Bug 471531

*** Bug 471465 has been marked as a duplicate of this bug. ***

Other bug shows 5.107.0 affected, too.

*** Bug 461318 has been marked as a duplicate of this bug. ***

*** Bug 462826 has been marked as a duplicate of this bug. ***

*** Bug 470478 has been marked as a duplicate of this bug. ***

*** Bug 468323 has been marked as a duplicate of this bug. ***

*** Bug 466663 has been marked as a duplicate of this bug. ***

-- Backtrace:
Application: Dolphin (dolphin), signal: Segmentation fault
Content of s_kcrashErrorMessage: std::unique_ptr<char []> = {get() = <optimized out>}
[KCrash Handler]
#6  0x00007f49c8abab63 in QObject::property (this=this@entry=0x55889ae883d0, name=name@entry=0x7f49ca906f96 "desktopFileName") at kernel/qobject.cpp:4123
#7  0x00007f49ca900b85 in KUiServerV2JobTracker::registerJob (this=0x55889aeba0a0, job=<optimized out>) at /usr/src/debug/kjobwidgets/kjobwidgets-5.103.0/src/kuiserverv2jobtracker.cpp:186
#8  0x00007f49ca8fdae3 in operator() (__closure=0x55889aeccd60) at /usr/src/debug/kjobwidgets/kjobwidgets-5.103.0/src/kuiserverv2jobtracker.cpp:227
#9  QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, KUiServerV2JobTracker::registerJob(KJob*)::<lambda()> >::call (arg=<optimized out>, f=...) at /usr/include/qt/QtCore/qobjectdefs_impl.h:146
#10 QtPrivate::Functor<KUiServerV2JobTracker::registerJob(KJob*)::<lambda()>, 0>::call<QtPrivate::List<>, void> (arg=<optimized out>, f=...) at /usr/include/qt/QtCore/qobjectdefs_impl.h:256
#11 QtPrivate::QFunctorSlotObject<KUiServerV2JobTracker::registerJob(KJob*)::<lambda()>, 0, QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void **, bool *) (which=<optimized out>, this_=0x55889aeccd50, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/qt/QtCore/qobjectdefs_impl.h:443
#12 0x00007f49c8abea71 in QtPrivate::QSlotObjectBase::call (a=<optimized out>, r=<optimized out>, this=<optimized out>, this=<optimized out>, r=<optimized out>, a=<optimized out>) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#13 doActivate<false> (sender=0x7f49ca90e060 <_ZZN12_GLOBAL__N_117Q_QGS_serverProxy13innerFunctionEvE6holder.lto_priv.1>, signal_index=3, argv=0x7ffdaf9bd9e0) at kernel/qobject.cpp:3923
#14 0x00007f49c8abea71 in QtPrivate::QSlotObjectBase::call (a=<optimized out>, r=<optimized out>, this=<optimized out>, this=<optimized out>, r=<optimized out>, a=<optimized out>) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#15 doActivate<false> (sender=0x55889aebdbe0, signal_index=5, argv=0x7ffdaf9bdb00) at kernel/qobject.cpp:3923
#16 0x00007f49c9eb9e94 in QDBusServiceWatcher::serviceOwnerChanged (this=this@entry=0x55889aebdbe0, _t1=..., _t2=..., _t3=...) at .moc/moc_qdbusservicewatcher.cpp:242
#17 0x00007f49c9ebfb33 in QDBusServiceWatcherPrivate::_q_serviceOwnerChanged (this=<optimized out>, newOwner=..., oldOwner=..., service=...) at /usr/src/debug/qt5-base/qtbase/src/dbus/qdbusservicewatcher.cpp:76
#18 QDBusServiceWatcher::qt_static_metacall (_o=_o@entry=0x55889aebdbe0, _c=_c@entry=QMetaObject::InvokeMetaMethod, _id=_id@entry=3, _a=_a@entry=0x7ffdaf9bdc80) at .moc/moc_qdbusservicewatcher.cpp:116
#19 0x00007f49c9ebfe13 in QDBusServiceWatcher::qt_metacall (this=0x55889aebdbe0, _c=QMetaObject::InvokeMetaMethod, _id=3, _a=0x7ffdaf9bdc80) at .moc/moc_qdbusservicewatcher.cpp:197
#20 0x00007f49c9ec345f in QDBusConnectionPrivate::deliverCall(QObject*, int, QDBusMessage const&, QVector<int> const&, int) [clone .constprop.0] (this=<optimized out>, object=<optimized out>, msg=..., metaTypes=..., slotIdx=<optimized out>) at /usr/src/debug/qt5-base/qtbase/src/dbus/qdbusintegrator.cpp:1001
#21 0x00007f49c8ab1bb0 in QObject::event (this=0x55889aebdbe0, e=0x7f49bc011ec0) at kernel/qobject.cpp:1347
#22 0x00007f49c9778b5c in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x55889aebdbe0, e=0x7f49bc011ec0) at kernel/qapplication.cpp:3640
#23 0x00007f49c8a8df48 in QCoreApplication::notifyInternal2 (receiver=0x55889aebdbe0, event=0x7f49bc011ec0) at kernel/qcoreapplication.cpp:1064
#24 0x00007f49c8a8dfb3 in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462
#25 0x00007f49c8a8ea53 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x55889a0edad0) at kernel/qcoreapplication.cpp:1821
#26 0x00007f49c8ad4e88 in postEventSourceDispatch (s=0x55889a115da0) at kernel/qeventdispatcher_glib.cpp:277
#27 0x00007f49c691682b in g_main_dispatch (context=0x7f49bc005010) at ../glib/glib/gmain.c:3454
#28 g_main_context_dispatch (context=0x7f49bc005010) at ../glib/glib/gmain.c:4172
#29 0x00007f49c696dcc9 in g_main_context_iterate.constprop.0 (context=0x7f49bc005010, block=1, dispatch=1, self=<optimized out>) at ../glib/glib/gmain.c:4248
#30 0x00007f49c69150e2 in g_main_context_iteration (context=0x7f49bc005010, may_block=1) at ../glib/glib/gmain.c:4313
#31 0x00007f49c8ad8c6c in QEventDispatcherGlib::processEvents (this=0x55889a0c95c0, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#32 0x00007f49c8a866ec in QEventLoop::exec (this=0x7ffdaf9be150, flags=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#33 0x00007f49c8a91219 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#34 0x00007f49c8f39fe2 in QGuiApplication::exec () at kernel/qguiapplication.cpp:1870
#35 0x00007f49c9776f2a in QApplication::exec () at kernel/qapplication.cpp:2832
#36 0x00005588996e4f53 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dolphin/dolphin-22.12.2/src/main.cpp:258
[Inferior 1 (process 11756) detached]

