Bug 429027

The relevant part of the backtrace is here:


#32 0x00007f434e6f3ae4 in KCModuleProxyPrivate::loadModule() (this=this@entry=0x55743c6fae40) at /usr/src/debug/kf5-kcmutils-5.75.0-1.fc33.x86_64/src/kcmoduleproxy.cpp:83
#33 0x00007f434e6f4178 in KCModuleProxy::realModule() const (this=<optimized out>) at /usr/src/debug/kf5-kcmutils-5.75.0-1.fc33.x86_64/src/kcmoduleproxy.cpp:56
#34 0x00007f434e731439 in ModuleView::updatePageIconHeader(KPageWidgetItem*, bool) (this=<optimized out>, page=0x55743c88da40, light=<optimized out>) at /usr/src/debug/plasma-systemsettings-5.20.3-1.fc33.x86_64/core/ModuleView.cpp:224
#35 0x00007f434e732072 in ModuleView::addModule(KCModuleInfo*, QStringList const&) (this=0x55743a825a00, module=0x55743a839428, args=<optimized out>) at /usr/src/debug/plasma-systemsettings-5.20.3-1.fc33.x86_64/core/ModuleView.cpp:201
#36 0x00007f434e732620 in ModuleView::loadModule(QModelIndex const&, QStringList const&) (args=..., menuItem=<optimized out>, this=0x55743a825a00) at /usr/src/debug/plasma-systemsettings-5.20.3-1.fc33.x86_64/core/ModuleView.cpp:156
#37 ModuleView::loadModule(QModelIndex const&, QStringList const&) (this=0x55743a825a00, menuItem=<optimized out>, args=...) at /usr/src/debug/plasma-systemsettings-5.20.3-1.fc33.x86_64/core/ModuleView.cpp:140
#38 0x00007f4338195915 in SidebarMode::loadModule(QModelIndex const&, QStringList const&) (this=0x55743a7d65f0, activeModule=..., args=...) at /usr/src/debug/plasma-systemsettings-5.20.3-1.fc33.x86_64/sidebar/SidebarMode.cpp:473
#39 0x00007f4338199541 in SidebarMode::loadModule(QModelIndex const&, QStringList const&) (args=..., activeModule=<optimized out>, this=0x55743a7d65f0) at /usr/include/qt5/QtCore/qabstractitemmodel.h:76

*** Bug 431418 has been marked as a duplicate of this bug. ***

*** Bug 431515 has been marked as a duplicate of this bug. ***

*** Bug 432564 has been marked as a duplicate of this bug. ***

*** Bug 428170 has been marked as a duplicate of this bug. ***

Number of dupes piling up; raising priority.

that's the part that seems more relevant to me
#11 0x00007f434d205005 in QObject::connectImpl(QObject const*, void**, QObject const*, void**, QtPrivate::QSlotObjectBase*, Qt::ConnectionType, int const*, QMetaObject const*) (sender=0x55743d481e40, signal=<optimized out>, receiver=0x55743c17c8f0, slot=0x0, slotObj=0x55743c796c90, type=Qt::AutoConnection, types=0x0, senderMetaObject=<optimized out>) at kernel/qobject.cpp:5001
#12 0x00007f432438dd64 in QObject::connect<void (QmlComponentsPool::*)(), ColumnView::classBegin()::<lambda()> > (type=Qt::AutoConnection, slot=..., context=0x55743c17c8f0, signal=(void (QmlComponentsPool::*)(class QmlComponentsPool * const)) 0x7f432437b170 <QmlComponentsPool::gridUnitChanged()>, sender=0x55743d481e40) at /usr/include/qt5/QtCore/qobject.h:347
#13 ColumnView::classBegin() (this=0x55743c17c8f0) at /usr/src/debug/kf5-kirigami2-5.75.0-1.fc33.x86_64/src/columnview.cpp:1406
#14 0x00007f434c2fbe6d in QQmlObjectCreator::createInstance(int, QObject*, bool) (this=0x7ffe1365fc30, index=38, parent=<optimized out>, isContextObject=<optimized out>) at qml/qqmlobjectcreator.cpp:1291
#15 0x00007f434c2fe1fe in QQmlObjectCreator::setPropertyBinding(QQmlPropertyData const*, QV4::CompiledData::Binding const*) (this=this@entry=0x7ffe1365fc30, bindingProperty=bindingProperty@entry=0x7f42f40c93a8, binding=binding@entry=0x7f42b3b4abc8) at /usr/include/qt5/QtCore/qendian.h:288
#16 0x00007f434c2fe7cf in QQmlObjectCreator::setupBindings(bool) (this=0x7ffe1365fc30, applyDeferredBindings=false) at qml/qqmlobjectcreator.cpp:798
#17 0x00007f434c2fb57e in QQmlObjectCreator::populateInstance(int, QObject*, QObject*, QQmlPropertyData const*) (this=this@entry=0x7ffe1365fc30, index=-1, index@entry=0, instance=0x0, bindingTarget=0x0, valueTypeProperty=valueTypeProperty@entry=0x0) at qml/qqmlobjectcreator.cpp:1555
#18 0x00007f434c2fc0db in QQmlObjectCreator::createInstance(int, QObject*, bool) (this=0x7ffe1365fc30, index=0, parent=<optimized out>, isContextObject=<optimized out>) at qml/qqmlobjectcreator.cpp:1348

