Bug 425670

Summary: Discover crashes in QQmlData::wasDeleted() upon press of 'settings' too soon after launching (waiting 10-15 seconds makes it not crash)
Product: [Frameworks and Libraries] frameworks-kirigami Reporter: James Cain <dequire>
Component: generalAssignee: Marco Martin <notmart>
Status: RESOLVED FIXED    
Severity: crash CC: ahiemstra, airmonk, aleixpol, bugseforuns, dbruckner, gustavohenac, jmoncayo753, joseph.d.harris78, kde, lawson1961cs, lou.afonso, matt.gatto, nate, proteus5, tr4nquoc, welitonubuntu
Priority: VHI Keywords: drkonqi, regression
Version: 5.73.0   
Target Milestone: Not decided   
Platform: Neon   
OS: Linux   
Latest Commit: Version Fixed In: Frameworks 5.75 or Plasma 5.20, whichever one you get first! :)
Attachments: New crash information added by DrKonqi
New crash information added by DrKonqi
New crash information added by DrKonqi

Description James Cain 2020-08-22 10:47:22 UTC
Application: plasma-discover (5.19.4)

Qt Version: 5.14.2
Frameworks Version: 5.74.0
Operating System: Linux 5.8.2-050802-generic x86_64
Windowing system: X11
Distribution: KDE neon Testing Edition

-- Information about the crash:
- What I was doing when the application crashed:  

Opened the applcation, and pressed 'settings' button upon launch.

- Unusual behavior I noticed:

Application crashes 100% of the time. This is new behaviour.

The crash can be reproduced every time.

-- Backtrace:
Application: Discover (plasma-discover), signal: Segmentation fault

[KCrash Handler]
#4  0x00007fc00114d8a5 in QMetaObject::SuperData::operator QMetaObject const*() const (this=0x0) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs.h:598
#5  0x00007fc00114d8a5 in QMetaObject::superClass() const (this=0x0) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs.h:644
#6  0x00007fc00114d8a5 in QQmlMetaTypeData::propertyCache(QMetaObject const*, int) (this=this@entry=0x7fc001517960 <(anonymous namespace)::Q_QGS_metaTypeData::innerFunction()::holder>, metaObject=<optimized out>, metaObject@entry=0x0, minorVersion=minorVersion@entry=-1) at qml/qqmlmetatypedata.cpp:107
#7  0x00007fc00114201a in QQmlMetaType::propertyCache(QMetaObject const*, int) (metaObject=0x0, minorVersion=minorVersion@entry=-1) at qml/qqmlmetatype.cpp:1202
#8  0x00007fc001122456 in QJSEnginePrivate::cache(QObject*, int) (minorVersion=-1, obj=0x55ed663dc090, this=0x55ed64a736f0) at ../../include/QtQml/5.14.2/QtQml/private/../../../../../src/qml/jsapi/qjsengine_p.h:170
#9  0x00007fc001122456 in QQmlData::createPropertyCache(QJSEngine*, QObject*) (engine=<optimized out>, object=0x55ed663dc090) at qml/qqmlengine.cpp:2025
#10 0x00007fc00105e99b in QV4::QObjectWrapper::create(QV4::ExecutionEngine*, QObject*) (engine=<optimized out>, object=0x55ed663dc090) at ../../include/QtQml/5.14.2/QtQml/private/../../../../../src/qml/qml/qqmldata_p.h:284
#11 0x00007fc00106074b in QV4::QObjectWrapper::wrap_slowPath(QV4::ExecutionEngine*, QObject*) (engine=0x55ed64a3a220, object=0x55ed663dc090) at jsruntime/qv4qobjectwrapper.cpp:614
#12 0x00007fc000fe1dc3 in QV4::QObjectWrapper::wrap(QV4::ExecutionEngine*, QObject*) (engine=engine@entry=0x55ed64a3a220, object=<optimized out>) at jsruntime/qv4qobjectwrapper_p.h:222
#13 0x00007fc001060a86 in loadProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData const&) (v4=v4@entry=0x55ed64a3a220, object=object@entry=0x55ed65c0f960, property=...) at jsruntime/qv4qobjectwrapper.cpp:139
#14 0x00007fc001060f63 in QV4::QObjectWrapper::getProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData*) (engine=engine@entry=0x55ed64a3a220, object=object@entry=0x55ed65c0f960, property=<optimized out>) at jsruntime/qv4qobjectwrapper.cpp:268
#15 0x00007fc001065793 in QV4::QObjectWrapper::getQmlProperty(QV4::ExecutionEngine*, QQmlContextData*, QObject*, QV4::String*, QV4::QObjectWrapper::RevisionMode, bool*, QQmlPropertyData**) (engine=engine@entry=0x55ed64a3a220, qmlContext=qmlContext@entry=0x55ed663cc5f0, object=0x55ed65c0f960, name=0x7fbfe56e1628, revisionMode=revisionMode@entry=QV4::QObjectWrapper::IgnoreRevision, hasProperty=hasProperty@entry=0x0, property=0x0) at jsruntime/qv4qobjectwrapper.cpp:388
#16 0x00007fc0011a8c9f in QV4::QQmlTypeWrapper::virtualGet(QV4::Managed const*, QV4::PropertyKey, QV4::Value const*, bool*) (m=0x7fbfe56e1618, id=..., receiver=0x7fbfe56e1618, hasProperty=0x0) at qml/qqmltypewrapper.cpp:268
#17 0x00007fc000fe783b in QV4::Object::get(QV4::StringOrSymbol*, bool*, QV4::Value const*) const (receiver=0x7fbfe56e1618, hasProperty=0x0, name=0x7fbfe56e1620, this=0x7fbfe56e1620) at jsruntime/qv4object_p.h:308
#18 0x00007fc000fe783b in QV4::Lookup::getterFallback(QV4::Lookup*, QV4::ExecutionEngine*, QV4::Value const&) (l=<optimized out>, engine=0x55ed64a3a220, object=...) at jsruntime/qv4lookup.cpp:201
#19 0x00007fbf7aed8cc0 in  ()
#20 0x0000000000000000 in  ()

