b010) at widgets/qtextedit.cpp:1070
#20 0x00007f11500c58fd in KopeteRichTextWidget::event (this=0x1ef1340, event=0x7fff8bc4b010)
    at /var/tmp/portage/kde-base/kopete-9999/work/kopete-9999/kopete/kopete/chatwindow/kopeterichtextwidget.cpp:458
#21 0x00007f1160c60c3c in QApplicationPrivate::notify_helper (this=0xba9850, receiver=0x1ef1340, e=0x7fff8bc4b010) at kernel/qapplication.cpp:4300
#22 0x00007f1160c68a28 in QApplication::notify (this=<value optimized out>, receiver=0x1ef1340, e=0x7fff8bc4b010) at kernel/qapplication.cpp:3763
#23 0x00007f1162733486 in KApplication::notify (this=0x7fff8bc4bf90, receiver=0x1ef1340, event=0x7fff8bc4b010)
    at /var/tmp/portage/kde-base/kdelibs-9999/work/kdelibs-9999/kdeui/kernel/kapplication.cpp:302
#24 0x00007f1161d3701b in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib64/qt4/libQtCore.so.4
#25 0x00007f1160d09fba in QKeyMapper::sendKeyEvent (keyWidget=0x1ef1340, grab=<value optimized out>, type=QEvent::KeyPress, code=16777219, modifiers=<value optimized out>, text=..., autorepeat=
    false, count=1, nativeScanCode=22, nativeVirtualKey=65288, nativeModifiers=0) at kernel/qkeymapper_x11.cpp:1861
#26 0x00007f1160d0c4f1 in QKeyMapperPrivate::translateKeyEvent (this=0xbe5630, keyWidget=0x1ef1340, event=<value optimized out>, grab=224) at kernel/qkeymapper_x11.cpp:1831
#27 0x00007f1160ce53a4 in QApplication::x11ProcessEvent (this=<value optimized out>, event=0x7fff8bc4bbc0) at kernel/qapplication_x11.cpp:3394
#28 0x00007f1160d0f672 in x11EventSourceDispatch (s=0xbad170, callback=<value optimized out>, user_data=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:146
#29 0x00007f115d4ef50d in g_main_dispatch (context=0xbac120) at gmain.c:1960
#30 IA__g_main_context_dispatch (context=0xbac120) at gmain.c:2513
#31 0x00007f115d4f2ec8 in g_main_context_iterate (context=0xbac120, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591
#32 0x00007f115d4f2ff0 in IA__g_main_context_iteration (context=0xbac120, may_block=1) at gmain.c:2654
#33 0x00007f1161d603b3 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#34 0x00007f1160d0f26e in QGuiEventDispatcherGlib::processEvents (this=0x7fff8bc49ab0, flags=<value optimized out>) at kernel/qguieventdispatcher_glib.cpp:204
#35 0x00007f1161d35972 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#36 0x00007f1161d35d44 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib64/qt4/libQtCore.so.4
#37 0x00007f1161d39a2b in QCoreApplication::exec() () from /usr/lib64/qt4/libQtCore.so.4
#38 0x0000000000416172 in main (argc=<value optimized out>, argv=<value optimized out>) at /var/tmp/portage/kde-base/kopete-9999/work/kopete-9999/kopete/kopete/main.cpp:105

Created attachment 43372 [details]
New crash information added by DrKonqi

kopete (1.0.80) on KDE Platform 4.4.75 (KDE 4.4.75 (KDE 4.5 >= 20100505)) using Qt 4.6.2

Same as above - crashes when deleting characters when chatting with WLM.

-- Backtrace (Reduced):
#6  0x00007f7ed8b02826 in QListData::size (f=0x1dd2e00) at ../../include/QtCore/../../src/corelib/tools/qlist.h:90
#7  QList<QTextFrame*>::count (f=0x1dd2e00) at ../../include/QtCore/../../src/corelib/tools/qlist.h:261
#8  QTextDocumentPrivate::clearFrame (f=0x1dd2e00) at text/qtextdocument_p.cpp:1370
#9  0x00007f7ed8b029d8 in QTextDocumentPrivate::scan_frames (this=0x7fff31f5f5d0, pos=<value optimized out>, charsRemoved=<value optimized out>, charsAdded=<value optimized out>)
    at text/qtextdocument_p.cpp:1384
#10 0x00007f7ed8b04e6f in QTextDocumentPrivate::finishEdit (this=0x1dd2e00) at text/qtextdocument_p.cpp:1144

