Bug 420817

Summary:	Kate crashed when closing terminal session
Product:	[Applications] kate	Reporter:	magiblot
Component:	general	Assignee:	KWrite Developers <kwrite-bugs-null>
Status:	RESOLVED FIXED
Severity:	crash	CC:	leocirto, wbauer1
Priority:	NOR	Keywords:	drkonqi
Version First Reported In:	20.04.0
Target Milestone:	---
Platform:	Arch Linux
OS:	Linux
Latest Commit:		Version Fixed/Implemented In:	20.04.2
Sentry Crash Report:

Description magiblot 2020-04-30 17:57:29 UTC

Application: kate (20.04.0)

Qt Version: 5.14.2
Frameworks Version: 5.69.0
Operating System: Linux 5.6.7-arch1-1 x86_64
Windowing system: X11
Distribution: "Arch Linux"

-- Information about the crash:
- What I was doing when the application crashed:
After a few hours of text editing and interacting with the terminal, Kate crashed when I ended the terminal session with Ctrl+D.

The crash does not seem to be reproducible.

-- Backtrace:
Application: Kate (kate), signal: Segmentation fault
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[Current thread is 1 (Thread 0x7f105eb37840 (LWP 5488))]

Thread 7 (Thread 0x7f1049bd3700 (LWP 5495)):
#0  0x00007f1061a8ccf5 in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007f1054ec730c in ?? () from /usr/lib/dri/iris_dri.so
#2  0x00007f1054ec6f08 in ?? () from /usr/lib/dri/iris_dri.so
#3  0x00007f1061a8646f in start_thread () from /usr/lib/libpthread.so.0
#4  0x00007f1062bcd3d3 in clone () from /usr/lib/libc.so.6

Thread 6 (Thread 0x7f104a3d4700 (LWP 5494)):
#0  0x00007f1061a8ccf5 in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007f1054ec730c in ?? () from /usr/lib/dri/iris_dri.so
#2  0x00007f1054ec6f08 in ?? () from /usr/lib/dri/iris_dri.so
#3  0x00007f1061a8646f in start_thread () from /usr/lib/libpthread.so.0
#4  0x00007f1062bcd3d3 in clone () from /usr/lib/libc.so.6

Thread 5 (Thread 0x7f10423d4700 (LWP 5493)):
#0  0x00007f1061a8ccf5 in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007f1054ec730c in ?? () from /usr/lib/dri/iris_dri.so
#2  0x00007f1054ec6f08 in ?? () from /usr/lib/dri/iris_dri.so
#3  0x00007f1061a8646f in start_thread () from /usr/lib/libpthread.so.0
#4  0x00007f1062bcd3d3 in clone () from /usr/lib/libc.so.6

Thread 4 (Thread 0x7f104abd5700 (LWP 5492)):
#0  0x00007f1061a8ccf5 in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007f1054ec730c in ?? () from /usr/lib/dri/iris_dri.so
#2  0x00007f1054ec6f08 in ?? () from /usr/lib/dri/iris_dri.so
#3  0x00007f1061a8646f in start_thread () from /usr/lib/libpthread.so.0
#4  0x00007f1062bcd3d3 in clone () from /usr/lib/libc.so.6

Thread 3 (Thread 0x7f1057fff700 (LWP 5491)):
#0  0x00007f1062bc2abf in poll () from /usr/lib/libc.so.6
#1  0x00007f10610b54a0 in ?? () from /usr/lib/libglib-2.0.so.0
#2  0x00007f10610b5571 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#3  0x00007f106317c8ac in QEventDispatcherGlib::processEvents (this=0x7f1050000b60, flags=...) at kernel/qeventdispatcher_glib.cpp:425
#4  0x00007f106312305c in QEventLoop::exec (this=this@entry=0x7f1057ffed30, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:136
#5  0x00007f1062f47c62 in QThread::exec (this=this@entry=0x7f106421a060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at ../../include/QtCore/../../src/corelib/global/qflags.h:118
#6  0x00007f1064195b28 in QDBusConnectionManager::run (this=0x7f106421a060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at qdbusconnection.cpp:179
#7  0x00007f1062f48dd6 in QThreadPrivate::start (arg=0x7f106421a060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at thread/qthread_unix.cpp:342
#8  0x00007f1061a8646f in start_thread () from /usr/lib/libpthread.so.0
#9  0x00007f1062bcd3d3 in clone () from /usr/lib/libc.so.6

Thread 2 (Thread 0x7f105da33700 (LWP 5490)):
#0  0x00007f1062bc2abf in poll () from /usr/lib/libc.so.6
#1  0x00007f1061cb063b in poll (__timeout=-1, __nfds=1, __fds=0x7f105da32c68) at /usr/include/bits/poll2.h:46
#2  _xcb_conn_wait (c=c@entry=0x55e460177330, cond=cond@entry=0x55e460177370, vector=vector@entry=0x0, count=count@entry=0x0) at xcb_conn.c:480
#3  0x00007f1061cb237b in xcb_wait_for_event (c=c@entry=0x55e460177330) at xcb_in.c:697
#4  0x00007f105e3ede01 in QXcbEventQueue::run (this=0x55e460169d30) at qxcbeventqueue.cpp:228
#5  0x00007f1062f48dd6 in QThreadPrivate::start (arg=0x55e460169d30) at thread/qthread_unix.cpp:342
#6  0x00007f1061a8646f in start_thread () from /usr/lib/libpthread.so.0
#7  0x00007f1062bcd3d3 in clone () from /usr/lib/libc.so.6

