From fc208ec1dfc58873b0b55786e418e51519eb388e Mon Sep 17 00:00:00 2001 From: Javier Date: Sun, 30 Aug 2026 16:57:59 +0200 Subject: [PATCH] fix: SIGSEGV on exit - double-free in EmailTreeModel::deleteTree deleteTree did qDeleteAll(children) AND delete item, but ~TreeItem already frees children recursively (qDeleteAll(children)). The children were freed twice -> heap-use-after-free -> SIGSEGV exactly on app teardown, only visible when mail threads had real tree children (empty DB masked it). Reproduced under ASAN with seeded thread data: old code = heap-use-after-free exit 1; fixed code = clean exit 0. Reproducible, not guessed. --- src/ui/models/EmailTreeModel.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/ui/models/EmailTreeModel.cpp b/src/ui/models/EmailTreeModel.cpp index f8a0881..69cd1c9 100644 --- a/src/ui/models/EmailTreeModel.cpp +++ b/src/ui/models/EmailTreeModel.cpp @@ -20,7 +20,9 @@ EmailTreeModel::~EmailTreeModel() void EmailTreeModel::deleteTree(TreeItem* item) { if (!item) return; - qDeleteAll(item->children); + // TreeItem::~TreeItem already deletes its children recursively (qDeleteAll(children)). + // Only delete the node itself — calling qDeleteAll(children) here first would + // double-free (the dtor frees them again) and SIGSEGV on teardown in debug builds. delete item; }