When running Kopete under valgrind, backspacing over the last character doesn't crash it, but this comes up in the log:

==11739== Invalid read of size 4
==11739==    at 0x970758D: QTextCursorPrivate::remove() (qtextcursor.cpp:173)
==11739==    by 0x970BAFB: QTextCursor::deletePreviousChar() (qtextcursor.cpp:1418)
==11739==    by 0x96AB0F9: QTextControlPrivate::keyPressEvent(QKeyEvent*) (qtextcontrol.cpp:1202)
==11739==    by 0x96AE86B: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:918)
==11739==    by 0x96A4A59: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:880)
==11739==    by 0x98D0CAB: QTextEditPrivate::sendControlEvent(QEvent*) (qtextedit_p.h:99)
==11739==    by 0x98D03FC: QTextEdit::keyPressEvent(QKeyEvent*) (qtextedit.cpp:1299)
==11739==    by 0x811F739: KTextEdit::keyPressEvent(QKeyEvent*) (ktextedit.cpp:1064)
==11739==    by 0x81068B1: KRichTextEdit::keyPressEvent(QKeyEvent*) (krichtextedit.cpp:464)
==11739==    by 0x94B4A0D: QWidget::event(QEvent*) (qwidget.cpp:8033)
==11739==    by 0x9859C85: QFrame::event(QEvent*) (qframe.cpp:557)
==11739==    by 0x98E51CA: QAbstractScrollArea::event(QEvent*) (qabstractscrollarea.cpp:989)
==11739==  Address 0x1bb79518 is 24 bytes inside a block of size 48 free'd
==11739==    at 0x4C2372A: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11739==    by 0x96E1DF5: QTextDocumentPrivate::finishEdit() (qtextdocument_p.cpp:1170)
==11739==    by 0x96E30A7: QTextDocumentPrivate::move(int, int, int, QTextUndoCommand::Operation) (qtextdocument_p.cpp:665)
==11739==    by 0x970758C: QTextCursorPrivate::remove() (qtextcursor.cpp:172)
==11739==    by 0x970BAFB: QTextCursor::deletePreviousChar() (qtextcursor.cpp:1418)
==11739==    by 0x96AB0F9: QTextControlPrivate::keyPressEvent(QKeyEvent*) (qtextcontrol.cpp:1202)
==11739==    by 0x96AE86B: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:918)
==11739==    by 0x96A4A59: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:880)
==11739==    by 0x98D0CAB: QTextEditPrivate::sendControlEvent(QEvent*) (qtextedit_p.h:99)
==11739==    by 0x98D03FC: QTextEdit::keyPressEvent(QKeyEvent*) (qtextedit.cpp:1299)
==11739==    by 0x811F739: KTextEdit::keyPressEvent(QKeyEvent*) (ktextedit.cpp:1064)
==11739==    by 0x81068B1: KRichTextEdit::keyPressEvent(QKeyEvent*) (krichtextedit.cpp:464)
==11739== 
==11739== Invalid read of size 8
==11739==    at 0x9707590: QTextCursorPrivate::remove() (qtextcursor.cpp:174)
==11739==    by 0x970BAFB: QTextCursor::deletePreviousChar() (qtextcursor.cpp:1418)
==11739==    by 0x96AB0F9: QTextControlPrivate::keyPressEvent(QKeyEvent*) (qtextcontrol.cpp:1202)
==11739==    by 0x96AE86B: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:918)
==11739==    by 0x96A4A59: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:880)
==11739==    by 0x98D0CAB: QTextEditPrivate::sendControlEvent(QEvent*) (qtextedit_p.h:99)
==11739==    by 0x98D03FC: QTextEdit::keyPressEvent(QKeyEvent*) (qtextedit.cpp:1299)
==11739==    by 0x811F739: KTextEdit::keyPressEvent(QKeyEvent*) (ktextedit.cpp:1064)
==11739==    by 0x81068B1: KRichTextEdit::keyPressEvent(QKeyEvent*) (krichtextedit.cpp:464)
==11739==    by 0x94B4A0D: QWidget::event(QEvent*) (qwidget.cpp:8033)
==11739==    by 0x9859C85: QFrame::event(QEvent*) (qframe.cpp:557)
==11739==    by 0x98E51CA: QAbstractScrollArea::event(QEvent*) (qabstractscrollarea.cpp:989)
==11739==  Address 0x1bb79508 is 8 bytes inside a block of size 48 free'd
==11739==    at 0x4C2372A: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11739==    by 0x96E1DF5: QTextDocumentPrivate::finishEdit() (qtextdocument_p.cpp:1170)
==11739==    by 0x96E30A7: QTextDocumentPrivate::move(int, int, int, QTextUndoCommand::Operation) (qtextdocument_p.cpp:665)
==11739==    by 0x970758C: QTextCursorPrivate::remove() (qtextcursor.cpp:172)
==11739==    by 0x970BAFB: QTextCursor::deletePreviousChar() (qtextcursor.cpp:1418)
==11739==    by 0x96AB0F9: QTextControlPrivate::keyPressEvent(QKeyEvent*) (qtextcontrol.cpp:1202)
==11739==    by 0x96AE86B: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:918)
==11739==    by 0x96A4A59: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:880)
==11739==    by 0x98D0CAB: QTextEditPrivate::sendControlEvent(QEvent*) (qtextedit_p.h:99)
==11739==    by 0x98D03FC: QTextEdit::keyPressEvent(QKeyEvent*) (qtextedit.cpp:1299)
==11739==    by 0x811F739: KTextEdit::keyPressEvent(QKeyEvent*) (ktextedit.cpp:1064)
==11739==    by 0x81068B1: KRichTextEdit::keyPressEvent(QKeyEvent*) (krichtextedit.cpp:464)