*** Bug 465820 has been marked as a duplicate of this bug. ***

*** Bug 465717 has been marked as a duplicate of this bug. ***

*** Bug 464900 has been marked as a duplicate of this bug. ***

*** Bug 464653 has been marked as a duplicate of this bug. ***

*** Bug 463690 has been marked as a duplicate of this bug. ***

*** Bug 461825 has been marked as a duplicate of this bug. ***

*** Bug 457314 has been marked as a duplicate of this bug. ***

*** Bug 473455 has been marked as a duplicate of this bug. ***

*** Bug 473781 has been marked as a duplicate of this bug. ***

*** Bug 455696 has been marked as a duplicate of this bug. ***

*** Bug 476582 has been marked as a duplicate of this bug. ***

*** Bug 476202 has been marked as a duplicate of this bug. ***

*** Bug 475803 has been marked as a duplicate of this bug. ***

*** Bug 473625 has been marked as a duplicate of this bug. ***

*** Bug 473722 has been marked as a duplicate of this bug. ***

*** Bug 474156 has been marked as a duplicate of this bug. ***

*** Bug 474867 has been marked as a duplicate of this bug. ***

*** Bug 473482 has been marked as a duplicate of this bug. ***

Git commit 75410fa3df5fbb182790a14af22ce5705cc1b86d by Méven Car.
Committed on 03/12/2023 at 09:41.
Pushed by meven into branch 'master'.

KUiServerV2JobTracker: prevent potenial use-after-free

M  +7    -5    src/kuiserverv2jobtracker.cpp

https://invent.kde.org/frameworks/kjobwidgets/-/commit/75410fa3df5fbb182790a14af22ce5705cc1b86d

A possibly relevant merge request was started @ https://invent.kde.org/frameworks/kjobwidgets/-/merge_requests/48

Git commit 10f8cb306978f2a70d2e4388b67cc6855a1ca8a3 by Méven Car.
Committed on 03/12/2023 at 16:27.
Pushed by cullmann into branch 'kf5'.

