Bug 502747

Created attachment 180227 [details]
New crash information added by DrKonqi

DrKonqi auto-attaching complete backtrace.

Not sure whats changed, but I cannot reproduce it anymore.
Closing until it starts happening again.

Whoops, just as I closed the bug report it crashed again. Backtrace is different though.

Thread 1 (Thread 0x79b58a8d1280 (LWP 2279)):
[KCrash Handler]
#5  0x0000000000000010 in ??? ()
#6  0x000064c43d6d763a in QCache<QString, MessageContentModel>::Value::~Value (this=0x64c455256d50, __in_chrg=<optimized out>) at /usr/include/qt6/QtCore/qcache.h:35
#7  QCache<QString, MessageContentModel>::Node::~Node (this=0x64c455256d28, __in_chrg=<optimized out>) at /usr/include/qt6/QtCore/qcache.h:48
#8  QHashPrivate::Span<QCache<QString, MessageContentModel>::Node>::erase (this=0x64c4542e54d8, bucket=5) at /usr/include/qt6/QtCore/qhash.h:300
#9  QHashPrivate::Data<QCache<QString, MessageContentModel>::Node>::erase (this=this@entry=0x64c43dc9c760 <ContentProvider::self()::instance+32>, bucket=...) at /usr/include/qt6/QtCore/qhash.h:744
#10 0x000064c43d6d474f in QCache<QString, MessageContentModel>::unlink (this=0x64c43dc9c750 <ContentProvider::self()::instance+16>, n=<optimized out>) at /usr/include/qt6/QtCore/qcache.h:106
#11 QCache<QString, MessageContentModel>::trim (this=0x64c43dc9c750 <ContentProvider::self()::instance+16>, m=99) at /usr/include/qt6/QtCore/qcache.h:133
#12 QCache<QString, MessageContentModel>::insert (this=0x64c43dc9c750 <ContentProvider::self()::instance+16>, key=..., object=0x64c458b1e7b0, cost=1) at /usr/include/qt6/QtCore/qcache.h:191
#13 0x000064c43d6d50e8 in ContentProvider::contentModelForEvent (this=this@entry=0x64c43dc9c740 <ContentProvider::self()::instance>, room=0x64c44f0cc7d0, event=event@entry=0x64c452cf3c30, isReply=isReply@entry=false) at /home/duha/kde/src/neochat/src/timeline/contentprovider.cpp:54
#14 0x000064c43d6fb381 in MessageModel::data (this=0x64c44679c1f0, idx=<optimized out>, role=<optimized out>) at /home/duha/kde/src/neochat/src/timeline/models/messagemodel.cpp:138
#15 0x000079b590998753 in QModelIndex::data (this=0x7ffffc940d30, arole=267, this=<optimized out>, arole=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/itemmodels/qabstractitemmodel.h:518
#16 QConcatenateTablesProxyModel::data (this=<optimized out>, index=<optimized out>, role=267) at /usr/src/debug/qt6-base/qtbase/src/corelib/itemmodels/qconcatenatetablesproxymodel.cpp:185
#17 0x000079b5909b16d5 in QSortFilterProxyModel::data (this=this@entry=0x64c446790e40, index=..., role=267) at /usr/src/debug/qt6-base/qtbase/src/corelib/itemmodels/qsortfilterproxymodel.cpp:2216
#18 0x000064c43d6f8b37 in MessageFilterModel::data (this=0x64c446790e40, index=..., role=<optimized out>) at /home/duha/kde/src/neochat/src/timeline/models/messagefiltermodel.cpp:83
#19 0x000079b593e89fc5 in QModelIndex::data (this=0x7ffffc940ed0, arole=267) at /usr/include/qt6/QtCore/qabstractitemmodel.h:518
#20 QQmlDMAbstractItemModelData::value (this=this@entry=0x64c452efa2b0, role=267) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldmabstractitemmodeldata.cpp:229
#21 0x000079b593e8dec8 in QQmlDMAbstractItemModelData::metaCall (this=0x64c452efa2b0, call=<optimized out>, id=<optimized out>, arguments=0x7ffffc941020) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldmabstractitemmodeldata.cpp:30
#22 0x000079b590776175 in QMetaProperty::read (this=this@entry=0x7ffffc941110, object=0x64c452efa2b0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qmetaobject.cpp:529
#23 0x000079b593138b21 in QQmlPropertyToPropertyBinding::update (this=0x64c458b1e740, flags=...) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlpropertytopropertybinding.cpp:119
#24 0x000079b593e73c06 in QQmlAnyBinding::installOn (mode=QQmlAnyBinding::IgnoreInterceptors, this=<synthetic pointer>, target=...) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlanybinding_p.h:239
