Bug 502853

Summary: Crash in PlasmaQuick::PlasmaWindow::resizeEvent when tricking the hover preview into having the wrong size
Product: [Plasma] plasmashell Reporter: Adam Fontenot <adam.m.fontenot+kde>
Component: Task Manager and Icons-Only Task Manager widgetsAssignee: Plasma Bugs List <plasma-bugs-null>
Status: RESOLVED DUPLICATE    
Severity: crash CC: nate, qydwhotmail
Priority: NOR    
Version First Reported In: 6.3.4   
Target Milestone: 1.0   
Platform: Arch Linux   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:
Attachments: screencast of issue

Description Adam Fontenot 2025-04-15 17:52:45 UTC 
Created attachment 180304 [details]
screencast of issue

SUMMARY

I managed to do this in a completely reproducible way, and even got a screen recording.

STEPS TO REPRODUCE
1. Get one preview bar to be really big - I opened enough Firefox windows to span the width of the screen in the preview.
2. Have another app with two windows open next to the big one on the taskbar.
3. Open the hover preview for the app with many windows open, and quickly switch to hovering over the app with two windows open.

OBSERVED RESULT

The hover preview appears to be tricked into showing the wrong size modal window, and something involved in resizing it causes a crash in PlasmaQuick.

Sometimes the size of the hover modal gets stuck for even longer, e.g. after plasmashell restarts, and I can immediately crash it again by hovering over the same icon (KWrite in the recording).

It might be related to this other taskbar crash which is similarly in the guts of the Qml runtime: https://bugs.kde.org/show_bug.cgi?id=491699

EXPECTED RESULT

No crash

SOFTWARE/OS VERSIONS
Operating System: Arch Linux 
KDE Plasma Version: 6.3.4
KDE Frameworks Version: 6.12.0
Qt Version: 6.9.0
Kernel Version: 6.14.2-arch1-1 (64-bit)
Graphics Platform: Wayland

ADDITIONAL INFORMATION

Trying to install the debug symbols resulted in an error message: "Cannot QML trace cores :("

Crashing thread:

