Bug 442681

Summary:	kded sometimes crashes in LayoutUnit::operator= when switching ibus keyboard layouts
Product:	[Plasma] plasmashell	Reporter:	Kishore Gopalakrishnan <kishore96>
Component:	Keyboard Layout widget	Assignee:	Plasma Bugs List <plasma-bugs-null>
Status:	RESOLVED FIXED
Severity:	crash	CC:	butirsky, kdelibs-bugs-null, nate, nicolas.fella
Priority:	NOR
Version First Reported In:	5.22.90
Target Milestone:	1.0
Platform:	Arch Linux
OS:	Other
Latest Commit:		Version Fixed In:
Sentry Crash Report:

Description Kishore Gopalakrishnan 2021-09-19 06:17:54 UTC

SUMMARY
kded sometimes crashes when I am switching ibus input methods with a keyboard shortcut (meta+space on my machine). The crash is not reproducible every time I switch, but happens a couple of times a week.

STEPS TO REPRODUCE (does not happen every time)
1. Switch ibus keyboard layout with the keyboard shortcut (can be chosen in the ibus settings)

OBSERVED RESULT
kded crashes. After this, various keys on my keyboard get remapped in a strange way; for example, one of the arrow keys becomes 'prtscr', and my left Ctrl becomes 'pgdn'.

EXPECTED RESULT
kded should not crash.

SOFTWARE/OS VERSIONS
Operating System: Arch Linux
KDE Plasma Version: 5.22.90
KDE Frameworks Version: 5.86.0
Qt Version: 5.15.2
Kernel Version: 5.10.63-1-lts (64-bit)
Graphics Platform: X11

BACKTRACE
(I have installed debug symbols for kded, plasma-desktop, and qt5-base; please let me know in case other debug symbols are required)

Thread 7 (Thread 0x7f03303702c0 (LWP 3474)):
#0  0x00007f0333305b2f in poll () at /usr/lib/libc.so.6
#1  0x00007f03343f88aa in  () at /usr/lib/libKF5Crash.so.5
#2  0x00007f03343f9360 in KCrash::defaultCrashHandler(int) () at /usr/lib/libKF5Crash.so.5
#3  0x00007f033324eda0 in <signal handler called> () at /usr/lib/libc.so.6
#4  0x00007f033374b65a in operator==(QString const&, QString const&) (s1=..., s2=...) at text/qstring.cpp:3432
#5  0x00007f03251396ee in LayoutUnit::operator==(LayoutUnit const&) const (layoutItem=..., this=0x55ae77ca6010) at /usr/src/debug/plasma-desktop-5.22.90/kcms/keyboard/x11_helper.h:161
#6  LayoutUnit::operator!=(LayoutUnit const&) const (layoutItem=..., this=0x55ae77ca6010) at /usr/src/debug/plasma-desktop-5.22.90/kcms/keyboard/x11_helper.h:165
#7  isExtraSubset (newList=..., allLayouts=...) at /usr/src/debug/plasma-desktop-5.22.90/kcms/keyboard/layout_memory.cpp:98
#8  LayoutMemory::layoutMapChanged() (this=this@entry=0x7f03200034b8) at /usr/src/debug/plasma-desktop-5.22.90/kcms/keyboard/layout_memory.cpp:118
#9  0x00007f0325133edc in KeyboardDaemon::layoutMapChanged() (this=0x7f0320003460) at /usr/src/debug/plasma-desktop-5.22.90/kcms/keyboard/keyboard_daemon.cpp:167
#10 0x00007f03338f08c5 in QtPrivate::QSlotObjectBase::call(QObject*, void**) (a=0x7fffa7197d50, r=<optimized out>, this=0x55ae77aa3c70) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#11 doActivate<false>(QObject*, int, void**) (sender=0x55ae77a97fe0, signal_index=4, argv=0x7fffa7197d50) at kernel/qobject.cpp:3886
#12 0x00007f03338e9e97 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (sender=sender@entry=0x55ae77a97fe0, m=m@entry=0x7f032516ab20 <XEventNotifier::staticMetaObject>, local_signal_index=local_signal_index@entry=1, argv=argv@entry=0x0) at kernel/qobject.cpp:3946
#13 0x00007f0325132478 in XEventNotifier::layoutMapChanged() (this=this@entry=0x55ae77a97fe0) at /usr/src/debug/build/kcms/keyboard/kded_keyboard_autogen/EWIEGA46WW/moc_x11_helper.cpp:151
#14 0x00007f0325141fd7 in XEventNotifier::processXkbEvents(xcb_generic_event_t*) (event=0x7f0328005d70, this=0x55ae77a97fe0) at /usr/src/debug/plasma-desktop-5.22.90/kcms/keyboard/x11_helper.cpp:321
#15 XEventNotifier::nativeEventFilter(QByteArray const&, void*, long*) (eventType=<optimized out>, message=0x7f0328005d70, this=0x55ae77a97fe0) at /usr/src/debug/plasma-desktop-5.22.90/kcms/keyboard/x11_helper.cpp:332
#16 XEventNotifier::nativeEventFilter(QByteArray const&, void*, long*) (this=0x55ae77a97fe0, eventType=<optimized out>, message=0x7f0328005d70) at /usr/src/debug/plasma-desktop-5.22.90/kcms/keyboard/x11_helper.cpp:326
#17 0x00007f03338b64d7 in QAbstractEventDispatcher::filterNativeEvent(QByteArray const&, void*, long*) (this=<optimized out>, eventType=..., message=message@entry=0x7f0328005d70, result=result@entry=0x7fffa7197e08) at kernel/qabstracteventdispatcher.cpp:495
#18 0x00007f032feedc67 in QXcbConnection::handleXcbEvent(xcb_generic_event_t*) (this=this@entry=0x55ae775ec580, event=event@entry=0x7f0328005d70) at qxcbconnection.cpp:536
#19 0x00007f032feef2d1 in QXcbConnection::processXcbEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=0x55ae775ec580, flags=...) at qxcbconnection.cpp:1014
#20 0x00007f032ff167f8 in xcbSourceDispatch(GSource*, GSourceFunc, gpointer) (source=<optimized out>) at qxcbeventdispatcher.cpp:103
#21 0x00007f033086610c in g_main_context_dispatch () at /usr/lib/libglib-2.0.so.0
#22 0x00007f03308b9ba9 in  () at /usr/lib/libglib-2.0.so.0
#23 0x00007f0330863871 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#24 0x00007f0333912ada in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=0x55ae776dbbd0, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#25 0x00007f03338b7a6b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7fffa7198090, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#26 0x00007f03338c0258 in QCoreApplication::exec() () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#27 0x00007f0333e3e2e2 in QGuiApplication::exec() () at kernel/qguiapplication.cpp:1867
#28 0x00007f0334619f6a in QApplication::exec() () at kernel/qapplication.cpp:2824
#29 0x000055ae7693b73f in main(int, char**) (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kded-5.86.0/src/kded.cpp:782