#25 QQDMIncubationTask::initializeRequiredProperties (this=<optimized out>, modelItemToIncubate=<optimized out>, object=0x64c4525ecf10) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:988
#26 0x000079b593e73f6c in QQmlDelegateModelPrivate::setInitialState (this=0x64c4504ed490, incubationTask=0x64c453de5be0, o=0x64c4525ecf10) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:1164
#27 QQDMIncubationTask::setInitialState (this=this@entry=0x64c453de5be0, o=0x64c4525ecf10) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:1158
#28 0x000079b5930d6fe6 in QQmlIncubatorPrivate::incubate (this=this@entry=0x64c452909db0, i=...) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlincubator.cpp:321
#29 0x000079b5930d7648 in QQmlEnginePrivate::incubate (this=0x64c4466fae80, i=<optimized out>, forContext=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlincubator.cpp:53
#30 0x000079b593e74d8e in QQmlDelegateModelPrivate::object (this=0x64c4504ed490, group=QQmlListCompositor::Default, index=2, incubationMode=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:1288
#31 0x000079b593891281 in QQuickItemViewPrivate::createItem (this=0x64c45ae8da60, modelIndex=2, incubationMode=QQmlIncubator::AsynchronousIfNested) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickitemview.cpp:2390
#32 0x000079b5938a18fc in QQuickListViewPrivate::addVisibleItems (this=0x64c45ae8da60, fillFrom=-28, fillTo=876, bufferFrom=<optimized out>, bufferTo=<optimized out>, doBuffer=false) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquicklistview.cpp:761
#33 0x000079b59388f9f4 in QQuickItemViewPrivate::refill (this=0x64c45ae8da60, from=-28, to=876) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickitemview.cpp:1798
#34 0x000079b5938945bf in QQuickItemViewPrivate::regenerate (this=0x64c45ae8da60, orientationChanged=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickitemview.cpp:1846
#35 0x000079b5938947fa in QQuickItemViewPrivate::regenerate (this=0x64c45ae8da60, orientationChanged=false) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickitemview.cpp:1256
#36 QQuickItemView::modelUpdated (this=0x64c4511b1800, changeSet=<optimized out>, reset=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickitemview.cpp:1230
#37 0x000079b5907b6f1a in doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4150
#38 0x000079b593e7d998 in non-virtual thunk to QQmlDelegateModelPrivate::emitModelUpdated(QQmlChangeSet const&, bool) () at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel_p_p.h:303
#39 0x000079b593e80d9b in QQmlDelegateModelGroupPrivate::emitModelUpdated (this=0x64c4528862f0, reset=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:2888
#40 QQmlDelegateModelPrivate::emitChanges (this=this@entry=0x64c4504ed490) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:1904
#41 0x000079b593e85900 in QQmlDelegateModel::handleModelReset (this=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:1985
#42 0x000079b5907b6cc9 in QtPrivate::QSlotObjectBase::call (this=0x64c4523883b0, r=0x64c452aa5f00, a=0x7ffffc942d20, this=<optimized out>, r=<optimized out>, a=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#43 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4138
#44 0x000079b590975a39 in QMetaObject::activate<void, QAbstractItemModel::QPrivateSignal> (sender=0x64c446790e40, mo=<optimized out>, local_signal_index=18, ret=0x0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs.h:306
#45 QAbstractItemModel::modelReset (this=0x64c446790e40, _t1=...) at /usr/src/debug/qt6-base/build/src/corelib/Core_autogen/include/moc_qabstractitemmodel.cpp:736
#46 QAbstractItemModel::endResetModel (this=0x64c446790e40) at /usr/src/debug/qt6-base/qtbase/src/corelib/itemmodels/qabstractitemmodel.cpp:3436
#47 0x000079b5909af8e7 in QSortFilterProxyModelPrivate::_q_sourceReset (this=0x64c4460ee1f0) at /usr/src/debug/qt6-base/qtbase/src/corelib/itemmodels/qsortfilterproxymodel.cpp:1591