Possible duplicates by query: bug 394294.

Reported using DrKonqi
Comment 1 lou.afonso 2020-08-25 17:12:11 UTC
Created attachment 131173 [details]
New crash information added by DrKonqi

plasma-discover (5.19.4) using Qt 5.14.2

- What I was doing when the application crashed:

open app get updates. hit settings. goodbye app

-- Backtrace (Reduced):
#4  0x00007f81dd3dd907 in QQmlData::wasDeleted (object=0x562a1ec7bb90) at ../../include/QtQml/5.14.2/QtQml/private/../../../../../src/qml/qml/qqmldata_p.h:338
#5  QV4::QObjectWrapper::wrap (object=0x562a1ec7bb90, engine=0x562a1b571ff0) at jsruntime/qv4qobjectwrapper_p.h:213
#6  loadProperty (v4=0x562a1b571ff0, object=0x562a1f17f380, property=...) at jsruntime/qv4qobjectwrapper.cpp:139
#7  0x00007f81dd3dea05 in QV4::QObjectWrapper::getQmlProperty (engine=engine@entry=0x562a1b571ff0, qmlContext=qmlContext@entry=0x562a1f0e5dd0, object=0x562a1f17f380, name=0x7f81d43c5628, revisionMode=revisionMode@entry=QV4::QObjectWrapper::IgnoreRevision, hasProperty=hasProperty@entry=0x0, property=0x0) at jsruntime/qv4qobjectwrapper.cpp:388
#8  0x00007f81dd538cb3 in QV4::QQmlTypeWrapper::virtualGet (m=0x7f81d43c5618, id=..., receiver=0x7f81d43c5618, hasProperty=0x0) at ../../include/QtQml/5.14.2/QtQml/private/../../../../../src/qml/common/qv4staticvalue_p.h:325
Comment 2 Nate Graham 2020-09-08 13:45:21 UTC
Can reproduce. If I open the settings window right after launching, it crashes 100% of the time. If I wait a bit, it goes away. In particular, when there are available updates, if I wait until they've all loaded, visiting the settings page never crashes when going there. If I go there before or during the updates have loaded, it crashes.
Comment 3 Nate Graham 2020-09-08 13:45:43 UTC
*** Bug 425855 has been marked as a duplicate of this bug. ***
Comment 4 David Edmundson 2020-09-08 14:02:34 UTC
Reproduced:

