Summary: | Plasma crashed in WorkspaceScripting::Applet::writeConfig() after changing wallpaper using context menu item | ||
---|---|---|---|
Product: | [Plasma] plasmashell | Reporter: | Cristiano Kieling <cristiano.kieling> |
Component: | generic-crash | Assignee: | Plasma Bugs List <plasma-bugs> |
Status: | RESOLVED FIXED | ||
Severity: | crash | CC: | bart, christianmillonario, joefruchey, kde, nate, qydwhotmail, rustytone |
Priority: | NOR | Keywords: | drkonqi |
Version: | 5.24.2 | ||
Target Milestone: | 1.0 | ||
Platform: | Neon | ||
OS: | Linux | ||
Latest Commit: | https://invent.kde.org/frameworks/plasma-framework/commit/76dd5f333d0abfcde46697088b0d533d6c5d79e4 | Version Fixed In: | 5.94 |
Sentry Crash Report: | |||
Attachments: | New crash information added by DrKonqi |
Description
Cristiano Kieling
2022-03-08 04:15:11 UTC
#12 WorkspaceScripting::Applet::writeConfig (this=0x564605444b10, key=..., value=...) at ./shell/scripting/applet.cpp:108 #13 0x0000564600801f21 in WorkspaceScripting::Applet::qt_static_metacall (_o=_o@entry=0x564605444b10, _c=_c@entry=QMetaObject::InvokeMetaMethod, _id=_id@entry=2, _a=_a@entry=0x7fffea05b5a0) at ./obj-x86_64-linux-gnu/shell/plasmashell_autogen/7KDSW62DQT/moc_applet.cpp:103 #14 0x0000564600804a43 in WorkspaceScripting::Applet::qt_metacall (this=this@entry=0x564605444b10, _c=_c@entry=QMetaObject::InvokeMetaMethod, _id=2, _a=_a@entry=0x7fffea05b5a0) at ./obj-x86_64-linux-gnu/shell/plasmashell_autogen/7KDSW62DQT/moc_applet.cpp:197 #15 0x0000564600804a6a in WorkspaceScripting::Containment::qt_metacall (this=0x564605444b10, _c=QMetaObject::InvokeMetaMethod, _id=<optimized out>, _a=0x7fffea05b5a0) at ./obj-x86_64-linux-gnu/shell/plasmashell_autogen/7KDSW62DQT/moc_containment.cpp:303 Fushan, would you mind taking a look when you have some time? Thanks! After seeing the bug and trying to reproduce it, plasmashell crashed for the first time. Second time is good. (gdb) bt #0 __GI___pthread_sigmask (how=1, newmask=<optimized out>, oldmask=0x0) at pthread_sigmask.c:43 #1 0x00007f576aa465ed in __GI___sigprocmask (how=<optimized out>, set=<optimized out>, oset=<optimized out>) at ../sysdeps/unix/sysv/linux/sigprocmask.c:25 #2 0x00007f576d74284b in KCrash::setCrashHandler(void (*)(int)) (handler=handler@entry=0x0) at /usr/src/debug/kcrash-5.93.0git.20220320T195329~a9fb4b5-ku.2.1.x86_64/src/kcrash.cpp:417 #3 0x00007f576d744d2e in KCrash::defaultCrashHandler(int) (sig=11) at /usr/src/debug/kcrash-5.93.0git.20220320T195329~a9fb4b5-ku.2.1.x86_64/src/kcrash.cpp:623 #4 0x00007f576aa463d0 in <signal handler called> () at /lib64/libc.so.6 #5 0x00007f576b21d898 in QMetaObject::cast(QObject const*) const (this=0x7f576b4e1a60 <QObject::staticMetaObject>, obj=0x1a11f30) at kernel/qmetaobject.cpp:382 #6 0x00000000004354dc in qobject_cast<QObject*>(QObject*) (object=0x1a11f30) at /usr/include/qt5/QtCore/qobject.h:524 #7 0x00000000004353c1 in QtPrivate::QVariantValueHelper<QObject*>::object(QVariant const&) (v=...) at /usr/include/qt5/QtCore/qvariant.h:753 #8 0x000000000043526d in QtPrivate::ObjectInvoker<QtPrivate::QVariantValueHelper<QObject*>, QVariant const&, QObject*>::invoke(QVariant const&) (a=...) at /usr/include/qt5/QtCore/qvariant.h:107 #9 0x0000000000434f3e in qvariant_cast<QObject*>(QVariant const&) (v=...) at /usr/include/qt5/QtCore/qvariant.h:879 #10 0x0000000000434874 in QVariant::value<QObject*>() const (this=0x7ffc8f365500) at /usr/include/qt5/QtCore/qvariant.h:367 #11 0x000000000049a246 in WorkspaceScripting::Applet::writeConfig(QString const&, QJSValue const&) (this=0x611fc00, key=..., value=...) