Bug 410290

Created attachment 121778 [details]
drkonqi trace of segmentation fault when closing falkon

SUMMARY

I booted into Fedora 30 and rawhide/31 KDE Plasma spin and start Plasma on Wayland. I started falkon 3.1.0-1, and in Preferences>Browsing>Local storage I set Allow storing network cache on disk, Allowing saving history, Allow local storage of HTML5 web content to off. I selected OK. I set View>Toolbars>Menu bar to on. I closed falkon. drkonqi showed that a segmentation fault had occurred in  in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4 with the following trace in the crashing thread 1 which occurred in rawhide. falkon might have been clearing the history which I set to not be saved given the History::clearHistory function (this=0x0) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/history/history.cpp:255 in #9 of the crashing thread.

Thread 1 (Thread 0x7fe2cb117800 (LWP 17899)):
[KCrash Handler]
#6  qGetPtrHelper<QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> > > (ptr=...) at ../../include/QtCore/../../src/corelib/global/qglobal.h:1038
#7  QObject::d_func (this=0x0) at kernel/qobject.h:121
#8  QMetaObject::activate (sender=0x0, signalOffset=3, local_signal_index=3, argv=0x0) at kernel/qobject.cpp:3664
#9  0x00007fe2cc74f962 in History::clearHistory (this=0x0) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/history/history.cpp:255
#10 0x00007fe2cc6f5ef9 in MainApplication::saveSettings (this=0x7ffc6ea63680) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/app/mainapplication.cpp:803
#11 0x00007fe2cbc60ea0 in QtPrivate::QSlotObjectBase::call (a=0x7ffc6ea63550, r=0x7ffc6ea63680, this=0x55edf42d6320) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:394
#12 QMetaObject::activate (sender=0x7ffc6ea63680, signalOffset=<optimized out>, local_signal_index=<optimized out>, argv=<optimized out>) at kernel/qobject.cpp:3781
#13 0x00007fe2cbc35edb in QCoreApplication::aboutToQuit (this=<optimized out>, _t1=...) at .moc/moc_qcoreapplication.cpp:253
#14 0x00007fe2cbc39ed1 in QCoreApplicationPrivate::execCleanup (this=0x55edf05ff2b0) at kernel/qcoreapplication_p.h:78
#15 0x00007fe2cbc3d71f in QCoreApplication::exec () at kernel/qcoreapplication.h:86
#16 0x000055edeec36ef9 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/main/main.cpp:155
[Inferior 1 (process 17899) detached]

I ran valgrind --log-file=/mnt/root/programs/kde/falkon/valgrind-falkon-f31-4.txt falkon & then I closed falkon. An invalid read and write were found in
wl_proxy_unref at wayland-client.c:229-230 after closing falkon which appear to be use-after-free errors.

