*** Bug 322304 has been marked as a duplicate of this bug. ***

Created attachment 81092 [details]
New crash information added by DrKonqi

plasma-desktop (4.10.90) on KDE Platform 4.10.90 using Qt 4.8.5

- What I was doing when the application crashed:
I installed openSUSE 13.1 Milestone 3 i586 with KDE desktop .
I logined , then I got SEGV .

- Unusual behavior I noticed:

- Custom settings of the application:

I installed default, and I installed debug symbols .

-- Backtrace (Reduced):
#6  strlen () at ../sysdeps/i386/i586/strlen.S:68
#7  0xb6d2d0d8 in qstrlen (str=0x15f <Address 0x15f out of bounds>) at ../../src/corelib/tools/qbytearray.h:80
#8  QString::fromUtf8 (str=0x15f <Address 0x15f out of bounds>, size=-1) at tools/qstring.cpp:4018
#9  0xb2436b57 in QDeclarativeRewrite::RewriteBinding::rewrite (this=this@entry=0xbfa13f8c, code=..., position=position@entry=0, node=0xa066080) at qml/qdeclarativerewrite.cpp:163
#10 0xb2437f2e in QDeclarativeRewrite::RewriteBinding::operator() (this=0xbfa13f8c, code=..., ok=0xbfa13f83, sharable=0x0) at qml/qdeclarativerewrite.cpp:93

*** Bug 322316 has been marked as a duplicate of this bug. ***

I fear this is a downstream issue. I managed to reproduce on 32bit arch only, with 3 or 4 different
backtraces. x86_64 is unaffected. Also tried downgrading Qt to 4.8.4, with the same result.

Created attachment 81097 [details]
1st

Created attachment 81098 [details]
2nd

Created attachment 81099 [details]
3rd

Created attachment 81100 [details]
4th

*** Bug 321181 has been marked as a duplicate of this bug. ***

With the last duplicate, i can conclude the issue is not downstream. Crash is somehow triggered by launchers + new task widget.

Hrvoje, bug 321181 is not a duplicate.

(In reply to comment #11)
> Hrvoje, bug 321181 is not a duplicate.

Well not a obvious one, at least. Both here, and on that report, the trigger was launcher. Also compare my 1st, 2nd and 4th bt to the one in bug 321181. Additionally, that is also (?) on 32bit install.

I can reopen that one if you think i was wrong.

Yes it's kind of duplicate if you compare the backrace.


On Sun, Jul 14, 2013 at 9:07 PM, Hrvoje Senjan <hrvoje.senjan@gmail.com>wrote:

> https://bugs.kde.org/show_bug.cgi?id=322283
>
> --- Comment #12 from Hrvoje Senjan <hrvoje.senjan@gmail.com> ---
> (In reply to comment #11)
> > Hrvoje, bug 321181 is not a duplicate.
>
> Well not a obvious one, at least. Both here, and on that report, the
> trigger
> was launcher. Also compare my 1st, 2nd and 4th bt to the one in bug 321181.
> Additionally, that is also (?) on 32bit install.
>
> I can reopen that one if you think i was wrong.
>
> --
> You are receiving this mail because:
> You are on the CC list for the bug.
>

Well, to me it looks like several different backtraces are collected here. The original report, and comment #1 crash in QMetaObject::indexOfProperty() called from QPropertyAnimation::updateState().

Bug 321181 crashes in Akonadi code.

What am I missing?

(In reply to comment #14)
> What am I missing?

Sorry Cristoph, you are correct, as i shamelessly stolen this bug report. Referenced bug seem like a dup to my pasted bt's (or vice-versa), but they are however different to original crash.  As is also 
bug 322316. Only the trigger seems to be the same...

openSUSE bug 829298 has two different workarounds for this for me on 2GHz 32 bit Sempron with rv200 gfx, plus plasma-desktop...kcrash.txt from simply trying to get a session started.

Created attachment 81241 [details]
backtrace

And I have attached yet another different backtrace. (openSUSE Factory 32bit)
But I just got the same bt as in comment#7 as well.
So it seems to be kind of random where exactly it crashes...

Those things fix the crash for me:
- change Exec line in /usr/share/autostart/plasma-desktop.desktop to "Exec=sleep30 && plasma-desktop"
- remove the two launchers from the taskmanager plasmoid in the panel

Created attachment 81256 [details]
New crash information added by DrKonqi

plasma-desktop (4.10.90) on KDE Platform 4.10.90 using Qt 4.8.5

- What I was doing when the application crashed:

I installed openSUSE 13.1 Milestone 3 i586 in  VMware Player 5.0.2 build-1031769 on Windows 7 Ultimate SP1 64 bit .
Host information: https://dl.dropboxusercontent.com/u/86335040/DxDiag17.txt .
I selected auto install, rebooted openSUSE, and logged in KDE .

- Custom settings of the application:

No, I installed openSUSE in VMware Player .
I selected auto install, and selected all default .
After I installed debuginfos .

--
I reproduced this issue in VMware Player too .

-- Backtrace (Reduced):
#7  0xb6e0912a in QObject::setProperty (this=0x8589588, name=0x114 <Address 0x114 out of bounds>, value=...) at kernel/qobject.cpp:3713
#8  0xb6cc51bd in QPropertyAnimationPrivate::updateProperty (this=0x8589800, newValue=...) at animation/qpropertyanimation.cpp:144
#9  0xb6cc2485 in QVariantAnimationPrivate::setCurrentValueForProgress (this=this@entry=0x8589800, progress=progress@entry=0.63363199999999997) at animation/qvariantanimation.cpp:294
#10 0xb6cc2845 in QVariantAnimationPrivate::recalculateCurrentInterval (this=0x8589800, force=false) at animation/qvariantanimation.cpp:279
#11 0xb6cbfde7 in QAbstractAnimation::setCurrentTime (this=this@entry=0x8c0ca10, msecs=<optimized out>, msecs@entry=143) at animation/qabstractanimation.cpp:903

(In reply to comment #17)
> Those things fix the crash for me:
> - change Exec line in /usr/share/autostart/plasma-desktop.desktop to
> "Exec=sleep30 && plasma-desktop"
> - remove the two launchers from the taskmanager plasmoid in the panel

Another workaround that fixes this crash for me:
- change Exec line in /usr/share/autostart/plasma-desktop.desktop to
"Exec=LANG=C plasma-desktop"

Created attachment 81422 [details]
New crash information added by DrKonqi

plasma-desktop (4.10.97) on KDE Platform 4.10.97 using Qt 4.8.6

- What I was doing when the application crashed:

And another one. This is with debug Qt build + debugfull of KDElibs, runtime and workspace. Also stripped all packages of oS patches so those at least can be ruled out...