Thread 6 (Thread 0x7f0309bf0640 (LWP 3592)):
#0  0x00007f0333308323 in pselect () at /usr/lib/libc.so.6
#1  0x00007f032d1bf524 in  () at /usr/lib/libusbmuxd-2.0.so.6
#2  0x00007f032d1c08a9 in  () at /usr/lib/libusbmuxd-2.0.so.6
#3  0x00007f03331fa259 in start_thread () at /usr/lib/libpthread.so.0
#4  0x00007f03333105e3 in clone () at /usr/lib/libc.so.6

Thread 5 (Thread 0x7f0326966640 (LWP 3482)):
#0  0x00007f033330189c in read () at /usr/lib/libc.so.6
#1  0x00007f0330866505 in g_main_context_check () at /usr/lib/libglib-2.0.so.0
#2  0x00007f03308b9add in  () at /usr/lib/libglib-2.0.so.0
#3  0x00007f0330865693 in g_main_loop_run () at /usr/lib/libglib-2.0.so.0
#4  0x00007f0327b018c8 in  () at /usr/lib/libgio-2.0.so.0
#5  0x00007f03308942d1 in  () at /usr/lib/libglib-2.0.so.0
#6  0x00007f03331fa259 in start_thread () at /usr/lib/libpthread.so.0
#7  0x00007f03333105e3 in clone () at /usr/lib/libc.so.6

