Summary: | Plasma crashes in TaskManager::LauncherTasksModel::Private::requestRemoveLauncherFromActivities() when unpinning Task Manager shortcut | ||
---|---|---|---|
Product: | [Plasma] plasmashell | Reporter: | Will <tcosprojects> |
Component: | Task Manager and Icons-Only Task Manager widgets | Assignee: | Will <tcosprojects> |
Status: | RESOLVED FIXED | ||
Severity: | crash | CC: | francoisdprob, kde, nate, paulstansell, qydwhotmail, zurielsoto94 |
Priority: | NOR | Keywords: | drkonqi |
Version First Reported In: | 5.27.6 | ||
Target Milestone: | 1.0 | ||
Platform: | openSUSE | ||
OS: | Linux | ||
Latest Commit: | https://invent.kde.org/plasma/plasma-workspace/-/commit/6309a138092016b05bee00c76401a199324c8c71 | Version Fixed In: | 5.27.7 |
Sentry Crash Report: |
Description
Will
2023-07-19 02:23:47 UTC
I've created a test case to reliably reproduce this issue and am preparing a merge request with the fix As a launcher is removed by url, the ref count decreases until it is deallocated, but the url can be used after free when attempting a remove from appCacheData. The issue occurs at launchertasksmodel.cpp:257 launchersOrder.removeAt(row); // Removes one reference, this is the same as 'launcher' activitiesForLauncher.remove(url); // Can remove last reference if url == launcher and it is not present in appDataCache appDataCache.remove(launcher); // Uses free'd launcher and crashes A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/3105 Git commit 9d9f80149096a04d34cbfdd4310d15e279f32bc3 by Will Horne. Committed on 25/07/2023 at 08:17. Pushed by fusionfuture into branch 'Plasma/5.27'. Fix crash in LauncherTasksModel::Private::requestRemoveLauncherFromActivities Change the 'launcher' variable from a reference to an implicit shared copy to avoid a use-after-free error Add a regression test to launchertasksmodeltest.cpp M +29 -0 libtaskmanager/autotests/launchertasksmodeltest.cpp M +1 -1 libtaskmanager/launchertasksmodel.cpp https://invent.kde.org/plasma/plasma-workspace/-/commit/9d9f80149096a04d34cbfdd4310d15e279f32bc3 Git commit 6309a138092016b05bee00c76401a199324c8c71 by Fushan Wen, on behalf of Will Horne. Committed on 25/07/2023 at 08:54. Pushed by fusionfuture into branch 'master'. Fix crash in LauncherTasksModel::Private::requestRemoveLauncherFromActivities Change the 'launcher' variable from a reference to an implicit shared copy to avoid a use-after-free error Add a regression test to launchertasksmodeltest.cpp (cherry picked from commit 9d9f80149096a04d34cbfdd4310d15e279f32bc3) M +29 -0 libtaskmanager/autotests/launchertasksmodeltest.cpp M +1 -1 libtaskmanager/launchertasksmodel.cpp https://invent.kde.org/plasma/plasma-workspace/-/commit/6309a138092016b05bee00c76401a199324c8c71 *** Bug 412822 has been marked as a duplicate of this bug. *** *** Bug 483917 has been marked as a duplicate of this bug. *** *** Bug 460327 has been marked as a duplicate of this bug. *** |