#48 0x000079b5907b6cc9 in QtPrivate::QSlotObjectBase::call (this=0x64c4467982e0, r=0x64c446790e40, a=0x7ffffc942eb0, this=<optimized out>, r=<optimized out>, a=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#49 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4138
#50 0x000079b590975a39 in QMetaObject::activate<void, QAbstractItemModel::QPrivateSignal> (sender=0x64c4467aae80, mo=<optimized out>, local_signal_index=18, ret=0x0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs.h:306
#51 QAbstractItemModel::modelReset (this=0x64c4467aae80, _t1=...) at /usr/src/debug/qt6-base/build/src/corelib/Core_autogen/include/moc_qabstractitemmodel.cpp:736
#52 QAbstractItemModel::endResetModel (this=0x64c4467aae80) at /usr/src/debug/qt6-base/qtbase/src/corelib/itemmodels/qabstractitemmodel.cpp:3436
#53 0x000079b5907b6cc9 in QtPrivate::QSlotObjectBase::call (this=0x64c4467b2860, r=0x64c4467aae80, a=0x7ffffc943020, this=<optimized out>, r=<optimized out>, a=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#54 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4138
#55 0x000079b590975a39 in QMetaObject::activate<void, QAbstractItemModel::QPrivateSignal> (sender=0x64c44679c1f0, mo=<optimized out>, local_signal_index=18, ret=0x0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs.h:306
#56 QAbstractItemModel::modelReset (this=0x64c44679c1f0, _t1=...) at /usr/src/debug/qt6-base/build/src/corelib/Core_autogen/include/moc_qabstractitemmodel.cpp:736
#57 QAbstractItemModel::endResetModel (this=0x64c44679c1f0) at /usr/src/debug/qt6-base/qtbase/src/corelib/itemmodels/qabstractitemmodel.cpp:3436
#58 0x000064c43d6fa115 in MessageModel::setRoom (this=<optimized out>, room=room@entry=0x64c44f0cc7d0) at /home/duha/kde/src/neochat/src/timeline/models/messagemodel.cpp:69
#59 0x000064c43d718d25 in TimelineModel::setRoom (this=0x64c4467aae80, room=0x64c44f0cc7d0) at /home/duha/kde/src/neochat/src/timeline/models/timelinemodel.cpp:31
#60 0x000064c43d667721 in operator() (__closure=0x64c4467b2a70) at /home/duha/kde/src/neochat/src/app/roommanager.cpp:62
#61 operator() (__closure=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:116
#62 QtPrivate::FunctorCallBase::call_internal<void, QtPrivate::FunctorCall<std::integer_sequence<long unsigned int>, QtPrivate::List<>, void, RoomManager::RoomManager(QObject*)::<lambda()> >::call(RoomManager::RoomManager(QObject*)::<lambda()>&, void**)::<lambda()> > (args=<optimized out>, fn=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:65
#63 QtPrivate::FunctorCall<std::integer_sequence<long unsigned int>, QtPrivate::List<>, void, RoomManager::RoomManager(QObject*)::<lambda()> >::call (f=..., arg=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:115
#64 QtPrivate::FunctorCallable<RoomManager::RoomManager(QObject*)::<lambda()> >::call<QtPrivate::List<>, void> (f=..., arg=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:337
#65 QtPrivate::QCallableObject<RoomManager::RoomManager(QObject*)::<lambda()>, QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void **, bool *) (which=<optimized out>, this_=0x64c4467b2a60, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:547
#66 0x000079b5907b6cc9 in QtPrivate::QSlotObjectBase::call (this=0x64c4467b2a60, r=0x64c43dc9bc20 <RoomManager::instance()::_instance>, a=0x7ffffc943128, this=<optimized out>, r=<optimized out>, a=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#67 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4138
#68 0x000064c43d669d56 in RoomManager::currentRoomChanged (this=0x64c43dc9bc20 <RoomManager::instance()::_instance>) at /home/duha/kde/build/neochat/src/app/neochat_autogen/include/moc_roommanager.cpp:549
#69 RoomManager::setCurrentRoom (this=0x64c43dc9bc20 <RoomManager::instance()::_instance>, roomId=...) at /home/duha/kde/src/neochat/src/app/roommanager.cpp:558
