[KDE/Mac] kmail crash reading this list

["René J.V. Bertin"]

Hi guys,

You may remember I mentioned crashing issues I was having with kmail2 under OS X. I'm keeping a tab on those, and today I got a bit of a better idea where they occur. Here's a traceback, made on 10.9.4 (for once I'm running that natively :)):

{{{
Process 64672 stopped
* thread #1: tid = 0xc4fbf, 0x00000001026ce0e9 QtGui`QWidgetPrivate::invalidateBuffer_resizeHelper(QPoint const&, QSize const&) + 665, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
    frame #0: 0x00000001026ce0e9 QtGui`QWidgetPrivate::invalidateBuffer_resizeHelper(QPoint const&, QSize const&) + 665
QtGui`QWidgetPrivate::invalidateBuffer_resizeHelper(QPoint const&, QSize const&) + 665:
-> 0x1026ce0e9:  movq   0x8(%rax), %rax
   0x1026ce0ed:  je     0x1026ce183               ; QWidgetPrivate::invalidateBuffer_resizeHelper(QPoint const&, QSize const&) + 819
   0x1026ce0f3:  movq   %rdx, -0x180(%rbp)
   0x1026ce0fa:  movq   %rcx, -0x178(%rbp)
(lldb) bt
* thread #1: tid = 0xc4fbf, 0x00000001026ce0e9 QtGui`QWidgetPrivate::invalidateBuffer_resizeHelper(QPoint const&, QSize const&) + 665, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
  * frame #0: 0x00000001026ce0e9 QtGui`QWidgetPrivate::invalidateBuffer_resizeHelper(QPoint const&, QSize const&) + 665
    frame #1: 0x000000010248d1e2 QtGui`QWidgetPrivate::setGeometry_sys_helper(int, int, int, int, bool) + 626
    frame #2: 0x000000010248cc4f QtGui`QWidgetPrivate::setGeometry_sys(int, int, int, int, bool) + 159
    frame #3: 0x000000010253cdc4 QtGui`QWidget::resize(QSize const&) + 68
    frame #4: 0x00000001024ccb63 QtGui`QMenuPrivate::QMacMenuPrivate::addAction(QMacMenuAction*, QMacMenuAction*, QMenuPrivate*) + 1555
    frame #5: 0x00000001028da137 QtGui`QMenu::actionEvent(QActionEvent*) + 807
    frame #6: 0x000000010253edfc QtGui`QWidget::event(QEvent*) + 252
    frame #7: 0x00000001028d83e5 QtGui`QMenu::event(QEvent*) + 773
    frame #8: 0x00000001024f079c QtGui`QApplicationPrivate::notify_helper(QObject*, QEvent*) + 252
    frame #9: 0x00000001024f3743 QtGui`QApplication::notify(QObject*, QEvent*) + 7107
    frame #10: 0x00000001031aff96 QtCore`QCoreApplication::notifyInternal(QObject*, QEvent*) + 118
    frame #11: 0x00000001025356ef QtGui`QWidget::insertAction(QAction*, QAction*) + 287
    frame #12: 0x0000000100203a2a libkdeui.5.dylib`KMenu::addTitle(this=<unavailable>, icon=<unavailable>, text=<unavailable>, before=<unavailable>) + 298 at kmenu.cpp:193
    frame #13: 0x00000001002038c5 libkdeui.5.dylib`KMenu::addTitle(this=<unavailable>, text=<unavailable>, before=<unavailable>) + 53 at kmenu.cpp:172
    frame #14: 0x0000000100c4864e libkmailprivate.4.dylib`KMail::MessageActions::updateMailingListActions(this=0x000000011248d970, messageItem=<unavailable>) + 574 at messageactions.cpp:392
    frame #15: 0x0000000100c47c85 libkmailprivate.4.dylib`KMail::MessageActions::updateActions(this=0x000000011248d970) + 725 at messageactions.cpp:327
    frame #16: 0x0000000100c48124 libkmailprivate.4.dylib`KMail::MessageActions::setCurrentMessage(this=0x000000011248d970, msg=<unavailable>, items=<unavailable>) + 500 at messageactions.cpp:266
    frame #17: 0x0000000100c1856d libkmailprivate.4.dylib`KMMainWidget::itemsReceived(this=<unavailable>, list=<unavailable>) + 429 at kmmainwidget.cpp:4520