in this and all duplicates the last line before  going in qobject core is
connect(QmlComponentsPoolSingleton::instance(qmlEngine(this)), &QmlComponentsPool::gridUnitChanged, this, syncColumnWidth);

in columnview of kirigami.

in qobject::connectImpl:
return QObjectPrivate::connectImpl(sender, signal_index, receiver, slot, slotObj, type, types, senderMetaObject);

*** Bug 434732 has been marked as a duplicate of this bug. ***

*** Bug 435025 has been marked as a duplicate of this bug. ***

*** Bug 433194 has been marked as a duplicate of this bug. ***

*** Bug 427609 has been marked as a duplicate of this bug. ***

*** Bug 435312 has been marked as a duplicate of this bug. ***

*** Bug 435526 has been marked as a duplicate of this bug. ***

*** Bug 435437 has been marked as a duplicate of this bug. ***

*** Bug 435662 has been marked as a duplicate of this bug. ***

*** Bug 435842 has been marked as a duplicate of this bug. ***

*** Bug 436353 has been marked as a duplicate of this bug. ***

*** Bug 436659 has been marked as a duplicate of this bug. ***

It's difficult without being able to reproduce.

If someone can give me reliable steps to reproduce from a clean VM image, I would be extremely grateful.

(In reply to David Edmundson from comment #20)
> It's difficult without being able to reproduce.
> 
> If someone can give me reliable steps to reproduce from a clean VM image, I
> would be extremely grateful.

I'm afraid there's no clear way of reproducing it other than randomly clicking between many categories for a few minutes before triggering the bug. I managed to crash system settings twice in the span of about 5-7 minutes by just clicking randomly between categories really fast (not even giving it enough time for loading before clicking on another category).

Can we reproduce it in "valgrind systemsettings5" and attach any output?

it will be super slow, but potentially that might make it more trigger-able

Created attachment 138204 [details]
Log - Clicking through every System Settings category - No crash

(In reply to David Edmundson from comment #22)
> Can we reproduce it in "valgrind systemsettings5" and attach any output?
> 
> it will be super slow, but potentially that might make it more trigger-able

I tried for more than 30 minutes to reproduce it while using Valgrind with NO success, however, what I did manage to do was to click through every category with it running and output everything to a log file. This is probably not useful and I don't code so I don't know how to interpret the results, however, I hope this can at least give you some clues.


Full log is attached, but I wanna reiterate I could NOT reproduce the crash with Valgrind in this log.

Created attachment 138403 [details]
New crash information added by DrKonqi

systemsettings5 (5.21.5) using Qt 5.15.2

- What I was doing when the application crashed:

I tried to reproduce the System Settings crash in #429027 by selecting all the items from Startup and Shutdown down to Regional Settings in the sidebar menu on the left quickly so that sometimes the kcm screens didn't load before I selected the next one. I was using Plasma 5.21.5 on Wayland with KF 5.81.0 and Qt 5.15.2 in a Fedora 34 KDE Plasma installation. System Settings segmentation faulted in std::__atomic_base<QObjectPrivate::SignalVector*>::store(QObjectPrivate::SignalVector*, std::memory_order) at /usr/include/c++/11/bits/atomic_base.h:811 in libstdc++-devel-11.1.1-1.fc34.x86_64. The first crash was in std::__atomic_base<QObjectPrivate::ConnectionData*>::load(std::memory_order), but the traces look similar otherwise. I remember this type of crash happening for me just these two times.