Thread 1 (Thread 0x7e2f5a721a40 (LWP 43803)):
[KCrash Handler]
#4  0x00007e2f5fb7d04e in ??? () at /usr/lib/libQt6QmlModels.so.6
#5  0x00007e2f5fbcf1a1 in ??? () at /usr/lib/libQt6QmlModels.so.6
#6  0x00007e2f5fbe55db in ??? () at /usr/lib/libQt6QmlModels.so.6
#7  0x00007e2f5fbcadbb in QQmlDelegateModel::drainReusableItemsPool(int) () at /usr/lib/libQt6QmlModels.so.6
#8  0x00007e2f62aa44ea in QQuickListView::geometryChange(QRectF const&, QRectF const&) () at /usr/lib/libQt6Quick.so.6
#9  0x00007e2f627aabfd in QQuickItem::setSize(QSizeF const&) () at /usr/lib/libQt6Quick.so.6
#10 0x00007e2f596d21e6 in QQuickControlPrivate::resizeContent() () at /usr/lib/libQt6QuickTemplates2.so.6
#11 0x00007e2f596d761a in QQuickControl::geometryChange(QRectF const&, QRectF const&) () at /usr/lib/libQt6QuickTemplates2.so.6
#12 0x00007e2f627aabfd in QQuickItem::setSize(QSizeF const&) () at /usr/lib/libQt6Quick.so.6
#13 0x00007e2f627ce909 in ??? () at /usr/lib/libQt6Quick.so.6
#14 0x00007e2f627ced58 in QQuickLoader::geometryChange(QRectF const&, QRectF const&) () at /usr/lib/libQt6Quick.so.6
#15 0x00007e2f627aabfd in QQuickItem::setSize(QSizeF const&) () at /usr/lib/libQt6Quick.so.6
#16 0x00007e2f63999c95 in PlasmaQuick::PlasmaWindow::resizeEvent(QResizeEvent*) () at /usr/lib/libPlasmaQuick.so.6
#17 0x00007e2f615f5530 in QWindow::event(QEvent*) () at /usr/lib/libQt6Gui.so.6
#18 0x00007e2f62efed9e in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt6Widgets.so.6
#19 0x00007e2f60d5a018 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib/libQt6Core.so.6
#20 0x00007e2f6158997d in QGuiApplicationPrivate::processGeometryChangeEvent(QWindowSystemInterfacePrivate::GeometryChangeEvent*) () at /usr/lib/libQt6Gui.so.6
#21 0x00007e2f615fb23a in void QWindowSystemInterface::handleGeometryChange<QWindowSystemInterface::SynchronousDelivery>(QWindow*, QRect const&) () at /usr/lib/libQt6Gui.so.6
#22 0x00007e2f61eab67b in QtWaylandClient::QWaylandWindow::setGeometry(QRect const&) () at /usr/lib/libQt6WaylandClient.so.6
#23 0x00007e2f615f0aea in QWindow::resize(QSize const&) () at /usr/lib/libQt6Gui.so.6
#24 0x00007e2f4018e97d in ??? () at /usr/lib/qt6/qml/org/kde/plasma/core/libcorebindingsplugin.so
#25 0x00007e2f60db6cc9 in ??? () at /usr/lib/libQt6Core.so.6
#26 0x00007e2f627a9da1 in QQuickItem::setImplicitHeight(double) () at /usr/lib/libQt6Quick.so.6
#27 0x00007e2f627a0f38 in QQuickItemPrivate::implicitHeightChanged() () at /usr/lib/libQt6Quick.so.6
#28 0x00007e2f627a9da1 in QQuickItem::setImplicitHeight(double) () at /usr/lib/libQt6Quick.so.6
#29 0x00007e2f62260f63 in ??? () at /usr/lib/libQt6Qml.so.6
#30 0x00007e2f622796c2 in ??? () at /usr/lib/libQt6Qml.so.6
#31 0x00007e2f6227c99d in QQmlBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlags<QQmlPropertyData::WriteFlag>, QV4::Scope&) () at /usr/lib/libQt6Qml.so.6
#32 0x00007e2f62273c6e in QQmlBinding::update(QFlags<QQmlPropertyData::WriteFlag>) () at /usr/lib/libQt6Qml.so.6
#33 0x00007e2f6230189c in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) () at /usr/lib/libQt6Qml.so.6
#34 0x00007e2f60db69ca in ??? () at /usr/lib/libQt6Core.so.6
#35 0x00007e2f6278d7ef in ??? () at /usr/lib/libQt6Quick.so.6
#36 0x00007e2f627973ca in QQuickItem::geometryChange(QRectF const&, QRectF const&) () at /usr/lib/libQt6Quick.so.6
#37 0x00007e2f627a9c60 in QQuickItem::setHeight(double) () at /usr/lib/libQt6Quick.so.6
#38 0x00007e2f627b8df9 in QQuickItem::qt_metacall(QMetaObject::Call, int, void**) () at /usr/lib/libQt6Quick.so.6
#39 0x00007e2f62260fbf in ??? () at /usr/lib/libQt6Qml.so.6
#40 0x00007e2f62323fa4 in QQmlPropertyPrivate::write(QObject*, QQmlPropertyData const&, QVariant const&, QQmlRefPointer<QQmlContextData> const&, QFlags<QQmlPropertyData::WriteFlag>) () at /usr/lib/libQt6Qml.so.6
#41 0x00007e2f62325c72 in QQmlPropertyPrivate::writeValueProperty(QVariant const&, QFlags<QQmlPropertyData::WriteFlag>) () at /usr/lib/libQt6Qml.so.6
#42 0x00007e2f629967f4 in ??? () at /usr/lib/libQt6Quick.so.6
#43 0x00007e2f6241318d in QAbstractAnimationJob::setCurrentTime(int) () at /usr/lib/libQt6Qml.so.6
#44 0x00007e2f624134d0 in QQmlAnimationTimer::updateAnimationsTime(long long) () at /usr/lib/libQt6Qml.so.6
#45 0x00007e2f60eb4b21 in QUnifiedTimer::updateAnimationTimers() () at /usr/lib/libQt6Core.so.6
#46 0x00007e2f60ebdd92 in QAnimationDriver::advanceAnimation() () at /usr/lib/libQt6Core.so.6
#47 0x00007e2f62a55817 in ??? () at /usr/lib/libQt6Quick.so.6
#48 0x00007e2f62efed9e in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt6Widgets.so.6
#49 0x00007e2f60d5a018 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib/libQt6Core.so.6
#50 0x00007e2f60ede200 in QTimerInfoList::activateTimers() () at /usr/lib/libQt6Core.so.6
#51 0x00007e2f60fcfe29 in ??? () at /usr/lib/libQt6Core.so.6
#52 0x00007e2f5f8fa1e4 in ??? () at /usr/lib/libglib-2.0.so.0
#53 0x00007e2f5f95de97 in ??? () at /usr/lib/libglib-2.0.so.0
#54 0x00007e2f5f8f9615 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#55 0x00007e2f60fcd59d in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt6Core.so.6
#56 0x00007e2f60d65376 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt6Core.so.6
#57 0x00007e2f60d5d159 in QCoreApplication::exec() () at /usr/lib/libQt6Core.so.6
#58 0x00006055a59111cb in ??? ()
#59 0x00007e2f60635488 in ??? () at /usr/lib/libc.so.6
#60 0x00007e2f6063554c in __libc_start_main () at /usr/lib/libc.so.6
#61 0x00006055a59116d5 in ??? ()
Comment 1 Adam Fontenot 2025-04-15 18:46:37 UTC 
Actually, looking at the traceback more closely, I think this might just be Bug 491699? I'll let someone who's expert in this code confirm that, but it looks like QQmlDelegateModel::drainReusableItemsPool is just the last usable item I could get in this traceback, but the crashing path might still run through QQmlDelegateModelItem::destroyObject as before.

If so this is incredibly exciting because plasmashell has crashed 10+ times a day for me for at least the last 8 months, and this is the first time I've managed to get it to do so in a reproducible fashion. It also touches Plasma code in at least one place in this crash (PlasmaQuick::PlasmaWindow::resizeEvent), and so maybe that will help find the issue.
Comment 2 Nate Graham 2025-04-16 16:37:51 UTC 
Yep, I think so too.

*** This bug has been marked as a duplicate of bug 491699 ***