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/shell/scripting/applet.cpp:108 #12 0x00000000004238fe in WorkspaceScripting::Applet::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (_o=0x611fc00, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x7ffc8f365830) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/build/shell/plasmashell_autogen/7KDSW62DQT/moc_applet.cpp:103 #13 0x0000000000423d9b in WorkspaceScripting::Applet::qt_metacall(QMetaObject::Call, int, void**) (this=0x611fc00, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x7ffc8f365830) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/build/shell/plasmashell_autogen/7KDSW62DQT/moc_applet.cpp:197 #14 0x000000000042557a in WorkspaceScripting::Containment::qt_metacall(QMetaObject::Call, int, void**) (this=0x611fc00, _c=QMetaObject::InvokeMetaMethod, _id=7, _a=0x7ffc8f365830) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/build/shell/plasmashell_autogen/7KDSW62DQT/moc_containment.cpp:303 #15 0x00007f576cdbf1cd in QQmlObjectOrGadget::metacall(QMetaObject::Call, int, void**) const (this=this@entry=0x7ffc8f365ac0, type=type@entry=QMetaObject::InvokeMetaMethod, index=<optimized out>, index@entry=7, argv=<optimized out>) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/qml/qqmlobjectorgadget.cpp:51 #16 0x00007f576cc9e1f0 in CallMethod (callType=<optimized out>, callArgs=0x475, engine=<optimized out>, argTypes=<optimized out>, argCount=<optimized out>, returnType=<optimized out>, index=<optimized out>, object=...) at /usr/include/qt5/QtCore/qvarlengtharray.h:189 #17 CallPrecise(QQmlObjectOrGadget const&, QQmlPropertyData const&, QV4::ExecutionEngine*, QV4::CallData*, QMetaObject::Call) (object=..., data=<optimized out>, engine=engine@entry= 0x9b92e0, callArgs=callArgs@entry=0x7f56fd904588, callType=callType@entry=QMetaObject::InvokeMetaMethod) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4qobjectwrapper.cpp:1569 #18 0x00007f576cc9ffdb in CallOverloaded --Type <RET> for more, q to quit, c to continue without paging--c (callType=<optimized out>, propertyCache=<optimized out>, callArgs=<optimized out>, engine=<optimized out>, data=<optimized out>, object=<optimized out>) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4qobjectwrapper.cpp:1645 #19 QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const (this=<optimized out>, thisObject=<optimized out>, argv=<optimized out>, argc=<optimized out>) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4qobjectwrapper.cpp:2133 #20 0x00007f576ccd44e2 in QV4::FunctionObject::call(QV4::Value const*, QV4::Value const*, int) const (argc=2, argv=0x7f56fd904528, thisObject=0x7f56fd904510, this=<optimized out>) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4functionobject_p.h:202 #21 QV4::Runtime::CallProperty::call(QV4::ExecutionEngine*, QV4::Value const&, int, QV4::Value*, int) (engine=0x9b92e0, baseRef=<optimized out>, nameIndex=<optimized out>, argv=0x7f56fd904528, argc=2) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4runtime.cpp:1448 #22 0x00007f576ccbbf9a in QV4::Moth::VME::interpret(QV4::CppStackFrame*, QV4::ExecutionEngine*, char const*) (frame=0x7ffc8f365e40, engine=0x9b92e0, code=0x7eee1c0 "\030\006*\003r\030\bx0\003RH\224\374\026\006\002") at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4vme_moth.cpp:351 #23 0x00007f576ccbf917 in QV4::Moth::VME::exec(QV4::CppStackFrame*, QV4::ExecutionEngine*) (frame=frame@entry=0x7ffc8f365e40, engine=engine@entry=0x9b92e0) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4vme_moth.cpp:463 #24 0x00007f576cc52d3e in QV4::Function::call(QV4::Value const*, QV4::Value const*, int, QV4::ExecutionContext const*) (this=<optimized out>, thisObject=<optimized out>, argv=argv@entry=0x0, argc=argc@entry=0, context=<optimized out>) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4function.cpp:69 #25 0x00007f576cc9169c in QV4::Script::run(QV4::Value const*) (this=this@entry=0x7ffc8f365f20, thisObject=thisObject@entry=0x0) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsruntime/qv4script.cpp:162 #26 0x00007f576cc09e12 in QJSEngine::evaluate(QString const&, QString const&, int) (this=<optimized out>, program=..., fileName=<optimized out>, lineNumber=1) at /usr/src/debug/libqt5-qtdeclarative-5.15.2+kde43-ku.1.1.x86_64/src/qml/jsapi/qjsengine.cpp:545 #27 0x00000000004a191e in WorkspaceScripting::ScriptEngine::evaluateScript(QString const&, QString const&) (this=0x7ffc8f3660b0, script=..., path=...) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/shell/scripting/scriptengine.cpp:244 #28 0x000000000045f95a in ShellCorona::evaluateScript(QString const&) (this=0xb04ac0, script=...) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/shell/shellcorona.cpp:1447 #29 0x00000000004ac208 in PlasmaShellAdaptor::evaluateScript(QString const&) (this=0xc67d60, script=...) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/build/shell/plasmashelladaptor.cpp:63 #30 0x00000000004ac3d7 in PlasmaShellAdaptor::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (_o=0xc67d60, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x7ffc8f366320) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/build/shell/plasmashelladaptor.moc:134 #31 0x00000000004ac605 in PlasmaShellAdaptor::qt_metacall(QMetaObject::Call, int, void**) (this=0xc67d60, _c=QMetaObject::InvokeMetaMethod, _id=2, _a=0x7ffc8f366320) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/build/shell/plasmashelladaptor.moc:197 #32 0x00007f576bd416ab in QDBusConnectionPrivate::deliverCall(QObject*, int, QDBusMessage const&, QVector<int> const&, int) (this=<optimized out>, object=<optimized out>, msg=<optimized out>, metaTypes=<optimized out>, slotIdx=<optimized out>) at ../../include/QtCore/../../src/corelib/tools/qvarlengtharray.h:189 #33 0x00007f576bd450dc in QDBusConnectionPrivate::activateCall(QObject*, int, QDBusMessage const&) (this=this@entry=0x7f5758006800, object=0xc67d60, flags=flags@entry=273, msg=...) at qdbusintegrator.cpp:904 #34 0x00007f576bd45ae9 in QDBusConnectionPrivate::activateCall(QObject*, int, QDBusMessage const&) (msg=..., flags=273, object=<optimized out>, this=0x7f5758006800) at qdbusintegrator.cpp:853 #35 QDBusConnectionPrivate::activateObject(QDBusConnectionPrivate::ObjectTreeNode&, QDBusMessage const&, int) (this=0x7f5758006800, node=..., msg=..., pathStartPos=<optimized out>) at qdbusintegrator.cpp:1497 #36 0x00007f576bd47e88 in QDBusActivateObjectEvent::placeMetaCall(QObject*) (this=0x7d25cf0) at qdbusintegrator.cpp:1617 #37 0x00007f576b2414ae in QObject::event(QEvent*) (this=0xb04ac0, e=0x7d25cf0) at kernel/qobject.cpp:1314 #38 0x00007f576bfb4a7f in QApplicationPrivate::notify_helper(QObject*, QEvent*) (this=<optimized out>, receiver=0xb04ac0, e=0x7d25cf0) at