#70 0x000079b594188389 in Quotient::UriResolverBase::visitResource (this=this@entry=0x64c43dc9bc30 <RoomManager::instance()::_instance+16>, account=<optimized out>, uri=...) at /home/duha/kde/src/libquotient/Quotient/uriresolver.cpp:42
#71 0x000064c43d66841e in RoomManager::resolveResource (this=this@entry=0x64c43dc9bc20 <RoomManager::instance()::_instance>, uri=..., action=...) at /home/duha/kde/src/neochat/src/app/roommanager.cpp:230
#72 0x000064c43d668632 in RoomManager::resolveResource (this=0x64c43dc9bc20 <RoomManager::instance()::_instance>, idOrUri=<optimized out>, action=...) at /home/duha/kde/src/neochat/src/app/roommanager.cpp:205
#73 0x000064c43d66b3ab in RoomManager::qt_static_metacall (_o=0x64c43dc9bc20 <RoomManager::instance()::_instance>, _c=<optimized out>, _id=<optimized out>, _a=0x7ffffc943708) at /home/duha/kde/build/neochat/src/app/neochat_autogen/include/moc_roommanager.cpp:330
#74 0x000064c43d66d1ef in RoomManager::qt_metacall (this=0x64c43dc9bc20 <RoomManager::instance()::_instance>, _c=<optimized out>, _id=19, _a=0x7ffffc943708) at /home/duha/kde/build/neochat/src/app/neochat_autogen/include/moc_roommanager.cpp:523
#75 0x000079b59311778b in QQmlObjectOrGadget::metacall (this=0x7ffffc9439f0, type=QMetaObject::InvokeMetaMethod, index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlobjectorgadget.cpp:14
#76 0x000079b592fe47ce in QV4::CallMethod (object=<optimized out>, index=<optimized out>, returnType=..., argCount=<optimized out>, argTypes=<optimized out>, engine=<optimized out>, callArgs=<optimized out>, callType=<optimized out>) at /usr/include/qt6/QtCore/qvarlengtharray.h:89
#77 QV4::QObjectMethod::callPrecise (object=<optimized out>, data=<optimized out>, engine=<optimized out>, callArgs=<optimized out>, callType=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:2070
#78 0x000079b592fed73d in operator() (__closure=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:3072
#79 operator()<QV4::QObjectMethod::callInternal(const QV4::Value*, const QV4::Value*, int) const::<lambda()> > (__closure=<synthetic pointer>, call=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:3049
#80 QV4::QObjectMethod::callInternal (this=0x7ffffc943aa8, thisObject=<optimized out>, argv=0x79b51a61d558, argc=1) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:3072
#81 0x000079b59300ac1d in QV4::FunctionObject::call (this=0x7ffffc943aa8, thisObject=0x79b51a61d540, argv=0x79b51a61d558, argc=1) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4functionobject_p.h:187
#82 QV4::Runtime::CallPropertyLookup::call (engine=0x64c445fc9940, base=..., index=<optimized out>, argv=0x79b51a61d558, argc=1) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4runtime.cpp:1562
#83 0x000079b4f1dea373 in ??? ()
#84 0x0000000000000000 in ??? ()

A possibly relevant merge request was started @ https://invent.kde.org/network/neochat/-/merge_requests/2239

Git commit ccb162cfed3d635d4db72d46aaa80ad5bfd99c85 by Joshua Goins.
Committed on 26/04/2025 at 15:36.
Pushed by redstrate into branch 'master'.

Set CppOwnership for managed QObjects returned by Q_INVOKABLES

I'm 99% sure of the recent crashes we've been seeing are double-frees,
the QCache one me and Duha encountered must be one. The QCache is in
charge of the one in ContentProvider, so it will sometimes try to delete
or access something already destroyed by the QML engine.

While I'm at it, I also made sure to check every other Q_INVOKABLE to
ensure we don't hit this elsewhere.

M  +4    -1    src/libneochat/models/roomlistmodel.cpp
M  +9    -3    src/timeline/contentprovider.cpp

https://invent.kde.org/network/neochat/-/commit/ccb162cfed3d635d4db72d46aaa80ad5bfd99c85

Unfortunately I got a crash with the same backtrace as in comment 3 even with your patch applied.

*** This bug has been marked as a duplicate of bug 502638 ***