Better trace with extra notes:

#12 0x00007ffff59bdc5a in QQmlBinding::evaluate(bool*) (this=0x555557925710, isUndefined=0x7fffffffa70e)
    at /home/david/projects/qt5/qtdeclarative/src/qml/qml/qqmlbinding.cpp:218

frame 12 is:

file:///home/opt/kde5/lib/qml/org/kde/kirigami.2/ActionToolBar.qml:117:13


Frame 2, the property is


#2  0x00007ffff57d3431 in loadProperty (v4=0x55555577a340, object=0x555557827c30, property=...)
    at /home/david/projects/qt5/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:139
139             return QV4::QObjectWrapper::wrap(v4, rv);
(gdb) print object
$5 = (QObject *) 0x555557827c30
(gdb) print object->metaObject()
$6 = (const QMetaObject *) 0x7fffec1642d0 <ToolBarLayoutAttached::staticMetaObject>
Comment 5 Nate Graham 2020-09-08 14:09:03 UTC
Arjen, would you mind taking a look? Thanks!
Comment 6 David Edmundson 2020-09-08 14:15:09 UTC
        iconDelegate: PrivateActionToolButton {
            flat: root.flat && !action.icon.color.a
            display: Controls.Button.IconOnly
            action: Kirigami.ToolBarLayout.action

should it not be 

action: layout.action 

?
Comment 7 Arjen Hiemstra 2020-09-08 14:22:19 UTC
iconDelegate is instantiated for every action in the toolbar. ToolBarLayout in this context is an attached property that gets populated by ToolBarLayout with the action this instance is created for. So no, it should not, since there is no other way of knowing what action this instance should use.
Comment 8 Arjen Hiemstra 2020-09-09 11:43:59 UTC
https://invent.kde.org/frameworks/kirigami/-/merge_requests/95

(Don't think the bot picked it up)
Comment 9 Christoph Feck 2020-09-10 10:08:22 UTC
I am seeing lots of recent crash reports for plasmashell which point to QQmlData::wasDeleted(). Are these related?
Comment 10 Nate Graham 2020-09-10 15:30:53 UTC
Can you share links to them?
Comment 11 Christoph Feck 2020-09-10 16:43:16 UTC
I use a 'crash' web keyword/shortcut to search all open crash bugs that have a specific string in the comments. Anyway, here is the result:

https://bugs.kde.org/buglist.cgi?bug_severity=crash&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=NEEDSINFO&longdesc=QQmlData%3A%3AwasDeleted&longdesc_type=allwordssubstr&query_format=advanced&chfieldfrom=1461d
Comment 12 Nate Graham 2020-09-10 23:42:55 UTC
Thanks. I did a bit of triage to dupe the ones that were about the same things crashing, but beyond that, I don't see a strong pattern. :/
Comment 13 Arjen Hiemstra 2020-09-14 10:53:39 UTC
Git commit 6eaefba5001445fa7e198e4caa0bde738240d66f by Arjen Hiemstra.
Committed on 14/09/2020 at 10:50.
Pushed by ahiemstra into branch 'master'.

Remove actions and delegates from ToolBarLayout when they get destroyed

Otherwise we're keeping around stale entries that no longer point to
valid stuff.