-- Backtrace (Reduced):
#4  std::__atomic_base<QObjectPrivate::SignalVector*>::store(QObjectPrivate::SignalVector*, std::memory_order) (__m=std::memory_order_relaxed, __p=0x55ce07c03990, this=0x7f4330f8f888 <QQuickBasePositioner::staticMetaObject+8>) at /usr/include/c++/11/bits/atomic_base.h:811
#5  std::atomic<QObjectPrivate::SignalVector*>::store(QObjectPrivate::SignalVector*, std::memory_order) (__m=std::memory_order_relaxed, __p=0x55ce07c03990, this=0x7f4330f8f888 <QQuickBasePositioner::staticMetaObject+8>) at /usr/include/c++/11/atomic:568
#6  QAtomicOps<QObjectPrivate::SignalVector*>::storeRelaxed<QObjectPrivate::SignalVector*>(std::atomic<QObjectPrivate::SignalVector*>&, QObjectPrivate::SignalVector*) (newValue=0x55ce07c03990, _q_value=...) at ../../include/QtCore/../../src/corelib/thread/qatomic_cxx11.h:269
#7  QBasicAtomicPointer<QObjectPrivate::SignalVector>::storeRelaxed(QObjectPrivate::SignalVector*) (newValue=0x55ce07c03990, this=0x7f4330f8f888 <QQuickBasePositioner::staticMetaObject+8>) at ../../include/QtCore/../../src/corelib/thread/qbasicatomic.h:249
#8  QObjectPrivate::ConnectionData::resizeSignalVector(unsigned int) (this=this@entry=0x7f4330f8f880 <QQuickBasePositioner::staticMetaObject>, size=<optimized out>) at kernel/qobject_p.h:308

*** Bug 437281 has been marked as a duplicate of this bug. ***

*** Bug 437540 has been marked as a duplicate of this bug. ***

*** Bug 438410 has been marked as a duplicate of this bug. ***

*** Bug 438684 has been marked as a duplicate of this bug. ***

*** Bug 438734 has been marked as a duplicate of this bug. ***

Created attachment 139543 [details]
New crash information added by DrKonqi

systemsettings5 (5.21.4) using Qt 5.15.2

- What I was doing when the application crashed:

I was changing the asthetics when the application got crashed, dw why :( please fix it

-- Backtrace (Reduced):
#4  0x00007fde0fcd66b8 in QObjectPrivate::addConnection(int, QObjectPrivate::Connection*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#5  0x00007fde0fcdb320 in QObjectPrivate::connectImpl(QObject const*, int, QObject const*, void**, QtPrivate::QSlotObjectBase*, Qt::ConnectionType, int const*, QMetaObject const*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#6  0x00007fde0fcdb7fd in QObject::connectImpl(QObject const*, void**, QObject const*, void**, QtPrivate::QSlotObjectBase*, Qt::ConnectionType, int const*, QMetaObject const*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
[...]
#8  0x00007fde0eed195e in QQmlObjectCreator::createInstance(int, QObject*, bool) () from /lib/x86_64-linux-gnu/libQt5Qml.so.5
#9  0x00007fde0eed4ae8 in QQmlObjectCreator::setPropertyBinding(QQmlPropertyData const*, QV4::CompiledData::Binding const*) () from /lib/x86_64-linux-gnu/libQt5Qml.so.5

can you run systemsettings with the failing kcm in valgrind?

*** Bug 439558 has been marked as a duplicate of this bug. ***

*** Bug 440133 has been marked as a duplicate of this bug. ***

*** Bug 441311 has been marked as a duplicate of this bug. ***

*** Bug 432196 has been marked as a duplicate of this bug. ***

*** Bug 442689 has been marked as a duplicate of this bug. ***

*** Bug 442559 has been marked as a duplicate of this bug. ***

*** Bug 443421 has been marked as a duplicate of this bug. ***

*** Bug 443722 has been marked as a duplicate of this bug. ***

*** Bug 443671 has been marked as a duplicate of this bug. ***

*** Bug 430954 has been marked as a duplicate of this bug. ***

*** Bug 434719 has been marked as a duplicate of this bug. ***

*** Bug 444232 has been marked as a duplicate of this bug. ***

Moving to kirigami. QmlComponentsPoolSingleton has dodgy entry management.