KUiServerV2JobTracker: prevent potenial use-after-free
(cherry picked from commit 75410fa3df5fbb182790a14af22ce5705cc1b86d)

M  +7    -5    src/kuiserverv2jobtracker.cpp

https://invent.kde.org/frameworks/kjobwidgets/-/commit/10f8cb306978f2a70d2e4388b67cc6855a1ca8a3

*** Bug 480524 has been marked as a duplicate of this bug. ***

*** Bug 481529 has been marked as a duplicate of this bug. ***

*** Bug 484297 has been marked as a duplicate of this bug. ***

*** Bug 483153 has been marked as a duplicate of this bug. ***

*** Bug 481451 has been marked as a duplicate of this bug. ***

*** Bug 481343 has been marked as a duplicate of this bug. ***

*** Bug 481169 has been marked as a duplicate of this bug. ***

A possibly relevant merge request was started @ https://invent.kde.org/frameworks/kjobwidgets/-/merge_requests/53

Git commit 6f3496ce99d5cb9e4ce561d0bfc3b703fe9eec24 by Christoph Cullmann, on behalf of Méven Car.
Committed on 07/05/2024 at 19:28.
Pushed by cullmann into branch 'master'.

KUiServerV2JobTracker: prevent a crash
Related: bug 483582

This is a very-common crash, happening when plasma crashes itself:
https://crash-reports.kde.org/organizations/kde/issues/10390/activity/?project=4&query=is%3Aunresolved&referrer=issue-stream&stream_index=0

I think this is due to the line 204 indeed, dereferencing a jobViews key, which is nullptr, because the `QTimer::timeout` callback in `KUiServerV2JobTracker::registerJob` did implicitely insert a jobViews[nullptr] when the job was already removed. Guard with jobGuard.
The first change is not necessary but I felt it makes the code implicit, otherwise we have a QPointer implicit conversion to `*`.

cc @broulik

M  +5    -6    src/kuiserverv2jobtracker.cpp

https://invent.kde.org/frameworks/kjobwidgets/-/commit/6f3496ce99d5cb9e4ce561d0bfc3b703fe9eec24

This doesn't seem to be fixed. https://crash-reports.kde.org/organizations/kde/issues/72734

https://crash-reports.kde.org/organizations/kde/issues/23395

Operating System: Arch Linux 
KDE Plasma Version: 6.4.3
KDE Frameworks Version: 6.16.0
Qt Version: 6.9.1
Kernel Version: 6.12.38-1-lts (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 5800X 8-Core Processor
Memory: 32 GiB of RAM (31.2 GiB usable)
Graphics Processor: NVIDIA GeForce RTX 2070 SUPER
Manufacturer: Gigabyte Technology Co., Ltd.
Product Name: B550 VISION D
System Version: -CF