M  +12   -0    src/toolbarlayout.cpp

https://invent.kde.org/frameworks/kirigami/commit/6eaefba5001445fa7e198e4caa0bde738240d66f
Comment 14 Nate Graham 2020-09-18 21:09:42 UTC
*** Bug 426603 has been marked as a duplicate of this bug. ***
Comment 15 Nate Graham 2020-09-18 21:16:44 UTC
*** Bug 426667 has been marked as a duplicate of this bug. ***
Comment 16 Mathew 2020-09-19 05:41:25 UTC
Created attachment 131761 [details]
New crash information added by DrKonqi

plasma-discover (5.19.5) using Qt 5.15.0

- What I was doing when the application crashed: Clicking the settings option, every time I click 'Settings' in Discover the application crashes.

-- Backtrace (Reduced):
#4  0x00007fccbde7f617 in QQmlData::wasDeleted(QObject const*) (object=0x5606042ddb60) at ../../include/QtQml/5.15.0/QtQml/private/../../../../../src/qml/qml/qqmldata_p.h:338
#5  QV4::QObjectWrapper::wrap(QV4::ExecutionEngine*, QObject*) (object=0x5606042ddb60, engine=0x560600a73590) at jsruntime/qv4qobjectwrapper_p.h:213
#6  loadProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData const&) (v4=0x560600a73590, object=0x5606049281c0, property=...) at jsruntime/qv4qobjectwrapper.cpp:139
#7  0x00007fccbde806b2 in QV4::QObjectWrapper::getQmlProperty(QV4::ExecutionEngine*, QQmlContextData*, QObject*, QV4::String*, QV4::QObjectWrapper::RevisionMode, bool*, QQmlPropertyData**) (engine=engine@entry=0x560600a73590, qmlContext=qmlContext@entry=0x560604180750, object=0x5606049281c0, name=0x7fccb4e4b628, revisionMode=revisionMode@entry=QV4::QObjectWrapper::IgnoreRevision, hasProperty=hasProperty@entry=0x0, property=0x0) at jsruntime/qv4qobjectwrapper.cpp:388
#8  0x00007fccbdff11e3 in QV4::QQmlTypeWrapper::virtualGet(QV4::Managed const*, QV4::PropertyKey, QV4::Value const*, bool*) (m=0x7fccb4e4b618, id=..., receiver=0x7fccb4e4b618, hasProperty=0x0) at ../../include/QtQml/5.15.0/QtQml/private/../../../../../src/qml/common/qv4staticvalue_p.h:325
Comment 17 Nate Graham 2020-09-22 15:15:17 UTC
*** Bug 426855 has been marked as a duplicate of this bug. ***
Comment 18 Rik Mills 2020-09-23 16:46:04 UTC
*** Bug 426907 has been marked as a duplicate of this bug. ***
Comment 19 Nate Graham 2020-10-05 20:34:28 UTC
*** Bug 427240 has been marked as a duplicate of this bug. ***
Comment 20 Lawson Vaughan 2020-10-08 10:27:23 UTC
Created attachment 132208 [details]
New crash information added by DrKonqi

plasma-discover (5.19.5) using Qt 5.15.1

- What I was doing when the application crashed: Trying to alter setting in discover to add additional software repositories.

- Custom settings of the application:

-- Backtrace (Reduced):
#5  0x00007f1ff532129d in QObjectData::dynamicMetaObject() const () at /usr/lib/libQt5Core.so.5
#6  0x00007f1ff532ace1 in QObject::property(char const*) const () at /usr/lib/libQt5Core.so.5
[...]
#10 0x00007f1ff6e260c6 in QQuickWindowPrivate::polishItems() () at /usr/lib/libQt5Quick.so.5
[...]
#12 0x00007f1ff6e32bb7 in QQuickWindow::event(QEvent*) () at /usr/lib/libQt5Quick.so.5
#13 0x00007f1ff632a752 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
Comment 21 Nate Graham 2020-10-08 14:07:26 UTC
*** Bug 427360 has been marked as a duplicate of this bug. ***
Comment 22 Nate Graham 2020-10-08 14:07:54 UTC
*** Bug 427435 has been marked as a duplicate of this bug. ***
Comment 23 Nate Graham 2020-10-12 18:44:15 UTC
*** Bug 427562 has been marked as a duplicate of this bug. ***