==17976== Invalid read of size 4
==17976==    at 0x11C6FBB4: wl_proxy_unref (wayland-client.c:229)
==17976==    by 0x11C6FCB3: destroy_queued_closure (wayland-client.c:291)
==17976==    by 0x11C6FEC7: dispatch_event.isra.0 (wayland-client.c:1436)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==  Address 0x116ac0bc is 44 bytes inside a block of size 72 free'd
==17976==    at 0x4839A0C: free (vg_replace_malloc.c:540)
==17976==    by 0x120B1C14: destroy (wayland_pointer_p.h:63)
==17976==    by 0x120B1C14: KWayland::Client::Registry::Private::globalSync(void*, wl_callback*, unsigned int) (registry.cpp:539)
==17976==    by 0x11CC4AA7: ffi_call_unix64 (unix64.S:76)
==17976==    by 0x11CC42A3: ffi_call (ffi64.c:525)
==17976==    by 0x11C73606: wl_closure_invoke (connection.c:1014)
==17976==    by 0x11C6FF17: dispatch_event.isra.0 (wayland-client.c:1430)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==  Block was alloc'd at
==17976==    at 0x483AB1A: calloc (vg_replace_malloc.c:762)
==17976==    by 0x11C6FD42: UnknownInlinedFun (wayland-private.h:236)
==17976==    by 0x11C6FD42: proxy_create.isra.0 (wayland-client.c:421)
==17976==    by 0x11C7042B: create_outgoing_proxy (wayland-client.c:650)
==17976==    by 0x11C7042B: wl_proxy_marshal_array_constructor_versioned (wayland-client.c:735)
==17976==    by 0x11C70782: wl_proxy_marshal_constructor (wayland-client.c:824)
==17976==    by 0x120B20BD: wl_display_sync (wayland-client-protocol.h:958)
==17976==    by 0x120B20BD: KWayland::Client::Registry::create(wl_display*) (registry.cpp:470)
==17976==    by 0x120B213A: KWayland::Client::Registry::create(KWayland::Client::ConnectionThread*) (registry.cpp:479)
==17976==    by 0x11D06E6D: KWaylandIntegration::init() (kwaylandintegration.cpp:55)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976== 
==17976== Invalid write of size 4
==17976==    at 0x11C6FBBE: wl_proxy_unref (wayland-client.c:230)
==17976==    by 0x11C6FCB3: destroy_queued_closure (wayland-client.c:291)
==17976==    by 0x11C6FEC7: dispatch_event.isra.0 (wayland-client.c:1436)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==  Address 0x116ac0bc is 44 bytes inside a block of size 72 free'd
==17976==    at 0x4839A0C: free (vg_replace_malloc.c:540)
==17976==    by 0x120B1C14: destroy (wayland_pointer_p.h:63)
==17976==    by 0x120B1C14: KWayland::Client::Registry::Private::globalSync(void*, wl_callback*, unsigned int) (registry.cpp:539)
==17976==    by 0x11CC4AA7: ffi_call_unix64 (unix64.S:76)
==17976==    by 0x11CC42A3: ffi_call (ffi64.c:525)
==17976==    by 0x11C73606: wl_closure_invoke (connection.c:1014)
==17976==    by 0x11C6FF17: dispatch_event.isra.0 (wayland-client.c:1430)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==  Block was alloc'd at
==17976==    at 0x483AB1A: calloc (vg_replace_malloc.c:762)
==17976==    by 0x11C6FD42: UnknownInlinedFun (wayland-private.h:236)
==17976==    by 0x11C6FD42: proxy_create.isra.0 (wayland-client.c:421)
==17976==    by 0x11C7042B: create_outgoing_proxy (wayland-client.c:650)
==17976==    by 0x11C7042B: wl_proxy_marshal_array_constructor_versioned (wayland-client.c:735)
==17976==    by 0x11C70782: wl_proxy_marshal_constructor (wayland-client.c:824)
==17976==    by 0x120B20BD: wl_display_sync (wayland-client-protocol.h:958)
==17976==    by 0x120B20BD: KWayland::Client::Registry::create(wl_display*) (registry.cpp:470)
==17976==    by 0x120B213A: KWayland::Client::Registry::create(KWayland::Client::ConnectionThread*) (registry.cpp:479)
==17976==    by 0x11D06E6D: KWaylandIntegration::init() (kwaylandintegration.cpp:55)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976== 

An ioctl system call pointed to the uninaccessible address 0x3d at syscall-template.S:78. The address might've been due to memory corruption.

==17976== Syscall param ioctl(generic) points to unaddressable byte(s)
==17976==    at 0x5B4B07B: ioctl (syscall-template.S:78)
==17976==    by 0x554EE42: QFileSystemEngine::cloneFile(int, int, QFileSystemMetaData const&) (qfilesystemengine_unix.cpp:1097)
==17976==    by 0x54F0C50: QFile::copy(QString const&) (qfile.cpp:813)
==17976==    by 0x54F1366: QFile::copy(QString const&, QString const&) (qfile.cpp:881)
==17976==    by 0x4AF31E6: SessionManager::backupSavedSessions() (sessionmanager.cpp:355)
==17976==    by 0x49C7DCB: MainApplication::MainApplication(int&, char**) (mainapplication.cpp:342)
==17976==    by 0x10BEC7: main (main.cpp:148)
==17976==  Address 0x3d is not stack'd, malloc'd or (recently) free'd