Thread 4 (Thread 0x7f03259fc640 (LWP 3509)):
#0  0x00007f03336d13b1 in qCalculateGrowingBlockSize(unsigned long, unsigned long, unsigned long) (elementCount=elementCount@entry=10, elementSize=2, headerSize=24) at tools/qarraydata.cpp:137
#1  0x00007f03336d14c6 in calculateBlockSize (options=8, headerSize=<optimized out>, objectSize=10, capacity=<synthetic pointer>: <optimized out>) at tools/qarraydata.cpp:173
#2  calculateBlockSize (options=8, headerSize=<optimized out>, objectSize=2, capacity=<synthetic pointer>: <optimized out>) at tools/qarraydata.cpp:166
#3  QArrayData::allocate(unsigned long, unsigned long, unsigned long, QFlags<QArrayData::AllocationOption>) (objectSize=objectSize@entry=2, alignment=alignment@entry=8, capacity=10, options=...) at tools/qarraydata.cpp:217
#4  0x00007f03337497c5 in QTypedArrayData<unsigned short>::allocate(unsigned long, QFlags<QArrayData::AllocationOption>) (options=..., capacity=10) at ../../include/QtCore/../../src/corelib/tools/qarraydata.h:224
#5  QString::reallocData(unsigned int, bool) (this=0x7f03259fb090, alloc=10, grow=<optimized out>) at text/qstring.cpp:2366
#6  0x00007f0333749e37 in QString::append(QString const&) (this=this@entry=0x7f03259fb090, str=...) at text/qstring.cpp:2684
#7  0x00007f03251b6cf7 in QString::operator+=(QString const&) (s=..., this=0x7f03259fb090) at ../../../../include/QtCore/../../src/corelib/text/qstring.h:569
#8  operator+(QString const&, QString const&) (s2=..., s1=<optimized out>) at ../../../../include/QtCore/../../src/corelib/text/qstring.h:1531
#9  QGenericEngine::doRequestUpdate() (this=0x55ae77ada3e0) at qgenericengine.cpp:313
#10 0x00007f03338c491b in QMetaMethod::invoke(QObject*, Qt::ConnectionType, QGenericReturnArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument) const (this=<optimized out>, object=0x55ae77ada3e0, connectionType=Qt::DirectConnection, returnValue=..., val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...) at kernel/qmetaobject.cpp:2303
#11 0x00007f03338c98f0 in QMetaObject::invokeMethod(QObject*, char const*, Qt::ConnectionType, QGenericReturnArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument) (obj=obj@entry=0x55ae77ada3e0, member=member@entry=0x7f032ea0bae5 "requestUpdate", type=type@entry=Qt::AutoConnection, ret=..., val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...) at kernel/qmetaobject.cpp:1515
#12 0x00007f032e97b702 in QMetaObject::invokeMethod(QObject*, char const*, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument) (val9=..., val8=..., val7=..., val6=..., val5=..., val4=..., val3=..., val2=..., val1=..., val0=..., member=0x7f032ea0bae5 "requestUpdate", obj=0x55ae77ada3e0) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs.h:460
#13 QNetworkConfigurationManagerPrivate::pollEngines() (this=0x55ae77adfa20) at bearer/qnetworkconfigmanager_p.cpp:493
#14 0x00007f03338f091b in doActivate<false>(QObject*, int, void**) (sender=0x7f030c0132e0, signal_index=3, argv=0x7f03259fb930) at kernel/qobject.cpp:3898
#15 0x00007f03338e9e97 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (sender=<optimized out>, m=m@entry=0x7f0333b568e0 <QTimer::staticMetaObject>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7f03259fb930) at kernel/qobject.cpp:3946
#16 0x00007f03338f4a3f in QTimer::timeout(QTimer::QPrivateSignal) (this=<optimized out>, _t1=...) at .moc/moc_qtimer.cpp:205
#17 0x00007f03338e6fef in QObject::event(QEvent*) (this=0x7f030c0132e0, e=0x7f03259fba80) at kernel/qobject.cpp:1336
#18 0x00007f03338b919e in doNotify (event=0x7f03259fba80, receiver=0x7f030c0132e0) at kernel/qcoreapplication.cpp:1154
#19 QCoreApplication::notify(QObject*, QEvent*) (event=<optimized out>, receiver=<optimized out>, this=<optimized out>) at kernel/qcoreapplication.cpp:1140
#20 QCoreApplication::notifyInternal2(QObject*, QEvent*) (receiver=0x7f030c0132e0, event=0x7f03259fba80) at kernel/qcoreapplication.cpp:1064
#21 0x00007f0333911dbd in QTimerInfoList::activateTimers() (this=0x7f030c0040c0) at kernel/qtimerinfo_unix.cpp:643
#22 0x00007f03339126fa in timerSourceDispatch(GSource*, GSourceFunc, gpointer) (source=<optimized out>) at kernel/qeventdispatcher_glib.cpp:183
#23 0x00007f033086610c in g_main_context_dispatch () at /usr/lib/libglib-2.0.so.0
#24 0x00007f03308b9ba9 in  () at /usr/lib/libglib-2.0.so.0
#25 0x00007f0330863871 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#26 0x00007f0333912ada in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=0x7f030c000b60, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#27 0x00007f03338b7a6b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7f03259fbcc0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#28 0x00007f03336c4176 in QThread::exec() (this=<optimized out>) at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#29 0x00007f03336c53cb in QThreadPrivate::start(void*) (arg=0x55ae77a1d440) at thread/qthread_unix.cpp:329
#30 0x00007f03331fa259 in start_thread () at /usr/lib/libpthread.so.0
#31 0x00007f03333105e3 in clone () at /usr/lib/libc.so.6