Thread 1 (Thread 0x7f105eb37840 (LWP 5488)):
[KCrash Handler]
#6  0x0000000000000000 in ?? ()
#7  0x00007f1063153171 in QObject::disconnect (sender=0x55e46107f240, signal=0x55e4613d9309 "destroyed(QObject*)", receiver=0x55e46107e6b0, method=0x55e4623deec9 "_k_associatedWidgetDestroyed(QObject*)") at kernel/qobject.cpp:3121
#8  0x00007f10646ee31e in KActionCollection::removeAssociatedWidget(QWidget*) () from /usr/lib/libKF5XmlGui.so.5
#9  0x00007f1064736ebc in KXMLGUIClient::prepareXMLUnplug(QWidget*) () from /usr/lib/libKF5XmlGui.so.5
#10 0x00007f106473e440 in KXMLGUIFactory::removeClient(KXMLGUIClient*) () from /usr/lib/libKF5XmlGui.so.5
#11 0x00007f1048b00053 in Konsole::SessionController::~SessionController() () from /usr/lib/libkonsoleprivate.so.20
#12 0x00007f1048b002aa in Konsole::SessionController::~SessionController() () from /usr/lib/libkonsoleprivate.so.20
#13 0x00007f1063151870 in QObject::event (this=0x55e461020cf0, e=0x55e4610ac7d0) at kernel/qobject.cpp:1326
#14 0x00007f1063c22352 in QApplicationPrivate::notify_helper (this=this@entry=0x55e460165760, receiver=receiver@entry=0x55e461020cf0, e=e@entry=0x55e4610ac7d0) at kernel/qapplication.cpp:3685
#15 0x00007f1063c2b829 in QApplication::notify (this=0x7ffe8ce93f80, receiver=0x55e461020cf0, e=0x55e4610ac7d0) at kernel/qapplication.cpp:3431
#16 0x00007f10631244f2 in QCoreApplication::notifyInternal2 (receiver=0x55e461020cf0, event=0x55e4610ac7d0) at ../../include/QtCore/../../src/corelib/kernel/qobject.h:153
#17 0x00007f1063126d56 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x55e460164300) at kernel/qcoreapplication.cpp:1815
#18 0x00007f106317d244 in postEventSourceDispatch (s=0x55e4601df0f0) at kernel/qeventdispatcher_glib.cpp:277
#19 0x00007f10610b36be in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#20 0x00007f10610b5531 in ?? () from /usr/lib/libglib-2.0.so.0
#21 0x00007f10610b5571 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#22 0x00007f106317c890 in QEventDispatcherGlib::processEvents (this=0x55e4601e0590, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#23 0x00007f106312305c in QEventLoop::exec (this=this@entry=0x7ffe8ce93d30, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:136
#24 0x00007f106312b066 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:118
#25 0x000055e45e3134cc in ?? ()
#26 0x00007f1062af5023 in __libc_start_main () from /usr/lib/libc.so.6
#27 0x000055e45e314afe in _start ()
[Inferior 1 (process 5488) detached]

Possible duplicates by query: bug 400970, bug 400304, bug 398560, bug 374792, bug 366151.

Reported using DrKonqi

Comment 1 magiblot 2020-04-30 18:04:16 UTC

It seems that a null function pointer was invoked in QObject::disconnect:

> /* We now iterate through all the sender's and receiver's meta
>  * objects in order to also disconnect possibly shadowed signals
>  * and slots with the same signature.
>  */
> bool res = false;
> const QMetaObject *smeta = sender->metaObject(); // <<< kernel/qobject.cpp:3121

Comment 2 Christoph Feck 2020-05-14 13:09:46 UTC

*** Bug 421424 has been marked as a duplicate of this bug. ***

Comment 3 Christoph Feck 2020-05-14 13:10:22 UTC

Duplicate of bug 420695?

Comment 4 magiblot 2020-05-14 13:37:13 UTC

(In reply to Christoph Feck from comment #3)
> Duplicate of bug 420695?

I would say the backtrace of bug 421424 looks more similar to the one in bug 420695 than the one here. At least the crash is in a different function. But since I can't reproduce this every time, I don't mind flagging this issue as a duplicate.

Comment 5 Wolfgang Bauer 2020-05-29 13:11:39 UTC

Should be fixed by either https://invent.kde.org/utilities/konsole/-/commit/76f3764b47985f5fe50532d46b2e043ba8e31e4a or https://invent.kde.org/utilities/konsole/-/commit/d40e3c72f2ad9262d6028bc62bc2837067b824a0 in konsole.