-- Backtrace (Reduced):
#6  0xb6c34b86 in QString::fromLatin1_helper (str=0x5c <Address 0x5c out of bounds>, size=-1) at tools/qstring.cpp:3821
#7  0xb6c34c78 in QString::fromLatin1 (str=0x5c <Address 0x5c out of bounds>, size=-1) at tools/qstring.cpp:3901
#8  0xb705a24a in KLocalizedStringPrivate::toString (this=0xa098340, locale=0x9f81480, catalogName=0x0) at /usr/src/debug/kdelibs-4.10.97/kdecore/localization/klocalizedstring.cpp:303
#9  0xb7059635 in KLocalizedString::toString (this=0xbff7a7cc) at /usr/src/debug/kdelibs-4.10.97/kdecore/localization/klocalizedstring.cpp:194
#10 0xa6411b74 in i18n<int> (text=0xa641aa68 "Strength: %1%", a1=<synthetic pointer>) at /usr/include/klocalizedstring.h:645

Created attachment 81424 [details]
New crash information added by DrKonqi

plasma-desktop (4.10.97) on KDE Platform 4.10.97 using Qt 4.8.6

- What I was doing when the application crashed:
This backtrace is now with removed NM plasmoid.

-- Backtrace (Reduced):
#6  strlen () at ../sysdeps/i386/i586/strlen.S:98
#7  0xb6c3bde8 in qstrlen (str=0x5c <Address 0x5c out of bounds>) at ../../src/corelib/tools/qbytearray.h:80
#8  QString::fromUtf8 (str=0x5c <Address 0x5c out of bounds>, size=-1) at tools/qstring.cpp:4018
#9  0xb0634c17 in QDeclarativeRewrite::RewriteBinding::rewrite (this=this@entry=0xbf92407c, code=..., position=position@entry=0, node=0x9656f90) at qml/qdeclarativerewrite.cpp:163
#10 0xb0635fee in QDeclarativeRewrite::RewriteBinding::operator() (this=0xbf92407c, code=..., ok=0xbf924073, sharable=0x0) at qml/qdeclarativerewrite.cpp:93

Created attachment 81723 [details]
New crash information added by DrKonqi

plasma-desktop (4.11.00) on KDE Platform 4.11.00 using Qt 4.8.5

- What I was doing when the application crashed:

Just installed KDE 4.11 on OpenSuSE 12.3 from :
http://en.opensuse.org/KDE_repositories

UpdatedApps: http://download.opensuse.org/repositories/KDE:/UpdatedApps/openSUSE_12.3/
Extra: http://download.opensuse.org/repositories/KDE:/Extra/openSUSE_12.3/

After the restart I got the crash.

-- Backtrace (Reduced):
#6  0xb6d972d0 in QObject::setProperty (this=0xaee2730, name=0x9b <Address 0x9b out of bounds>, value=...) at kernel/qobject.cpp:3713
#7  0xb6c4f7c3 in QPropertyAnimationPrivate::updateProperty (this=0xaee2998, newValue=...) at animation/qpropertyanimation.cpp:144
#8  0xb6c4c82e in QVariantAnimationPrivate::setCurrentValueForProgress (this=this@entry=0xaee2998, progress=progress@entry=0.69267199999999995) at animation/qvariantanimation.cpp:294
#9  0xb6c4ccb2 in QVariantAnimationPrivate::recalculateCurrentInterval (this=0xaee2998, force=false) at animation/qvariantanimation.cpp:279
#10 0xb6c4aa2d in QAbstractAnimation::setCurrentTime (this=this@entry=0xa04ba18, msecs=<optimized out>, msecs@entry=152) at animation/qabstractanimation.cpp:903

*** Bug 323605 has been marked as a duplicate of this bug. ***

So I upgraded my 32 bit Gentoo Linux now to KDE 4.11.0 - and can't use it due to this bug.

May I ask for a work around ? Currently I'm running fluxbox ...

Go to failsafe mode, run plasma-desktop and remove task manager widget from panel. Use quick launch instead. 

"Do not use 'show launcher when not running option', It's broken."

(In reply to comment #25)
> Go to failsafe mode, run plasma-desktop and remove task manager widget from
> panel. Use quick launch instead. 
> 
> "Do not use 'show launcher when not running option', It's broken."

Even in a fail-safe mode the crash appears imemdiately during login.

But after login into fluxbox I'm at least able to run plasma-desktop.
May I ask you what do you mean with "remove task manager widget from panel." ?

(In reply to comment #26)
> (In reply to comment #25)
> > Go to failsafe mode, run plasma-desktop and remove task manager widget from
> > panel. Use quick launch instead. 
> > 
> > "Do not use 'show launcher when not running option', It's broken."
> 
> Even in a fail-safe mode the crash appears imemdiately during login.
> 
> But after login into fluxbox I'm at least able to run plasma-desktop.
> May I ask you what do you mean with "remove task manager widget from panel."
> ?
sry - got it - at least I'm now able to login

*** Bug 323727 has been marked as a duplicate of this bug. ***

(In reply to comment #25)
> Go to failsafe mode, run plasma-desktop and remove task manager widget from
> panel. Use quick launch instead. 
Do you meant  "System Tray" ?

> "Do not use 'show launcher when not running option', It's broken."
Yep, I had to remove both (dolphin and Konsole)

The "show launcher when not running" option works just fine here, by the way ...

(In reply to comment #30)
> The "show launcher when not running" option works just fine here, by the way
> ...

Seems it's, for now, isolated to 32bit installs only... are you using it also?

Hm, nope, but that's an interesting data point for sure ... I'll put together a 32bit VM for testing.

