fix: SIGSEGV on exit - double-free in EmailTreeModel::deleteTree

deleteTree did qDeleteAll(children) AND delete item, but ~TreeItem already
frees children recursively (qDeleteAll(children)). The children were freed
twice -> heap-use-after-free -> SIGSEGV exactly on app teardown, only
visible when mail threads had real tree children (empty DB masked it).

Reproduced under ASAN with seeded thread data: old code = heap-use-after-free
exit 1; fixed code = clean exit 0. Reproducible, not guessed.
This commit is contained in:
2026-08-30 16:57:59 +02:00
parent dabfb1e659
commit fc208ec1df
+3 -1
View File
@@ -20,7 +20,9 @@ EmailTreeModel::~EmailTreeModel()
void EmailTreeModel::deleteTree(TreeItem* item) void EmailTreeModel::deleteTree(TreeItem* item)
{ {
if (!item) return; if (!item) return;
qDeleteAll(item->children); // TreeItem::~TreeItem already deletes its children recursively (qDeleteAll(children)).
// Only delete the node itself — calling qDeleteAll(children) here first would
// double-free (the dtor frees them again) and SIGSEGV on teardown in debug builds.
delete item; delete item;
} }