An invalid read was shown in qGetPtrHelper at qglobal.h:1038 at the inaccessible address 0x8 which looked like that of the crashing thread.
==17976== Invalid read of size 8
==17976==    at 0x55CB6EE: qGetPtrHelper<QScopedPointer<QObjectData> > (qglobal.h:1038)
==17976==    by 0x55CB6EE: d_func (qobject.h:121)
==17976==    by 0x55CB6EE: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3664)
==17976==    by 0x4A1A961: History::clearHistory() (history.cpp:255)
==17976==    by 0x49C0EF8: MainApplication::saveSettings() [clone .part.0] (mainapplication.cpp:803)
==17976==    by 0x55CBE9F: call (qobjectdefs_impl.h:394)
==17976==    by 0x55CBE9F: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3781)
==17976==    by 0x55A0EDA: QCoreApplication::aboutToQuit(QCoreApplication::QPrivateSignal) (moc_qcoreapplication.cpp:253)
==17976==    by 0x55A4ED0: QCoreApplicationPrivate::execCleanup() (qcoreapplication.cpp:1405)
==17976==    by 0x55A871E: QCoreApplication::exec() (qcoreapplication.cpp:1389)
==17976==    by 0x10BEF8: main (main.cpp:155)
==17976==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

Two invalid reads in socketNotifierSourceCheck at qeventdispatcher_glib.cpp:88 which looked like use-after-free errors occurred afterwards. The addresses were freed by QSocketNotifier::setEnabled at qsocketnotifier.cpp:246.

==17976== Thread 10 QDBusConnectionM:
==17976== Invalid read of size 2
==17976==    at 0x55F6A4A: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==    by 0x5B54332: clone (clone.S:95)
==17976==  Address 0x1e2c0446 is 6 bytes inside a block of size 16 free'd
==17976==    at 0x483A0D6: operator delete(void*, unsigned long) (vg_replace_malloc.c:595)
==17976==    by 0x55D8172: QSocketNotifier::setEnabled(bool) (qsocketnotifier.cpp:246)
==17976==    by 0x55F6A49: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==  Block was alloc'd at
==17976==    at 0x4838E86: operator new(unsigned long) (vg_replace_malloc.c:344)
==17976==    by 0x55F7166: QEventDispatcherGlib::registerSocketNotifier(QSocketNotifier*) (qeventdispatcher_glib.cpp:459)
==17976==    by 0x55D8074: QSocketNotifier::QSocketNotifier(long long, QSocketNotifier::Type, QObject*) (qsocketnotifier.cpp:155)
==17976==    by 0x6076A50: qDBusAddWatch (qdbusintegrator.cpp:213)
==17976==    by 0xE992829: _dbus_watch_list_set_functions (dbus-watch.c:321)
==17976==    by 0xE977A60: dbus_connection_set_watch_functions (dbus-connection.c:4966)
==17976==    by 0x60798D5: q_dbus_connection_set_watch_functions (qdbus_symbols_p.h:242)
==17976==    by 0x60798D5: QDBusConnectionPrivate::setConnection(DBusConnection*, QDBusErrorInternal const&) (qdbusintegrator.cpp:1795)
==17976==    by 0x606D38F: QDBusConnectionManager::executeConnectionRequest(QDBusConnectionManager::ConnectionRequestData*) (qdbusconnection.cpp:289)
==17976==    by 0x55CCBD9: QObject::event(QEvent*) (qobject.cpp:1260)
==17976==    by 0x55A1A44: doNotify(QObject*, QEvent*) (qcoreapplication.cpp:1174)
==17976==    by 0x55A1B50: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1083)
==17976==    by 0x55A4A7A: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1821)
==17976== 
==17976== Invalid read of size 2
==17976==    at 0x55F69C6: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:79)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==    by 0x5B54332: clone (clone.S:95)
==17976==  Address 0x1e2c0444 is 4 bytes inside a block of size 16 free'd
==17976==    at 0x483A0D6: operator delete(void*, unsigned long) (vg_replace_malloc.c:595)
==17976==    by 0x55D8172: QSocketNotifier::setEnabled(bool) (qsocketnotifier.cpp:246)
==17976==    by 0x55F6A49: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==  Block was alloc'd at
==17976==    at 0x4838E86: operator new(unsigned long) (vg_replace_malloc.c:344)
==17976==    by 0x55F7166: QEventDispatcherGlib::registerSocketNotifier(QSocketNotifier*) (qeventdispatcher_glib.cpp:459)
==17976==    by 0x55D8074: QSocketNotifier::QSocketNotifier(long long, QSocketNotifier::Type, QObject*) (qsocketnotifier.cpp:155)
==17976==    by 0x6076A50: qDBusAddWatch (qdbusintegrator.cpp:213)
==17976==    by 0xE992829: _dbus_watch_list_set_functions (dbus-watch.c:321)
==17976==    by 0xE977A60: dbus_connection_set_watch_functions (dbus-connection.c:4966)
==17976==    by 0x60798D5: q_dbus_connection_set_watch_functions (qdbus_symbols_p.h:242)
==17976==    by 0x60798D5: QDBusConnectionPrivate::setConnection(DBusConnection*, QDBusErrorInternal const&) (qdbusintegrator.cpp:1795)
==17976==    by 0x606D38F: QDBusConnectionManager::executeConnectionRequest(QDBusConnectionManager::ConnectionRequestData*) (qdbusconnection.cpp:289)
==17976==    by 0x55CCBD9: QObject::event(QEvent*) (qobject.cpp:1260)
==17976==    by 0x55A1A44: doNotify(QObject*, QEvent*) (qcoreapplication.cpp:1174)
==17976==    by 0x55A1B50: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1083)
==17976==    by 0x55A4A7A: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1821)
==17976== 

