Summary: | Plasma crashed inMpris2Engine::serviceOwnerChanged() after closing all running apps with middle-click on their entries in task manager | ||
---|---|---|---|
Product: | [Plasma] plasmashell | Reporter: | Patrick Silva <bugseforuns> |
Component: | DataEngines | Assignee: | Plasma Bugs List <plasma-bugs> |
Status: | RESOLVED FIXED | ||
Severity: | crash | CC: | jacobbyrd, kde, mwaterbu, nate, plasma-bugs, qydwhotmail, rgeorgiev583, sitter, till2.schaefer |
Priority: | HI | Keywords: | drkonqi |
Version: | master | ||
Target Milestone: | 1.0 | ||
Platform: | Neon | ||
OS: | Linux | ||
See Also: | https://bugs.kde.org/show_bug.cgi?id=410092 | ||
Latest Commit: | https://invent.kde.org/plasma/plasma-workspace/-/commit/84b65b26338d7fbff15ccda23fda336a07ba915e | Version Fixed In: | 6.0 |
Sentry Crash Report: |
Description
Patrick Silva
2021-12-05 18:54:27 UTC
It seems the crash is not related to m_multiplexer. Investigating... It's possible that `QDBusServiceWatcher::serviceOwnerChanged` is emitted before `Mpris2Engine::initialFetchFinished`, so the same source is added twice. A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/1358 I think I experienced the same issue on Plasma Frameworks 5.91.0, Plasma Workspace 5.24.2… Application: Plasma (plasmashell), signal: Segmentation fault Content of s_kcrashErrorMessage: std::unique_ptr<char []> = {get() = 0x0} [KCrash Handler] #6 QHashData::nextNode (node=node@entry=0x55e5ee669d10) at ../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/tools/qhash.cpp:591 #7 0x00007f96f4bf8e49 in QHash<QString, Plasma::DataContainer*>::iterator::operator++ (this=<synthetic pointer>) at /usr/include/qt5/QtCore/qhash.h:351 #8 QHash<QString, Plasma::DataContainer*>::erase (this=0x7f96b4098db8, it=it@entry=...) at /usr/include/qt5/QtCore/qhash.h:879 #9 0x00007f96f4bf82af in QHash<QString, Plasma::DataContainer*>::erase (it=..., this=<optimized out>) at /usr/include/qt5/QtCore/qhash.h:409 #10 Plasma::DataEngine::removeSource (this=this@entry=0x55e5ec114dd0, source=...) at ../plasma-framework-5.91.0/src/plasma/dataengine.cpp:295 #11 0x00007f96b1087a3f in Mpris2Engine::serviceOwnerChanged (this=0x55e5ec114dd0, serviceName=..., oldOwner=..., newOwner=...) at ../plasma-workspace-5.24.2/dataengines/mpris2/mpris2engine.cpp:71 #12 0x00007f96b10896eb in QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1, 2>, QtPrivate::List<QString const&, QString const&, QString const&>, void, void (Mpris2Engine::*)(QString const&, QString const&, QString const&)>::call (arg=<optimized out>, o=<optimized out>, f=<optimized out>) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:152 #13 QtPrivate::FunctionPointer<void (Mpris2Engine::*)(QString const&, QString const&, QString const&)>::call<QtPrivate::List<QString const&, QString const&, QString const&>, void> (arg=<optimized out>, o=<optimized out>, f=<optimized out>) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:185 #14 QtPrivate::QSlotObject<void (Mpris2Engine::*)(QString const&, QString const&, QString const&), QtPrivate::List<QString const&, QString const&, QString const&>, void>::impl (which=<optimized out>, this_=<optimized out>, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:418 #15 0x00007f96f2afe805 in QtPrivate::QSlotObjectBase::call (a=0x7ffe00d38570, r=0x55e5ec114dd0, this=0x55e5ecc31d60) at ../../include/QtCore/../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/kernel/qobjectdefs_impl.h:398 #16 doActivate<false> (sender=0x55e5ec420890, signal_index=5, argv=0x7ffe00d38570) at ../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/kernel/qobject.cpp:3886 #17 0x00007f96f2af81af in QMetaObject::activate (sender=sender@entry=0x55e5ec420890, m=m@entry=0x7f96f34ba6a0 <QDBusServiceWatcher::staticMetaObject>, local_signal_index=local_signal_index@entry=2, argv=argv@entry=0x7ffe00d38570) at ../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/kernel/qobject.cpp:3946 #18 0x00007f96f349c1b8 in QDBusServiceWatcher::serviceOwnerChanged (this=this@entry=0x55e5ec420890, _t1=..., _t2=..., _t3=...) at .moc/moc_qdbusservicewatcher.cpp:242 #19 0x00007f96f349cb1a in QDBusServiceWatcherPrivate::_q_serviceOwnerChanged (newOwner=..., oldOwner=..., service=..., this=<optimized out>) at ../../../qtbase-c2ea67ecefe049f6e9bb8f910d7f9c60319d8619/src/dbus/qdbusservicewatcher.cpp:76 #20 QDBusServiceWatcher::qt_static_metacall (_o=<optimized out>, _c=<optimized out>, _id=<optimized out>, _a=<optimized out>) at .moc/moc_qdbusservicewatcher.cpp:116 #21 0x00007f96f349cfab in QDBusServiceWatcher::qt_metacall (this=0x55e5ec420890, _c=QMetaObject::InvokeMetaMethod, _id=3, _a=0x7ffe00d386d0) at .moc/moc_qdbusservicewatcher.cpp:197 #22 0x00007f96f3445a0a in QDBusConnectionPrivate::deliverCall (this=<optimized out>, object=<optimized out>, msg=..., metaTypes=..., slotIdx=<optimized out>) at ../../include/QtCore/../../../qtbase-c2ea67ecefe049f6e9bb8f910d7f9c60319d8619/src/corelib/tools/qvarlengtharray.h:190 #23 0x00007f96f2af4f0e in QObject::event (this=0x55e5ec420890, e=0x7f96e0147820) at ../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/kernel/qobject.cpp:1314 #24 0x00007f96f3807edf in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x55e5ec420890, e=0x7f96e0147820) at ../../../qtbase-c9fde86b0a2440133bc08f4811b6ca793be47f0a/src/widgets/kernel/qapplication.cpp:3632 #25 0x00007f96f2aca60a in QCoreApplication::notifyInternal2 (receiver=0x55e5ec420890, event=0x7f96e0147820) at ../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/kernel/qcoreapplication.cpp:1064 #26 0x00007f96f2acd373 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x55e5ebc97e20) at ../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/kernel/qcoreapplication.cpp:1821 #27 0x00007f96f2b1ee43 in postEventSourceDispatch (s=0x55e5ebd6cf20) at ../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/kernel/qeventdispatcher_glib.cpp:277 #28 0x00007f96f0f5f4cc in g_main_dispatch (context=0x7f96e8005000) at ../glib-2.70.4/glib/gmain.c:3381 #29 g_main_context_dispatch (context=0x7f96e8005000) at ../glib-2.70.4/glib/gmain.c:4099 #30 0x00007f96f0f5f738 in g_main_context_iterate (context=context@entry=0x7f96e8005000, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib-2.70.4/glib/gmain.c:4175 #31 0x00007f96f0f5f7df in g_main_context_iteration (context=0x7f96e8005000, may_block=1) at ../glib-2.70.4/glib/gmain.c:4240 #32 0x00007f96f2b1e508 in QEventDispatcherGlib::processEvents (this=0x55e5ebd72eb0, flags=...) at ../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/kernel/qeventdispatcher_glib.cpp:423 #33 0x00007f96f2ac917b in QEventLoop::exec (this=this@entry=0x7ffe00d38ae0, flags=..., flags@entry=...) at ../../include/QtCore/../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/global/qflags.h:69 #34 0x00007f96f2ad0dcc in QCoreApplication::exec () at ../../include/QtCore/../../../qtbase-f4ac0b55c37f2b594ffbe639db43dac365825c7c/src/corelib/global/qflags.h:121 #35 0x00007f96f2ed6f2c in QGuiApplication::exec () at ../../../qtbase-38ad2f39daec09168728033969265834b6a2d924/src/gui/kernel/qguiapplication.cpp:1867 #36 0x00007f96f3807e55 in QApplication::exec () at ../../../qtbase-c9fde86b0a2440133bc08f4811b6ca793be47f0a/src/widgets/kernel/qapplication.cpp:2824 #37 0x000055e5e9fa1a68 in main (argc=<optimized out>, argv=<optimized out>) at ../plasma-workspace-5.24.2/shell/main.cpp:238 [Inferior 1 (process 30402) detached] *** Bug 460392 has been marked as a duplicate of this bug. *** *** Bug 463122 has been marked as a duplicate of this bug. *** *** Bug 469199 has been marked as a duplicate of this bug. *** *** Bug 469495 has been marked as a duplicate of this bug. *** *** Bug 470955 has been marked as a duplicate of this bug. *** I suspect this broke as part of https://invent.kde.org/frameworks/plasma-framework/-/commit/5984d4960fa5ecf60a20b1fbc782fb841faa4af7 because the emit is potentially triggering blocking call chains (through qobject connects) into other parts of the dataengine that may mutate d->sources such that the iterator is no longer valid once erase() runs. At least that's the only explanation I have for the backtrace. The trace only really happens if the iterator is invalid (e.g. if you erase(end()++) you'd get that trace). That being said, I don't see where that call chain happens nor can I reproduce the crash. A blind fix would be to move the emits out of iteration scopes. This way we preserve the notify-before-removal behavior while also ensuring that iterators cannot go invalid mid-flight. A possibly relevant merge request was started @ https://invent.kde.org/frameworks/plasma-framework/-/merge_requests/816 A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma5support/-/merge_requests/9 Git commit 2d932664829348775eb0bda9cfefe66c0dd6c85e by Harald Sitter. Committed on 04/07/2023 at 12:36. Pushed by sitter into branch 'kf5'. dataengine: do not emit removal signals while iterators are open this likely caused connect-based call chains into client code that would then mutate the underlying container such that the iterator goes invalid mid-removal resulting in a crash. to solve this simply emit the signals all in one go initially, before iterating the sources for removal M +12 -3 src/plasma/dataengine.cpp https://invent.kde.org/frameworks/plasma-framework/-/commit/2d932664829348775eb0bda9cfefe66c0dd6c85e Git commit d9c52371f487a4fd53f9d0b18760d0b902500695 by Harald Sitter. Committed on 04/07/2023 at 12:36. Pushed by sitter into branch 'master'. dataengine: do not emit removal signals while iterators are open this likely caused connect-based call chains into client code that would then mutate the underlying container such that the iterator goes invalid mid-removal resulting in a crash. to solve this simply emit the signals all in one go initially, before iterating the sources for removal M +12 -3 src/plasma5support/dataengine.cpp https://invent.kde.org/plasma/plasma5support/-/commit/d9c52371f487a4fd53f9d0b18760d0b902500695 Git commit 84b65b26338d7fbff15ccda23fda336a07ba915e by Fushan Wen. Committed on 11/11/2023 at 01:11. Pushed by fusionfuture into branch 'master'. libkmpris: record source names of pending players When a player container hasn't finished its initialization, it may already disappear on DBus, so onServiceOwnerChanged will call `removeMediaPlayer` prematurely. This adds several checks to guard the situation. FIXED-IN: 6.0 M +22 -7 libkmpris/mpris2sourcemodel.cpp M +3 -2 libkmpris/mpris2sourcemodel.h M +20 -4 libkmpris/multiplexer.cpp https://invent.kde.org/plasma/plasma-workspace/-/commit/84b65b26338d7fbff15ccda23fda336a07ba915e |