*** Bug 321204 has been marked as a duplicate of this bug. ***

*** Bug 323751 has been marked as a duplicate of this bug. ***

Conditions for crash are:
a) it just crashes on login
b) it crashes when an icon in systray changes (e.g. nm plasmoid)
c) it crashes when interacting with plasma desktop (e.g. right click)
d) it crashes when hovering over icon (when tooltip should appear)

Crashes don't stop during session unless user manually quits plasma, and starts it again.
Crashes (all of the above) do *not* happen without launchers or on !32bit install.

(In reply to comment #35)
> Conditions for crash are:
> a) it just crashes on login
> b) it crashes when an icon in systray changes (e.g. nm plasmoid)
> c) it crashes when interacting with plasma desktop (e.g. right click)
> d) it crashes when hovering over icon (when tooltip should appear)
> 
> Crashes don't stop during session unless user manually quits plasma, and
> starts it again.
> Crashes (all of the above) do *not* happen without launchers or on !32bit
> install.

I confirm this bug with KDE 4.11.0 in ROSA Desktop Fresh R1 (aka 2012.1) 32 bit.

*** Bug 322637 has been marked as a duplicate of this bug. ***

(In reply to comment #32)
> Hm, nope, but that's an interesting data point for sure ... I'll put
> together a 32bit VM for testing.

This hint in https://forums.gentoo.org/viewtopic-t-967222-highlight-.html sounds interesting :

Edit /usr/share /autostart/plasma-desktop.desktop
Replace
Exec=plasma-desktop	
with
Exec=LANG=C plasma-desktop
in

(In reply to comment #38)
> (In reply to comment #32)
> > Hm, nope, but that's an interesting data point for sure ... I'll put
> > together a 32bit VM for testing.
> 
> This hint in https://forums.gentoo.org/viewtopic-t-967222-highlight-.html
> sounds interesting :
> 
> Edit /usr/share /autostart/plasma-desktop.desktop
> Replace
> Exec=plasma-desktop        
> with
> Exec=LANG=C plasma-desktop
> in
Yes, that fixes the crash for me.

But I already wrote that in comment#19. ;-)

*** Bug 323807 has been marked as a duplicate of this bug. ***

I managed to fix this problem on my setup by hitting alt-f2 and running a terminal emulator (ie. konsole). From there I ran plasma-desktop (i wanted to see what the shell output for the crash was). Fortunately though, it didn't crash. From there I set up everything the way I like it and restarted my computer. The restart prompted plasma to crash again which caused it to revert back to the default wallpaper for some reason. Once I logged back in again, I changed my wallpaper again and now everything works fine.

Created attachment 81829 [details]
New crash information added by DrKonqi

plasma-desktop (4.11.00) on KDE Platform 4.11.00 using Qt 4.8.5

- What I was doing when the application crashed: starting openSuSE 12.3 with KDE 4.11. After login, the plasma desktop crashes, but can be restarted with ALT+F2.

-- Backtrace (Reduced):
#7  0xb6d132d0 in QObject::setProperty (this=0x8b620e8, name=0x66 <Address 0x66 out of bounds>, value=...) at kernel/qobject.cpp:3713
#8  0xb6bcb7c3 in QPropertyAnimationPrivate::updateProperty (this=0x93542e8, newValue=...) at animation/qpropertyanimation.cpp:144
#9  0xb6bc882e in QVariantAnimationPrivate::setCurrentValueForProgress (this=this@entry=0x93542e8, progress=progress@entry=1) at animation/qvariantanimation.cpp:294
#10 0xb6bc8cb2 in QVariantAnimationPrivate::recalculateCurrentInterval (this=0x93542e8, force=false) at animation/qvariantanimation.cpp:279
#11 0xb6bc6a2d in QAbstractAnimation::setCurrentTime (this=this@entry=0x8a0d6f0, msecs=<optimized out>, msecs@entry=259) at animation/qabstractanimation.cpp:903

(In reply to comment #42)

I tried removing and adding the dolphin launcher, this fixed the crash after login. (And it seems KDE 4.11 starts much faster than 4.10, thanks guys!!)

I've got the same thing going on on Arch Linux. launching plasma-desktop from the Runner after the crash gets it going again for me too. I had systemd-journald going crazy and nepomuk doing core dumps after the crash. The crash happens again after I login again though. I thought some of my custom settings in kdmrc were the problem, but I guess not.

Created attachment 81833 [details]
New crash information added by DrKonqi

plasma-desktop (4.11.00) on KDE Platform 4.11.00 using Qt 4.8.5

- What I was doing when the application crashed: Arch had some updates, so I tried logging out and back in.
1. Immediate crash of plasma-desktop on login - everthing else loaded in background
2. Plasma-desktop respawned, loaded everything and then crashed
3. Restarted plasma-desktop via Runner. Everything works fine.

Systemd is throwing a strange error that I'm going to look into.

-- Backtrace (Reduced):
#7  0xb0ad6f1f in QMetaObjectBuilder::addSignal(QByteArray const&) () from /usr/lib/libQtDeclarative.so.4
#8  0xb097b393 in QDeclarativeOpenMetaObjectType::createProperty(QByteArray const&) () from /usr/lib/libQtDeclarative.so.4
[...]
#21 0xb0b46d8d in QListModelInterface::itemsInserted(int, int) () from /usr/lib/libQtDeclarative.so.4
[...]
#25 0xb6e0d6bb in QObject::event(QEvent*) () from /usr/lib/libQtCore.so.4
#26 0xb62ef9a4 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4

*** Bug 323839 has been marked as a duplicate of this bug. ***

*** Bug 323849 has been marked as a duplicate of this bug. ***

*** Bug 323903 has been marked as a duplicate of this bug. ***

https://git.reviewboard.kde.org/r/112241/ Patch

(In reply to comment #49)
> https://git.reviewboard.kde.org/r/112241/ Patch

applied - seems to fix the issue here at a 32 bit stable Gentoo Linux
:-)

But I'm wondering if this patch does fix the root cause or just squash a side effect b/c why does it only happen at 32 bit systems  (or am I wrong wrt to this ?) ?

