https://bugs.kde.org/show_bug.cgi?id=522751
Bug ID: 522751
Summary: Heap corruption (corrupted size vs. prev_size) on exit
in MessagePartRendererManager destructor via
QJSEngine/GrantleeTheme teardown
Classification: Applications
Product: kontact
Version First 6.7.3
Reported In:
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: contacts
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 194097
--> https://bugs.kde.org/attachment.cgi?id=194097&action=edit
kontact-bt
SUMMARY
Kontact/KMail reliably crashes with SIGABRT on every exit. glibc reports
"corrupted size vs. prev_size while consolidating" during static/global
destructor teardown. The crash originates in messagelib's
MessagePartRendererManager destructor, which tears down a GrantleeTheme
engine and its embedded QJSEngine; the heap corruption is detected while
freeing a QV4::ExecutableCompilationUnit.
The crash is unrelated to Akonadi resources or account data
(akonadictl fsck reports the database is clean). It happens purely in the
HTML message rendering layer during process exit.
STEPS TO REPRODUCE
1. Start Kontact (or KMail) and view at least one HTML mail so the
message renderer is initialized.
2. Quit the application.
OBSERVED RESULT
Process aborts on exit (signal 6). Log shows:
corrupted size vs. prev_size while consolidating
*** KMail got signal 6 (Exiting)
Preceding warnings:
<addr> deleted without having been removed from the factory first.
This will leak standalone popupmenus and could lead to crashes.
Crash thread backtrace (symbolized, via eu-stack):
#6 abort
#7 __libc_message_impl.cold
#8 malloc_printerr
#9 _int_free_merge_chunk
#10 _int_free_chunk
#11 QV4::ExecutableCompilationUnit::~ExecutableCompilationUnit()
#12 QV4::ExecutionEngine::~ExecutionEngine()
#13 QJSEnginePrivate::~QJSEnginePrivate()
#15 QJSEngine::~QJSEngine()
#16 QObjectPrivate::deleteChildren()
#18 KTextTemplate::ScriptableTagLibrary::~ScriptableTagLibrary()
#19 QObjectPrivate::deleteChildren()
#21 GrantleeTheme::Engine::~Engine()
#22
MessageViewer::MessagePartRendererManager::~MessagePartRendererManager()
#23 __run_exit_handlers
#24 exit
EXPECTED RESULT
Clean exit with no crash.
SOFTWARE/OS VERSIONS
Kontact: 6.7.3 (26.04.3)
messagelib: 26.04.3
OS: Fedora Linux 44 (KDE Plasma 6, Wayland)
Qt: <fill from `qmake6 -query QT_VERSION` or About dialog>
KDE Frameworks: <fill from About dialog>
ADDITIONAL INFORMATION
Reproducible on every exit. Full multi-thread backtrace attached
(eu-stack output). The .core file is not attached because it may contain
mail contents and credentials; symbolized stack only.
--
You are receiving this mail because:
You are watching all bug changes.