#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=11, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x000078cf31339813 in __pthread_kill_internal (threadid=<optimized out>, signo=11) at pthread_kill.c:89
#2  0x000078cf312dfdc0 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#3  0x000078cf3331ee97 in KCrash::defaultCrashHandler (sig=11) at /usr/src/debug/kcrash/kcrash-6.16.0/src/kcrash.cpp:605
#4  0x000078cf312dfef0 in <signal handler called> () at /usr/lib/libc.so.6
#5  std::__atomic_base<int>::fetch_add (this=0x1, __i=1, __m=std::memory_order_acq_rel, this=<optimized out>, __i=<optimized out>, __m=<optimized out>) at /usr/include/c++/15.1.1/bits/atomic_base.h:629
#6  QAtomicOps<int>::ref<int> (_q_value=<error reading variable: Cannot access memory at address 0x1>, _q_value=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/thread/qatomic_cxx11.h:259
#7  QBasicAtomicInteger<int>::ref (this=0x1, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/thread/qbasicatomic.h:47
#8  QtSharedPointer::ExternalRefCountData::getAndRef (obj=obj@entry=0x5abc83965da0) at /usr/src/debug/qt6-base/qtbase/src/corelib/tools/qsharedpointer.cpp:1536
#9  0x000078cf2f8e0589 in QWeakPointer<QObject>::QWeakPointer<KJob, true> (this=<synthetic pointer>, ptr=0x5abc83965da0, this=<optimized out>, ptr=<optimized out>) at /usr/include/qt6/QtCore/qsharedpointer_impl.h:773
#10 QPointer<KJob>::QPointer<void> (this=<synthetic pointer>, p=0x5abc83965da0, this=<optimized out>, p=<optimized out>) at /usr/include/qt6/QtCore/qpointer.h:37
#11 operator() (__closure=0x5abc82ff34a0) at /usr/src/debug/kjobwidgets/kjobwidgets-6.16.0/src/kuiserverv2jobtracker.cpp:204
#12 0x000078cf318fb7ef in QtPrivate::QSlotObjectBase::call (this=0x5abc82ff3490, r=0x78cf2400a8b0, a=0x7ffcce3d3a28, this=<optimized out>, r=<optimized out>, a=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#13 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4146
#14 0x000078cf318fb7ef in QtPrivate::QSlotObjectBase::call (this=0x5abc83194eb0, r=0x78cf2f8efd40 <QGlobalStatic<QtGlobalStatic::Holder<(anonymous namespace)::Q_QGS_serverProxy> >::instance()::holder>, a=0x7ffcce3d3bc0, this=<optimized out>, r=<optimized out>, a=<optimized out>)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#15 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4146
#16 0x000078cf30f5ac94 in QMetaObject::activate<void, QString, QString, QString>
    (sender=0x5abc83177ce0, mo=0x78cf30f82860 <QDBusServiceWatcher::staticMetaObject>, local_signal_index=2, ret=0x0, sender=<optimized out>, mo=<optimized out>, local_signal_index=<optimized out>, ret=<optimized out>)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs.h:306
#17 QDBusServiceWatcher::serviceOwnerChanged (this=0x5abc83177ce0, _t1=..., _t2=..., _t3=...) at /usr/src/debug/qt6-base/build/src/dbus/DBus_autogen/include/moc_qdbusservicewatcher.cpp:202
#18 QDBusServiceWatcherPrivate::_q_serviceOwnerChanged (this=<optimized out>, service=..., oldOwner=..., newOwner=...) at /usr/src/debug/qt6-base/qtbase/src/dbus/qdbusservicewatcher.cpp:53
#19 QDBusServiceWatcher::qt_static_metacall (_o=_o@entry=0x5abc83177ce0, _c=_c@entry=QMetaObject::InvokeMetaMethod, _id=_id@entry=3, _a=_a@entry=0x7ffcce3d3d68) at /usr/src/debug/qt6-base/build/src/dbus/DBus_autogen/include/moc_qdbusservicewatcher.cpp:113
#20 0x000078cf30f5aee7 in QDBusServiceWatcher::qt_metacall (this=0x5abc83177ce0, _c=<optimized out>, _id=3, _a=0x7ffcce3d3d68) at /usr/src/debug/qt6-base/build/src/dbus/DBus_autogen/include/moc_qdbusservicewatcher.cpp:170
#21 0x000078cf30f0cb09 in QDBusConnectionPrivate::deliverCall (this=0x78cf24001690, object=0x5abc83177ce0, msg=..., metaTypes=..., slotIdx=7) at /usr/src/debug/qt6-base/qtbase/src/dbus/qdbusintegrator.cpp:1007
#22 0x000078cf318e8e34 in QObject::event (this=<optimized out>, e=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:1431
#23 0x000078cf328acc70 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x5abc83177ce0, e=0x78cf2400d470) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:3303
#24 0x000078cf31890118 in QCoreApplication::notifyInternal2 (receiver=0x5abc83177ce0, event=event@entry=0x78cf2400d470) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1106
#25 0x000078cf318904fb in QCoreApplication::sendEvent (receiver=<optimized out>, event=0x78cf2400d470) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1546
#26 QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x5abc826e5140) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1879
#27 0x000078cf31b67cf8 in QCoreApplication::sendPostedEvents (receiver=0x0, event_type=0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1733
#28 postEventSourceDispatch (s=0x5abc826e9b10) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:246
#29 0x000078cf304ee87d in g_main_dispatch (context=0x78cf24000f00) at ../glib/glib/gmain.c:3398
#30 0x000078cf304efcd7 in g_main_context_dispatch_unlocked (context=0x78cf24000f00) at ../glib/glib/gmain.c:4249
#31 g_main_context_iterate_unlocked (context=context@entry=0x78cf24000f00, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4314
#32 0x000078cf304efee5 in g_main_context_iteration (context=0x78cf24000f00, may_block=1) at ../glib/glib/gmain.c:4379
#33 0x000078cf31b645e2 in QEventDispatcherGlib::processEvents (this=0x5abc826ea280, flags=...) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:399
#34 0x000078cf3189c4b6 in QEventLoop::processEvents (this=0x7ffcce3d43d0, flags=...) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:104
#35 QEventLoop::exec (this=0x7ffcce3d43d0, flags=...) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:186
#36 0x000078cf318947c1 in QCoreApplication::exec () at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1449
#37 0x000078cf328a76aa in QApplication::exec () at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:2570
#38 0x00005abc628f86da in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/ark/ark-25.04.3/app/main.cpp:297