(In reply to comment #50)
> (In reply to comment #49)
> > https://git.reviewboard.kde.org/r/112241/ Patch
> 
> applied - seems to fix the issue here at a 32 bit stable Gentoo Linux
> :-)
> 
> But I'm wondering if this patch does fix the root cause or just squash a
> side effect b/c why does it only happen at 32 bit systems  (or am I wrong
> wrt to this ?) ?

I think it fixes the root cause, at least for me on my both desktop and laptop it works.. (Both 32 bit) I am waiting for review of other plasma devs. :)

(In reply to comment #51)
> (In reply to comment #50)
> > (In reply to comment #49)
> > > https://git.reviewboard.kde.org/r/112241/ Patch
> > 
> > applied - seems to fix the issue here at a 32 bit stable Gentoo Linux
> > :-)
> > 
> > But I'm wondering if this patch does fix the root cause or just squash a
> > side effect b/c why does it only happen at 32 bit systems  (or am I wrong
> > wrt to this ?) ?
> 
> I think it fixes the root cause, at least for me on my both desktop and
> laptop it works.. (Both 32 bit) I am waiting for review of other plasma
> devs. :)

Indeed - you fixed it.

But let me ask in a different way :
Why does this issue not happen at a 64 bit system (or is this presumption wrong ?)

Latest back trace (reduced),

#6  0xb5d441e7 in operator<<(QDebug, QObject const*) () from /usr/lib/libQtCore.so.4
#7  0xaec8ea7d in Tasks::itemGeometryChanged (this=0x97bb448, id=7, x=0, y=0, width=32, height=86) at /home/bshah/kdesrc/kde/kde-workspace/plasma/desktop/applets/tasks/tasks.cpp:306
#8  0xaec8fded in Tasks::qt_static_metacall (_o=<optimized out>, _id=<optimized out>, _a=0xbf9d99c0, _c=<optimized out>) at /home/bshah/kdesrc/build/kde/kde-workspace/plasma/desktop/applets/tasks/tasks.moc:76
#9  0xb5d460b7 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib/libQtCore.so.4
#10 0xb5d46a68 in QMetaObject::activate(QObject*, int, void**) () from /usr/lib/libQtCore.so.4
#11 0xb6e46964 in ?? () from /usr/lib/libQtDeclarative.so.4
#12 0xb5d37f25 in QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) () from /usr/lib/libQtCore.so.4
#13 0xb6ef8f69 in ?? () from /usr/lib/libQtDeclarative.so.4
#14 0xb6efadce in ?? () from /usr/lib/libQtDeclarative.so.4
#15 0xb6efb754 in ?? () from /usr/lib/libQtDeclarative.so.4

Bad news - I set up a 32 bit installation in a 32 bit VM, and I'm afraid I still can't reproduce this with any of the conditions mentioned in comment 35. As for Bhushan patch, as I mentioned on ReviewBoard it's currently unclear why it would affect the situation, so it seems to be just hiding a root cause (also, his backtrace is markedly different from the others in here, and the one in comment 53 seems to be of modified code anyway since there's no use of qDebug in that method).

The distro I used was Fedora 19. It might help if anyone found a 32bit live CD that's reliably crashing for them that I could download, or if anyone figures out a tighter set of steps to reproduce, including perhaps posting their plasma-desktop / panel config.

Since LC_ALL=C was brought into play here: Toralf, are you using a German locale, and does the crash also disappear without  Bhushan's patch but with KDE set to English? (It's a bit weird tapping in the dark ...)

(In reply to comment #55)
> Since LC_ALL=C was brought into play here: Toralf, are you using a German
> locale
nope - although I'm german, I do prefer english settings at all (makes bug reports with screen shots easier and the german translation is often to horrible) , as an exception I just use a german keyboard of course to type my last name correctly with the umlaut 'ö' :-)

Then it's not translation-specific either (couldn't really see how anyway).

(In reply to comment #54)
> The distro I used was Fedora 19. It might help if anyone found a 32bit live
> CD that's reliably crashing for them that I could download, or if anyone
> figures out a tighter set of steps to reproduce, including perhaps posting
> their plasma-desktop / panel config.

You could try latest openSUSE Factory build:
http://download.opensuse.org/factory/iso/openSUSE-Factory-KDE-Live-i686-Build0657-Media.iso
It's from 12th August, so it's not final 4.11.00. Just note that we've disabled the launchers on default configuration, though manually enabling them would deliver the same effect.

Thanks, downloading.

(In reply to comment #50)
> (In reply to comment #49)
> > https://git.reviewboard.kde.org/r/112241/ Patch
> 
> applied - seems to fix the issue here at a 32 bit stable Gentoo Linux
> :-)

Same with ROSA Desktop Fresh R1. With this patch applied plasma no longer crashes when there are launchers on taskbar.

I think we have two or more types of back trace in this bug.

1) Complains about the propertyAnimation.
2) Complains about Tasks::itemGeometryChanged (Only mines)
3) itemsAdded and removed things.

From which 1,3 and others can not be reproduced anyhow, no matter what you did. If desktop crashes, can someone upload backtrace? I am running 4.11 branch of git.

@Eike Hein Can you reproduce bug with openSUSE?

Other usecase to reproduce bug is,

1) Enable Window grouping, and only when taskbar is full option.
2) Start *different* applications.
3) Once taskbar shrinks, start the new instance of already running application. In my case it was VLC media player.

(In reply to comment #55)
> Since LC_ALL=C was brought into play here: Toralf, are you using a German
> locale, and does the crash also disappear without  Bhushan's patch but with
> KDE set to English? (It's a bit weird tapping in the dark ...)

I set 

| Exec=LANG=de_DE.utf8 plasma-desktop

in /usr/share/autostart/plasma-desktop.desktop and it does no longer crash on startup.

Same crash on Arch Linux i686.
https://bbs.archlinux.org/viewtopic.php?id=168520
https://bbs.archlinux.org/viewtopic.php?pid=1314391

(In reply to comment #62)
> (In reply to comment #55)
> > Since LC_ALL=C was brought into play here: Toralf, are you using a German
> > locale, and does the crash also disappear without  Bhushan's patch but with
> > KDE set to English? (It's a bit weird tapping in the dark ...)
> 
> I set 
> 
> | Exec=LANG=de_DE.utf8 plasma-desktop
> 
> in /usr/share/autostart/plasma-desktop.desktop and it does no longer crash
> on startup.