    frame #18: 0x0000000100c07c11 libkmailprivate.4.dylib`KMMainWidget::qt_static_metacall(_o=0x000000010c4f61e0, _c=<unavailable>, _id=<unavailable>, _a=0x00007fff5fbfc870) + 3713 at kmmainwidget.moc:532
    frame #19: 0x00000001031c7e7d QtCore`QMetaObject::activate(QObject*, QMetaObject const*, int, void**) + 1693
    frame #20: 0x00000001019defd8 libakonadi-kde.4.dylib`Akonadi::ItemFetchJobPrivate::timeout() + 104
    frame #21: 0x00000001019ded1e libakonadi-kde.4.dylib`Akonadi::ItemFetchJob::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) + 78
    frame #22: 0x00000001031c7e7d QtCore`QMetaObject::activate(QObject*, QMetaObject const*, int, void**) + 1693
    frame #23: 0x00000001007553eb libkdecore.5.dylib`KJob::emitResult() [inlined] KJob::result(this=0x0000000113b42bf0, _t1=0x0000000113b42bf0, _t1=0x0000000113b42bf0) + 139 at kjob.moc:207
    frame #24: 0x00000001007553cc libkdecore.5.dylib`KJob::emitResult(this=0x0000000113b42bf0) + 108 at kjob.cpp:318
    frame #25: 0x00000001019f1631 libakonadi-kde.4.dylib`Akonadi::Job::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) + 321
    frame #26: 0x00000001031c399e QtCore`QObject::event(QEvent*) + 734
    frame #27: 0x00000001024f079c QtGui`QApplicationPrivate::notify_helper(QObject*, QEvent*) + 252
    frame #28: 0x00000001024f1ee0 QtGui`QApplication::notify(QObject*, QEvent*) + 864
    frame #29: 0x00000001031aff96 QtCore`QCoreApplication::notifyInternal(QObject*, QEvent*) + 118
    frame #30: 0x00000001031b0b52 QtCore`QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) + 770
    frame #31: 0x00007fff8c4c85b1 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
    frame #32: 0x00007fff8c4b9c62 CoreFoundation`__CFRunLoopDoSources0 + 242
    frame #33: 0x00007fff8c4b93ef CoreFoundation`__CFRunLoopRun + 831
    frame #34: 0x00007fff8c4b8e75 CoreFoundation`CFRunLoopRunSpecific + 309
    frame #35: 0x00007fff8be13a0d HIToolbox`RunCurrentEventLoopInMode + 226
    frame #36: 0x00007fff8be137b7 HIToolbox`ReceiveNextEventCommon + 479
    frame #37: 0x00007fff8be135bc HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 65
    frame #38: 0x00007fff8892f24e AppKit`_DPSNextEvent + 1434
    frame #39: 0x00007fff8892e89b AppKit`-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122
    frame #40: 0x00007fff8892299c AppKit`-[NSApplication run] + 553
    frame #41: 0x00000001024a47d0 QtGui`QEventDispatcherMac::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) + 528
    frame #42: 0x00000001031ad32d QtCore`QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) + 477
    frame #43: 0x00000001031b0547 QtCore`QCoreApplication::exec() + 199
    frame #44: 0x00000001000097cd kmail`main(argc=<unavailable>, argv=<unavailable>) + 2941 at main.cpp:146
}}}

In other words, the crash occurs when KMenu::addTitle calls its insertAction member function with the prepared QAction (and a NULL 'before' action, which apparently is perfectly acceptable), frame #12. I don't see anything wrong in the code leading to that call, and so the bug would be in Qt.

If so, the scope could be bigger than just kmail; anything trying to add a title to a menu could be concerned. Are there other examples of such use of KMenu::addTitle?

R.