I've reproduced crashes with this trace twice in Fedora 30 and nine times in rawhide. The output above and attached were on rawhide with the following rpms
falkon-0:3.1.0-1.fc31.x86_64
dbus-1:1.12.16-1.fc31.x86_64
glib2-0:2.61.1-2.fc31.x86_64
glibc-0:2.29.9000-34.fc31.x86_64
kernel-0:5.3.0-0.rc1.git1.1.fc31.x86_64
kf5-kwayland-0:5.59.0-2.fc31.x86_64
mesa-dri-drivers-0:19.1.3-1.fc31.x86_64
plasma-desktop-0:5.16.2-1.fc31.x86_64
qt5-qtbase-0:5.12.4-5.fc31.x86_64
qt5-qtwebengine-0:5.12.4-5.fc31.x86_64

STEPS TO REPRODUCE
1. boot into the Fedora 30 KDE Plasma spin installation fully updated with updates-testing enabled
2. start Plasma on Wayland from sddm
3. started falkon 3.1.0-1
4. in Preferences>Browsing>Local storage, set Allow storing network cache on disk, Allowing saving history, Allow local storage of HTML5 web content to off. 5. selected OK. 
6. set View>Toolbars>Menu bar to on. 
7. close falkon

OBSERVED RESULT
Segmentation faults in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4 when closing falkon involving not saving history and showing the menu bar 

EXPECTED RESULT
No crashes would happen.

SOFTWARE/OS VERSIONS

Linux/KDE Plasma: Fedora 30 and rawhide
(available in About System)
KDE Plasma Version: 5.15.5 and 5.16.2
KDE Frameworks Version: 5.59.0
Qt Version: 5.12.4

ADDITIONAL INFORMATION

After starting falkon again after the crashes, in Preferences>Browsing>Local storage Delete locally stored HTML5 web content on close was set to on even though Allow local storage of HTML5 web content was set to off. This combination of settings didn't appear to be allowed before that point.

I've reported invalid reads and writes in wl_proxy_unref when closing the following KDE programs in Plasma on Wayland 
powerdevil https://bugs.kde.org/show_bug.cgi?id=408553
konsole https://bugs.kde.org/show_bug.cgi?id=408971
kwin_wayland https://bugs.kde.org/show_bug.cgi?id=409688
plasmashell https://bugs.kde.org/show_bug.cgi?id=409021