==11739== 
==11739== Invalid write of size 4
==11739==    at 0x9707594: QTextCursorPrivate::remove() (qtextcursor.cpp:173)
==11739==    by 0x970BAFB: QTextCursor::deletePreviousChar() (qtextcursor.cpp:1418)
==11739==    by 0x96AB0F9: QTextControlPrivate::keyPressEvent(QKeyEvent*) (qtextcontrol.cpp:1202)
==11739==    by 0x96AE86B: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:918)
==11739==    by 0x96A4A59: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:880)
==11739==    by 0x98D0CAB: QTextEditPrivate::sendControlEvent(QEvent*) (qtextedit_p.h:99)
==11739==    by 0x98D03FC: QTextEdit::keyPressEvent(QKeyEvent*) (qtextedit.cpp:1299)
==11739==    by 0x811F739: KTextEdit::keyPressEvent(QKeyEvent*) (ktextedit.cpp:1064)
==11739==    by 0x81068B1: KRichTextEdit::keyPressEvent(QKeyEvent*) (krichtextedit.cpp:464)
==11739==    by 0x94B4A0D: QWidget::event(QEvent*) (qwidget.cpp:8033)
==11739==    by 0x9859C85: QFrame::event(QEvent*) (qframe.cpp:557)
==11739==    by 0x98E51CA: QAbstractScrollArea::event(QEvent*) (qabstractscrollarea.cpp:989)
==11739==  Address 0x1bb7951c is 28 bytes inside a block of size 48 free'd
==11739==    at 0x4C2372A: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11739==    by 0x96E1DF5: QTextDocumentPrivate::finishEdit() (qtextdocument_p.cpp:1170)
==11739==    by 0x96E30A7: QTextDocumentPrivate::move(int, int, int, QTextUndoCommand::Operation) (qtextdocument_p.cpp:665)
==11739==    by 0x970758C: QTextCursorPrivate::remove() (qtextcursor.cpp:172)
==11739==    by 0x970BAFB: QTextCursor::deletePreviousChar() (qtextcursor.cpp:1418)
==11739==    by 0x96AB0F9: QTextControlPrivate::keyPressEvent(QKeyEvent*) (qtextcontrol.cpp:1202)
==11739==    by 0x96AE86B: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:918)
==11739==    by 0x96A4A59: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:880)
==11739==    by 0x98D0CAB: QTextEditPrivate::sendControlEvent(QEvent*) (qtextedit_p.h:99)
==11739==    by 0x98D03FC: QTextEdit::keyPressEvent(QKeyEvent*) (qtextedit.cpp:1299)
==11739==    by 0x811F739: KTextEdit::keyPressEvent(QKeyEvent*) (ktextedit.cpp:1064)
==11739==    by 0x81068B1: KRichTextEdit::keyPressEvent(QKeyEvent*) (krichtextedit.cpp:464)
==11739== 
==11739== Invalid write of size 4
==11739==    at 0x9707597: QTextCursorPrivate::remove() (qtextcursor.cpp:173)
==11739==    by 0x970BAFB: QTextCursor::deletePreviousChar() (qtextcursor.cpp:1418)
==11739==    by 0x96AB0F9: QTextControlPrivate::keyPressEvent(QKeyEvent*) (qtextcontrol.cpp:1202)
==11739==    by 0x96AE86B: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:918)
==11739==    by 0x96A4A59: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:880)
==11739==    by 0x98D0CAB: QTextEditPrivate::sendControlEvent(QEvent*) (qtextedit_p.h:99)
==11739==    by 0x98D03FC: QTextEdit::keyPressEvent(QKeyEvent*) (qtextedit.cpp:1299)
==11739==    by 0x811F739: KTextEdit::keyPressEvent(QKeyEvent*) (ktextedit.cpp:1064)
==11739==    by 0x81068B1: KRichTextEdit::keyPressEvent(QKeyEvent*) (krichtextedit.cpp:464)
==11739==    by 0x94B4A0D: QWidget::event(QEvent*) (qwidget.cpp:8033)
==11739==    by 0x9859C85: QFrame::event(QEvent*) (qframe.cpp:557)
==11739==    by 0x98E51CA: QAbstractScrollArea::event(QEvent*) (qabstractscrollarea.cpp:989)
==11739==  Address 0x1bb79520 is 32 bytes inside a block of size 48 free'd
==11739==    at 0x4C2372A: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11739==    by 0x96E1DF5: QTextDocumentPrivate::finishEdit() (qtextdocument_p.cpp:1170)
==11739==    by 0x96E30A7: QTextDocumentPrivate::move(int, int, int, QTextUndoCommand::Operation) (qtextdocument_p.cpp:665)
==11739==    by 0x970758C: QTextCursorPrivate::remove() (qtextcursor.cpp:172)
==11739==    by 0x970BAFB: QTextCursor::deletePreviousChar() (qtextcursor.cpp:1418)
==11739==    by 0x96AB0F9: QTextControlPrivate::keyPressEvent(QKeyEvent*) (qtextcontrol.cpp:1202)
==11739==    by 0x96AE86B: QTextControl::processEvent(QEvent*, QMatrix const&, QWidget*) (qtextcontrol.cpp:918)
==11739==    by 0x96A4A59: QTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qtextcontrol.cpp:880)
==11739==    by 0x98D0CAB: QTextEditPrivate::sendControlEvent(QEvent*) (qtextedit_p.h:99)
==11739==    by 0x98D03FC: QTextEdit::keyPressEvent(QKeyEvent*) (qtextedit.cpp:1299)
==11739==    by 0x811F739: KTextEdit::keyPressEvent(QKeyEvent*) (ktextedit.cpp:1064)
==11739==    by 0x81068B1: KRichTextEdit::keyPressEvent(QKeyEvent*) (krichtextedit.cpp:464)
==11739==