A possibly relevant merge request was started @ https://invent.kde.org/frameworks/kirigami/-/merge_requests/404

Git commit 5ee8b2888fe092b2228ff410e2ee88e1ec558fb0 by Harald Sitter.
Committed on 31/10/2021 at 08:09.
Pushed by sitter into branch 'master'.

reliably drop component pools

previously this was extra wrong.

we had connected the componentPool (sender) to the engine (receiver),
but the engine is the parent of the componentPool, so the engine was
already disconnected by the time componentPool emitted destroyed and as
such never receive the destroyed signal, never remove the pool entry,
and then eventually crash if that engine address got reused

fix this aggressively since technically either the key or the
value may get destroyed and that'd constitute removal from the pool. one
shouldn't really be deleted without the other, but let's be explicit
here:

a) scope the previous connection from componentPool to componentPool so
it definitely runs and disappearance of the hash value results in
removal (this scenario may run with a dangling engine* in the lambda)

b) add another connection from engine to engine so hash key
disappearance also results in removal

this reliably fixes the random crashes to do with classBegin (where we
would eventually deference the dangling pointers from the hash)
FIXED-IN: 5.88.0

M  +6    -2    src/columnview.cpp

https://invent.kde.org/frameworks/kirigami/commit/5ee8b2888fe092b2228ff410e2ee88e1ec558fb0

*** Bug 446598 has been marked as a duplicate of this bug. ***

Duplicate bug 446598 is from someone using Frameworks 5.88 and they have the same backtrace. Re-opening. :(

>Duplicate bug 446598 is from someone using Frameworks 5.88 and they have the same backtrace. Re-opening. :(

That's not the same backtrace. 

This explicitly has ColumnView::classBegin. The other does not. It looks more like: https://bugs.kde.org/show_bug.cgi?id=446555 I'll adjust that and reclose this

Oh ok, sorry

Created attachment 145263 [details]
New crash information added by DrKonqi

systemsettings5 (5.23.4) using Qt 5.15.2

- What I was doing when the application crashed:
It crashes when I try to open any settings applet.

-- Backtrace (Reduced):
#6  0x00007f2fe7e97bea in QPixmapStyle::scrollBarSubControlRect (this=<optimized out>, option=0x55d5170c7f60, sc=QStyle::SC_ScrollBarGroove) at styles/qpixmapstyle.cpp:1139
#7  0x00007f2f9ad10f31 in KQuickStyleItem::subControlRect (subcontrolString=..., this=0x55d5170c4480) at /usr/src/debug/qqc2-desktop-style-5.89.0-1.2.x86_64/plugin/kquickstyleitem.cpp:1494
#8  KQuickStyleItem::qt_static_metacall (_o=0x55d5170c4480, _c=<optimized out>, _id=<optimized out>, _a=0x7fff6cdc2e20) at /usr/src/debug/qqc2-desktop-style-5.89.0-1.2.x86_64/build/plugin/qqc2desktopstyleplugin_autogen/include/moc_kquickstyleitem_p.cpp:400
#9  0x00007f2f9ad13a0b in KQuickStyleItem::qt_metacall (this=0x55d5170c4480, _c=QMetaObject::InvokeMetaMethod, _id=39, _a=0x7fff6cdc2e20) at /usr/src/debug/qqc2-desktop-style-5.89.0-1.2.x86_64/build/plugin/qqc2desktopstyleplugin_autogen/include/moc_kquickstyleitem_p.cpp:776
#10 0x00007f2fe5f5fead in QQmlObjectOrGadget::metacall (this=this@entry=0x7fff6cdc30b0, type=type@entry=QMetaObject::InvokeMetaMethod, index=<optimized out>, index@entry=86, argv=<optimized out>) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde36-1.3.x86_64/src/qml/qml/qqmlobjectorgadget.cpp:51