Exec=LANG=fr_FR.utf8 plasma-desktop

fixes the issue for me as well.

/which let me wonder if an empty LANG would be one of the possible causes of the issue ....

Martin and Anakin, could you please specify which issue specifically, perhaps by posting backtraces? This ticket has unfortunately become muddled with what seem to be different issues ...

The good news is that I can reproduce the propertyAnimation crash in the ISO that Hrvoje posted above - once anyway, after login. Hopefully that will persist after a HDD install so I can set up a dev environment in there (first time using openSUSE in many years).

And Toralf, which of the backtraces are you getting? :)

Crash that apppears on my system : http://www.youtube.com/watch?v=S9wh8f-vlGE

Created attachment 81918 [details]
Crash which is solved by modifying LANG

My backtrace is attached.

Here's the backtrace I'm getting in the openSUSE VM:

Application: Plasma Desktop Shell (plasma-desktop), signal: Segmentation fault
Using host libthread_db library "/lib/libthread_db.so.1".
[Current thread is 1 (Thread 0xb544c740 (LWP 3245))]

Thread 3 (Thread 0xade75b40 (LWP 3292)):
#0  0xb776e422 in __kernel_vsyscall ()
#1  0xb6c0f99c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#2  0xb0d81a92 in ?? () from /usr/lib/libQtScript.so.4
#3  0xb0d81adf in ?? () from /usr/lib/libQtScript.so.4
#4  0xb6c0be6a in start_thread () from /lib/libpthread.so.0
#5  0xb5f8ee9e in clone () from /lib/libc.so.6

Thread 2 (Thread 0xa665db40 (LWP 3320)):
#0  0xb776e422 in __kernel_vsyscall ()
#1  0xb5fa1842 in clock_gettime () from /lib/libc.so.6
#2  0xb6cea09c in do_gettime (frac=0xa665cff0, sec=0xa665cfe8) at tools/qelapsedtimer_unix.cpp:127
#3  qt_gettime () at tools/qelapsedtimer_unix.cpp:144
#4  0xb6dd04a2 in updateCurrentTime (this=0x9197474) at kernel/qeventdispatcher_unix.cpp:354
#5  QTimerInfoList::timerWait (this=0x9197474, tm=...) at kernel/qeventdispatcher_unix.cpp:460
#6  0xb6dcea5b in timerSourcePrepareHelper (src=src@entry=0x9197440, timeout=0xa665d0ec) at kernel/qeventdispatcher_glib.cpp:136
#7  0xb6dceaea in timerSourcePrepare (source=0x9197440, timeout=<optimized out>) at kernel/qeventdispatcher_glib.cpp:169
#8  0xb5939d93 in g_main_context_prepare () from /usr/lib/libglib-2.0.so.0
#9  0xb593a6af in ?? () from /usr/lib/libglib-2.0.so.0
#10 0xb593a8f8 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#11 0xb6dcec2f in QEventDispatcherGlib::processEvents (this=0x9195978, flags=...) at kernel/qeventdispatcher_glib.cpp:427
#12 0xb6d9e013 in QEventLoop::processEvents (this=this@entry=0xa665d258, flags=...) at kernel/qeventloop.cpp:149
#13 0xb6d9e339 in QEventLoop::exec (this=0xa665d258, flags=...) at kernel/qeventloop.cpp:204
#14 0xb6c8c30d in QThread::exec (this=0x9194420) at thread/qthread.cpp:536
#15 0xb6d7e3f4 in QInotifyFileSystemWatcherEngine::run (this=0x9194420) at io/qfilesystemwatcher_inotify.cpp:256
#16 0xb6c8ec5f in QThreadPrivate::start (arg=0x9194420) at thread/qthread_unix.cpp:338
#17 0xb6c0be6a in start_thread () from /lib/libpthread.so.0
#18 0xb5f8ee9e in clone () from /lib/libc.so.6