Thread 3 (Thread 0x7f032cb3a640 (LWP 3476)):
#0  0x00007f0333305b2f in poll () at /usr/lib/libc.so.6
#1  0x00007f03308b9b39 in  () at /usr/lib/libglib-2.0.so.0
#2  0x00007f0330863871 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#3  0x00007f0333912b57 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=0x7f0320000b60, flags=...) at kernel/qeventdispatcher_glib.cpp:425
#4  0x00007f03338b7a6b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7f032cb39c90, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#5  0x00007f03336c4176 in QThread::exec() (this=this@entry=0x7f0333ca1080 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#6  0x00007f0333c25b0c in QDBusConnectionManager::run() (this=0x7f0333ca1080 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at qdbusconnection.cpp:179
#7  0x00007f03336c53cb in QThreadPrivate::start(void*) (arg=0x7f0333ca1080 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at thread/qthread_unix.cpp:329
#8  0x00007f03331fa259 in start_thread () at /usr/lib/libpthread.so.0
#9  0x00007f03333105e3 in clone () at /usr/lib/libc.so.6

Thread 2 (Thread 0x7f0327968640 (LWP 3480)):
#0  0x00007f0333305b2f in poll () at /usr/lib/libc.so.6
#1  0x00007f03308b9b39 in  () at /usr/lib/libglib-2.0.so.0
#2  0x00007f0330863871 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#3  0x00007f03308638c2 in  () at /usr/lib/libglib-2.0.so.0
#4  0x00007f03308942d1 in  () at /usr/lib/libglib-2.0.so.0
#5  0x00007f03331fa259 in start_thread () at /usr/lib/libpthread.so.0
#6  0x00007f03333105e3 in clone () at /usr/lib/libc.so.6

Thread 1 (Thread 0x7f0327167640 (LWP 3481)):
#0  0x00007f033324ed22 in raise () at /usr/lib/libc.so.6
#1  0x00007f03343f93e0 in KCrash::defaultCrashHandler(int) () at /usr/lib/libKF5Crash.so.5
#2  0x00007f033324eda0 in <signal handler called> () at /usr/lib/libc.so.6
#3  0x00007f033324ed22 in raise () at /usr/lib/libc.so.6
#4  0x00007f033324eda0 in <signal handler called> () at /usr/lib/libc.so.6
#5  0x00007f033324ed22 in raise () at /usr/lib/libc.so.6
#6  0x00007f03279b8d8f in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0
#7  0x00007f03279d3f5e in  () at /usr/lib/libgobject-2.0.so.0
#8  0x00007f03279d5c49 in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#9  0x00007f03279d61a0 in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#10 0x00007f0327aedf17 in  () at /usr/lib/libgio-2.0.so.0
#11 0x00007f0330866015 in g_main_context_dispatch () at /usr/lib/libglib-2.0.so.0
#12 0x00007f03308b9ba9 in  () at /usr/lib/libglib-2.0.so.0
#13 0x00007f0330863871 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#14 0x00007f032796eebe in  () at /usr/lib/gio/modules/libdconfsettings.so
#15 0x00007f03308942d1 in  () at /usr/lib/libglib-2.0.so.0
#16 0x00007f03331fa259 in start_thread () at /usr/lib/libpthread.so.0
#17 0x00007f03333105e3 in clone () at /usr/lib/libc.so.6

Comment 1 Nate Graham 2023-12-09 04:14:20 UTC

Thank you for the bug report. Unfortunately we were not able to get to it yet. Can we ask you to please check if this is still an issue with Plasma 5.27, or--even better--the Plasma 6 beta?

Comment 2 Kishore Gopalakrishnan 2023-12-10 09:43:33 UTC

(In reply to Nate Graham from comment #1)
> Thank you for the bug report. Unfortunately we were not able to get to it
> yet. Can we ask you to please check if this is still an issue with Plasma
> 5.27, or--even better--the Plasma 6 beta?

On Plasma 5.27.10, I no longer get notifications about kded crashing, but the behaviour I used to observe after a kded crash (arrow and pgup/pgdn keys getting remapped) still occasionally crops up on days when I frequently switch between ibus layouts. I don't see any easy way to figure out if the latter is related to the earlier crashes (or even related to KDE), so I'll close this as fixed.