kernel/qapplication.cpp:3632 #39 0x00007f576b214e3a in QCoreApplication::notifyInternal2(QObject*, QEvent*) (receiver=0xb04ac0, event=0x7d25cf0) at kernel/qcoreapplication.cpp:1064 #40 0x00007f576b217e77 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (receiver=0x0, event_type=0, data=0x8d4a90) at kernel/qcoreapplication.cpp:1821 #41 0x00007f576b26cd03 in postEventSourceDispatch(GSource*, GSourceFunc, gpointer) (s=s@entry=0xa510d0) at kernel/qeventdispatcher_glib.cpp:277 #42 0x00007f57696efe22 in g_main_dispatch (context=0x7f5760005010) at ../glib/gmain.c:3381 #43 g_main_context_dispatch (context=0x7f5760005010) at ../glib/gmain.c:4099 #44 0x00007f57696f01b8 in g_main_context_iterate (context=context@entry=0x7f5760005010, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4175 #45 0x00007f57696f026f in g_main_context_iteration (context=0x7f5760005010, may_block=1) at ../glib/gmain.c:4240 #46 0x00007f576b26c384 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=0xa65210, flags=...) at kernel/qeventdispatcher_glib.cpp:423 #47 0x00007f576b21383b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7ffc8f366900, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69 #48 0x00007f576b21bb10 in QCoreApplication::exec() () at ../../include/QtCore/../../src/corelib/global/qflags.h:121 #49 0x0000000000431014 in main(int, char**) (argc=2, argv=0x7ffc8f366e98) at /mnt/data/home/qydw/Develop/KDE/Plasma/plasma-workspace/shell/main.cpp:243 *** Bug 452001 has been marked as a duplicate of this bug. *** *** Bug 452632 has been marked as a duplicate of this bug. *** Git commit 76dd5f333d0abfcde46697088b0d533d6c5d79e4 by Nate Graham, on behalf of Jakub Nowak. Committed on 22/04/2022 at 00:29. Pushed by ngraham into branch 'master'. Fix use-after-free in ContainmentInterface The object in property "wallpaperGraphicsObject" isn't cleared after being freed. This causes use-after-free in WorkspaceScripting::Applet::writeConfig at https://invent.kde.org/plasma/plasma-workspace/-/blob/master/shell/scripting/applet.cpp#L108. FIXED-IN: 5.94 M +9 -4 src/scriptengines/qml/plasmoid/containmentinterface.cpp M +1 -0 src/scriptengines/qml/plasmoid/containmentinterface.h https://invent.kde.org/frameworks/plasma-framework/commit/76dd5f333d0abfcde46697088b0d533d6c5d79e4 Created attachment 148540 [details]
New crash information added by DrKonqi
plasmashell (5.24.4) using Qt 5.15.3
- What I was doing when the application crashed:
I changed the wallpaper through Dolphin.
- Unusual behavior I noticed:
I changed the wallpaper through Dolphin because I couldn't open the context menu on my main screen. This happens when connected to my Dell D600 dock with the latest DisplayLink driver installed.
-- Backtrace (Reduced):
#6 0x0000563d5daf5006 in qobject_cast<QObject*> (object=<optimized out>) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobject.h:519
#7 QtPrivate::QVariantValueHelper<QObject*>::object (v=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qvariant.h:753
#8 QtPrivate::ObjectInvoker<QtPrivate::QVariantValueHelper<QObject*>, QVariant const&, QObject*>::invoke (a=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qvariant.h:107
#9 qvariant_cast<QObject*> (v=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qvariant.h:879
#10 QVariant::value<QObject*> (this=0x7fffbb878a70) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qvariant.h:367
*** Bug 453436 has been marked as a duplicate of this bug. *** |