Thread 1 (Thread 0xb544c740 (LWP 3245)):
[KCrash Handler]
#7  0xb6cd9e66 in QString::fromLatin1_helper (str=0x50 <Address 0x50 out of bounds>, size=-1) at tools/qstring.cpp:3821
#8  0xb6cd9f58 in QString::fromLatin1 (str=0x50 <Address 0x50 out of bounds>, size=-1) at tools/qstring.cpp:3901
#9  0xb70d9216 in ?? () from /usr/lib/libkdecore.so.5
#10 0xb70d9df8 in KLocalizedString::toString() const () from /usr/lib/libkdecore.so.5
#11 0xae629c2e in ?? () from /usr/lib/kde4/plasma_toolbox_desktoptoolbox.so
#12 0xb6da7c04 in QMetaMethod::invoke (this=this@entry=0xbfd9b5e4, object=0x8d4f058, connectionType=<optimized out>, returnValue=..., val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...) at kernel/qmetaobject.cpp:1664
#13 0xb6daa1e3 in QMetaObject::invokeMethod (obj=0x8d4f058, member=0xb305e408 "toolTipAboutToShow", type=Qt::AutoConnection, ret=..., val0=..., val1=..., val2=..., val3=..., val4=..., val5=..., val6=..., val7=..., val8=..., val9=...) at kernel/qmetaobject.cpp:1179
#14 0xb2f79eaa in invokeMethod (val9=..., val8=..., val7=..., val6=..., val5=..., val4=..., val3=..., val2=..., val1=..., val0=..., member=0xb305e408 "toolTipAboutToShow", obj=0x8d4f058) at /usr/include/QtCore/qobjectdefs.h:434
#15 Plasma::ToolTipManagerPrivate::showToolTip (this=0x8ca8830) at /usr/src/debug/kdelibs-4.10.97/plasma/tooltipmanager.cpp:394
#16 0xb2f7a463 in Plasma::ToolTipManager::qt_static_metacall (_o=<optimized out>, _id=<optimized out>, _a=0xbfd9b998, _c=<optimized out>) at /usr/src/debug/kdelibs-4.10.97/build/plasma/tooltipmanager.moc:64
#17 0xb6db4275 in QMetaObject::activate (sender=0x8ca86a8, m=0xb6f0b4b8 <QTimer::staticMetaObject>, local_signal_index=0, argv=0x0) at kernel/qobject.cpp:3556
#18 0xb6e04eb5 in QTimer::timeout (this=0x8ca86a8) at .moc/release-shared/moc_qtimer.cpp:147
#19 0xb6dbdb36 in QTimer::timerEvent (this=0x8ca86a8, e=0xbfd9bd50) at kernel/qtimer.cpp:280
#20 0xb6db873c in QObject::event (this=0x8ca86a8, e=0xbfd9bd50) at kernel/qobject.cpp:1165
#21 0xb628b4b4 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4
#22 0xb6291ee3 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4
#23 0xb74eeae4 in KApplication::notify (this=0x8b43760, receiver=0x8ca86a8, event=0xbfd9bd50) at /usr/src/debug/kdelibs-4.10.97/kdeui/kernel/kapplication.cpp:311
#24 0xb6d9f5ca in QCoreApplication::notifyInternal (this=0x8b43760, receiver=0x8ca86a8, event=0xbfd9bd50) at kernel/qcoreapplication.cpp:949
#25 0xb6dd19cf in sendEvent (event=0xbfd9bd50, receiver=<optimized out>) at kernel/qcoreapplication.h:231
#26 QTimerInfoList::activateTimers (this=0x8b4b2c4) at kernel/qeventdispatcher_unix.cpp:636
#27 0xb6dce9fb in timerSourceDispatch (source=<optimized out>) at kernel/qeventdispatcher_glib.cpp:186
#28 idleTimerSourceDispatch (source=0x8b4bd00) at kernel/qeventdispatcher_glib.cpp:233
#29 0xb593a48e in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#30 0xb593a838 in ?? () from /usr/lib/libglib-2.0.so.0
#31 0xb593a8f8 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#32 0xb6dcec0f in QEventDispatcherGlib::processEvents (this=0x8b10f40, flags=...) at kernel/qeventdispatcher_glib.cpp:425
#33 0xb633b4ee in ?? () from /usr/lib/libQtGui.so.4
#34 0xb6d9e013 in QEventLoop::processEvents (this=this@entry=0xbfd9bf78, flags=...) at kernel/qeventloop.cpp:149
#35 0xb6d9e339 in QEventLoop::exec (this=0xbfd9bf78, flags=...) at kernel/qeventloop.cpp:204
#36 0xb6da3b1e in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1221
#37 0xb6289944 in QApplication::exec() () from /usr/lib/libQtGui.so.4
#38 0xaf810f77 in kdemain () from /usr/lib/libkdeinit4_plasma-desktop.so
#39 0x0804fba3 in _start ()

> #11 0xae629c2e in ?? () from /usr/lib/kde4/plasma_toolbox_desktoptoolbox.so

This is getting more complicated. How you solved this crash? @Eike Hein?

If by "solved" you mean "how to reproduce": Started Dolphin, right-clicked the task button, picked "Show a launcher when running", closed Dolphin, moved mouse over launcher button (causing the tooltip code to run, as seen in the trace).

I'm getting entirely different backtraces somewhere in the declarative engine on login with launchers, though.

This must be some sort of tricky memory corruption issue I think ...

By the way, thanks for the YouTube video - sadly I can't reproduce it on my main system however (64 bit).

Can we implment things Thomas Lübking mentioned on reviewboard? Also my patch works on same machine?

Created attachment 81920 [details]
Don't attempt to publish launcher geometry

Bhushan, could you please try if this patch helps your case? (Without your patch applies please.)

(In reply to comment #67)
> And Toralf, which of the backtraces are you getting? :)

my origin bug report is here : #bug 323605

Yes this patch works for me.

(In reply to comment #74)
> Created attachment 81920 [details]
> Don't attempt to publish launcher geometry
> 
> Bhushan, could you please try if this patch helps your case? (Without your
> patch applies please.)

Git commit 6878e972b87e9ef34617c6280eda8ac5d7113a29 by Eike Hein.
Committed on 25/08/2013 at 14:38.
Pushed by hein into branch 'KDE/4.11'.

Don't attempt to publish geometry for launcher items.

M  +1    -1    plasma/desktop/applets/tasks/package/contents/code/tools.js

http://commits.kde.org/kde-workspace/6878e972b87e9ef34617c6280eda8ac5d7113a29

Ok, this fixes Bhushan's crash, but unfortunately it does nothing for the openSUSE crashes (nor does Bhushan's original patch - as a side note, while my patch technically makes it unnecessary by avoiding calls to it for launcher items (hence also improving performance slightly), I also made a commit that adds slightly different extra sanity checking to itemGeometryChanged() as well, to avoid breakage in the future if it ends up being used differently).

@Toralf: Thanks for the reply.

So as for openSUSE crash are we sure that?

1) It happens in taskbar-widget/taskbar (Remove taskbar completely from desktop and login)
2) It happens when launcher is there?

(In reply to comment #78)
> Ok, this fixes Bhushan's crash, but unfortunately it does nothing for the
> openSUSE crashes (nor does Bhushan's original patch - as a side note, while
> my patch technically makes it unnecessary by avoiding calls to it for
> launcher items (hence also improving performance slightly), I also made a
> commit that adds slightly different extra sanity checking to
> itemGeometryChanged() as well, to avoid breakage in the future if it ends up
> being used differently).
> 
> @Toralf: Thanks for the reply.

I can only reproduce it in connection with launchers, but the crashes occur all over the place in plasma-desktop - I have backtraces ending in the toolbox, in the tray, in the NM plasmoid, etc. - so it's probably memory corruption. I might need to rebuild a lot of stuff with asan in the VM, or maybe valgrind will do the trick already. Before I am investigating a hunch though ...

Can you try with plasmoidviewer? Because it can give clean backtrace probably.

(In reply to comment #80)
> I can only reproduce it in connection with launchers, but the crashes occur
> all over the place in plasma-desktop - I have backtraces ending in the
> toolbox, in the tray, in the NM plasmoid, etc. - so it's probably memory
> corruption. I might need to rebuild a lot of stuff with asan in the VM, or
> maybe valgrind will do the trick already. Before I am investigating a hunch
> though ...