I'm pretty sure there's some stack corruption happening in a slot connected (possibly indirectly) to QTextDocument::cursorPositionChanged(QCursor).  Need to build my own Qt to debug properly, I think, though.

And it seems to be a kdelibs bug - kopete from 4.4 with libs from 4.4 works fine.  Kopete from 4.4 with libs from trunk crashes.  But just reverting kdelibs/kdeui/widgets/krichtext* and kdelibs/kdeui/widgets/ktextedit* back to before the 4.4 branching (r1047622) doesn't fix it.

It's r1095227 that's causing the crash (a change in spellcheck highlighting).

CC'ing tmcguire, since it was his commit that caused this.

Thanks a lot Alex for figuring this out!

Consequently, deactivating spell checking serves as a workaround for this bug. Should've tried that sooner :)

I tried reproducing this bug by running ktextedittest from kdelibs/kdeui (and enabling spellchecking in the context menu), but no problem so far. The test does not crash and valgrind doesn't complain. Same result with KMail's composer.

I'm afraid I can't do anything about this without reproducing the bug.

Alex, does ktextedittest work for you? Maybe this bug only appears in combination with Kopete for some reason?
If you can't fix the bug, please revert this commit.

No, I can't reproduce it outside Kopete, even using KopeteRichTextWidget.  I've no idea what interaction with Kopete is triggering/causing this bug, so I'll just revert the commit.

SVN commit 1124727 by alexmerry:

Revert r1095227, which causes Kopete to crash in some weird way.

BUG: 229201



 M  +3 -56     highlighter.cpp  
 M  +0 -1      highlighter.h  


WebSVN link: http://websvn.kde.org/?view=rev&revision=1124727