Unfortunately I can't get it to crash in plasma-windowed, plasmoidviewer, or on valgrind ... which is what I was sort of expecting in terms of gut feeling, that's why I'm hoping asan will help.

So this crash happens only when the widget is in panel, either grouping panel or default panel or empty panel.. It must be in panel and should have launcher items to crash. Try with empty panel and taskwidget.

I'm also currently not able to test (build that is) Eike's patches, but starting plasma with Exec=LANG=$LANG resolves all the crashes (i've added the mentioned workaround now to openSUSE packages)

The other traces (or at least many) look like accessing properties on a deleted QObject.
From the way in, it looks like events being delivered to them.
Are any Objects inside QGraphics* deleted directly (instead deleteLater)?

Every time I check "Show Launcher When not running", I get this kDebug message in log

plasmoidviewer(3866)/plasma TaskManager::TaskGroup::remove: couldn't find item

(In reply to comment #85)
> The other traces (or at least many) look like accessing properties on a
> deleted QObject.
> From the way in, it looks like events being delivered to them.
> Are any Objects inside QGraphics* deleted directly (instead deleteLater)?

The LANG=$LANG thing won't help with Bhushan's crash, but then it seems he was the only one who was affected (but the changes make sense anyway). The reason the LANG thing helps seems to be because it otherwise trips a crash in Qt's unicode encoder when it tries to format garbage in an XError caught by KApplication:xErrhandler during an animation.

(In reply to comment #84)
> I'm also currently not able to test (build that is) Eike's patches, but
> starting plasma with Exec=LANG=$LANG resolves all the crashes (i've added
> the mentioned workaround now to openSUSE packages)

The workaround is missing from openSUSE Tumbleweed packages.

Some good news: It turns out I unfortunately made a typo in an 'export' in the VM, causing the wrong applet to be loaded. It turns out that with the patches I committed earlier (either would do), one of the openSUSE crashes disappears after all, since it was ultimately related to attempting to perform coordinate mapping for bogus coordinates, leading to that XError. Hrvoje, I would suggest you backport those patches instead of the LANG thing.

However, the hover crash is still there and a separate matter, but I was able to get a better backtrace for it now that will make it easier to figure out:

Application: Plasma Desktop Shell (plasma-desktop), signal: Segmentation
fault
Using host libthread_db library "/lib/libthread_db.so.1".
[Current thread is 1 (Thread 0xb53e0740 (LWP 2350))]

Thread 4 (Thread 0xaddbab40 (LWP 2382)):
#0  0xb7702422 in __kernel_vsyscall ()
#1  0xb6ba399c in pthread_cond_wait@@GLIBC_2.3.2 () from
/lib/libpthread.so.0
#2  0xb0d15a92 in QTWTF::TCMalloc_PageHeap::scavengerThread
(this=this@entry=0xb0e127e0
<QTWTF::pageheap_memory>) at
../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:2359
#3  0xb0d15adf in QTWTF::TCMalloc_PageHeap::runScavengerThread
(context=0xb0e127e0 <QTWTF::pageheap_memory>) at
../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:1464
#4  0xb6b9fe6a in start_thread () from /lib/libpthread.so.0
#5  0xb5f22e9e in clone () from /lib/libc.so.6

Thread 3 (Thread 0xa659eb40 (LWP 2384)):
#0  0xb7702422 in __kernel_vsyscall ()
#1  0xb5f35842 in clock_gettime () from /lib/libc.so.6
#2  0xb6c7e09c in do_gettime (frac=0xa659dff0, sec=0xa659dfe8) at
tools/qelapsedtimer_unix.cpp:127
#3  qt_gettime () at tools/qelapsedtimer_unix.cpp:144
#4  0xb6d644a2 in updateCurrentTime (this=0x8ef4324) at
kernel/qeventdispatcher_unix.cpp:354
#5  QTimerInfoList::timerWait (this=0x8ef4324, tm=...) at
kernel/qeventdispatcher_unix.cpp:460
#6  0xb6d62a5b in timerSourcePrepareHelper (src=src@entry=0x8ef42f0,
timeout=0xa659e0ec) at kernel/qeventdispatcher_glib.cpp:136
#7  0xb6d62aea in timerSourcePrepare (source=0x8ef42f0, timeout=<optimized
out>) at kernel/qeventdispatcher_glib.cpp:169
#8  0xb58cdd93 in g_main_context_prepare () from /usr/lib/libglib-2.0.so.0
#9  0xb58ce6af in ?? () from /usr/lib/libglib-2.0.so.0
#10 0xb58ce8f8 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#11 0xb6d62c2f in QEventDispatcherGlib::processEvents (this=0x8eed0b0,
flags=...) at kernel/qeventdispatcher_glib.cpp:427
#12 0xb6d32013 in QEventLoop::processEvents (this=this@entry=0xa659e258,
flags=...) at kernel/qeventloop.cpp:149
#13 0xb6d32339 in QEventLoop::exec (this=0xa659e258, flags=...) at
kernel/qeventloop.cpp:204
#14 0xb6c2030d in QThread::exec (this=0x8eeadd0) at thread/qthread.cpp:536
#15 0xb6d123f4 in QInotifyFileSystemWatcherEngine::run (this=0x8eeadd0) at
io/qfilesystemwatcher_inotify.cpp:256
#16 0xb6c22c5f in QThreadPrivate::start (arg=0x8eeadd0) at
thread/qthread_unix.cpp:338
#17 0xb6b9fe6a in start_thread () from /lib/libpthread.so.0
#18 0xb5f22e9e in clone () from /lib/libc.so.6

Thread 2 (Thread 0xa3fb0b40 (LWP 2393)):
#0  0xb7702422 in __kernel_vsyscall ()
#1  0xb6ba3d7e in pthread_cond_timedwait@@GLIBC_2.3.2 () from
/lib/libpthread.so.0
#2  0xb6c231b3 in wait (time=30000, this=0x979a8e0) at
thread/qwaitcondition_unix.cpp:84
#3  QWaitCondition::wait (this=0x979b3a8, mutex=0x979b3a4, time=30000) at
thread/qwaitcondition_unix.cpp:158
#4  0xb6c15ed2 in QThreadPoolThread::run (this=0x8846958) at
concurrent/qthreadpool.cpp:141
#5  0xb6c22c5f in QThreadPrivate::start (arg=0x8846958) at
thread/qthread_unix.cpp:338
#6  0xb6b9fe6a in start_thread () from /lib/libpthread.so.0
#7  0xb5f22e9e in clone () from /lib/libc.so.6

Thread 1 (Thread 0xb53e0740 (LWP 2350)):
[KCrash Handler]
#7  0xb6d3a58f in QMetaObject::indexOfProperty (this=0xad03eccc
<IconItem::staticMetaObject>, name=0x50 <Address 0x50 out of bounds>) at
kernel/qmetaobject.cpp:738
#8  0xb6d46829 in QObject::property (this=0x9aa53b0, name=0x50 <Address
0x50 out of bounds>) at kernel/qobject.cpp:3765
#9  0xb6c0a947 in QPropertyAnimation::updateState (this=0x98ab9a0,
newState=QAbstractAnimation::Running, oldState=QAbstractAnimation::Stopped)
at animation/qpropertyanimation.cpp:288
#10 0xb6c04b0a in QAbstractAnimationPrivate::setState (this=0x9aa5628,
newState=QAbstractAnimation::Running) at
animation/qabstractanimation.cpp:569
#11 0xad024093 in IconItem::loadPixmap (this=0x9aa53b0) at
/home/sho/devel/src/kde-runtime/plasma/declarativeimports/core/iconitem.cpp:322
#12 0xad02354d in IconItem::setActive (this=0x9aa53b0, active=true) at
/home/sho/devel/src/kde-runtime/plasma/declarativeimports/core/iconitem.cpp:159
#13 0xad024514 in IconItem::qt_metacall (this=0x9aa53b0,
_c=QMetaObject::WriteProperty, _id=4, _a=0xbf82a3d0) at
/home/sho/devel/build/kde-runtime/plasma/declarativeimports/core/iconitem.moc:150
#14 0xb6d3a095 in QMetaObject::metacall (object=0x9aa53b0,
cl=QMetaObject::WriteProperty, idx=45, argv=0xbf82a3d0) at
kernel/qmetaobject.cpp:245
#15 0xb09ca919 in QDeclarativeCompiledBindingsPrivate::run
(this=this@entry=0x98742c0,
instrIndex=1, context=0x9a3e658, error=error@entry=0x8ef20b4,
scope=0x9aa53b0, output=0x9aa53b0, storeFlags=...) at
qml/qdeclarativecompiledbindings.cpp:1540
#16 0xb09cb9c0 in QDeclarativeCompiledBindingsPrivate::run
(this=this@entry=0x98742c0,
binding=0x8ef2094, flags=...) at qml/qdeclarativecompiledbindings.cpp:428
#17 0xb09cbc59 in QDeclarativeCompiledBindings::qt_metacall
(this=0x8ef3c88, c=QMetaObject::InvokeMetaMethod, id=<optimized out>) at
qml/qdeclarativecompiledbindings.cpp:380
#18 0xb6d3a095 in QMetaObject::metacall (object=0x8ef3c88,
cl=QMetaObject::InvokeMetaMethod, idx=6, argv=0xbf82a7b8) at
kernel/qmetaobject.cpp:245
#19 0xb6d4858b in QMetaObject::activate (sender=0x9275010, m=0xade0ab7c
<MouseEventListener::staticMetaObject>, local_signal_index=6,
argv=0xbf82a7b8) at kernel/qobject.cpp:3586
#20 0xaddfe03c in MouseEventListener::containsMouseChanged (this=0x9275010,
_t1=true) at
/home/sho/devel/build/kde-runtime/plasma/declarativeimports/qtextracomponents/mouseeventlistener.moc:410
#21 0xaddfc2cc in MouseEventListener::hoverEnterEvent (this=0x9275010,
event=0xbf82a8f0) at
/home/sho/devel/src/kde-runtime/plasma/declarativeimports/qtextracomponents/mouseeventlistener.cpp:74
#22 0xb686cfbb in QGraphicsItem::sceneEvent (this=0x9275018,
event=0xbf82a8f0) at graphicsview/qgraphicsitem.cpp:6735
#23 0xb08f18f6 in QDeclarativeItem::sceneEvent (this=0x9275010,
event=0xbf82a8f0) at graphicsitems/qdeclarativeitem.cpp:3047
#24 0xb6896be6 in QGraphicsScenePrivate::sendEvent (this=0x89e9290,
item=0x9275018, event=0xbf82a8f0) at graphicsview/qgraphicsscene.cpp:1221
#25 0xb689e9b3 in QGraphicsScenePrivate::sendHoverEvent
(this=this@entry=0x89e9290,
type=type@entry=QEvent::GraphicsSceneHoverEnter, item=0x9275018,
hoverEvent=0xbf82a9a0) at graphicsview/qgraphicsscene.cpp:1268
#26 0xb689ed40 in QGraphicsScenePrivate::dispatchHoverEvent
(this=this@entry=0x89e9290,
hoverEvent=hoverEvent@entry=0xbf82a9a0) at
graphicsview/qgraphicsscene.cpp:3939
#27 0xb689f250 in QGraphicsScene::mouseMoveEvent (this=0x89f6298,
mouseEvent=0xbf82ace0) at graphicsview/qgraphicsscene.cpp:4097
#28 0xb68ac168 in QGraphicsScene::event (this=0x89f6298, event=0xbf82ace0)
at graphicsview/qgraphicsscene.cpp:3451
#29 0xb621f4b4 in QApplicationPrivate::notify_helper (this=0x88930f8,
receiver=0x89f6298, e=0xbf82ace0) at kernel/qapplication.cpp:4562
#30 0xb6225ee3 in QApplication::notify (this=0x88848d8, receiver=0x89f6298,
e=0xbf82ace0) at kernel/qapplication.cpp:4348
#31 0xb7482ae4 in KApplication::notify (this=0x88848d8, receiver=0x89f6298,
event=0xbf82ace0) at
/usr/src/debug/kdelibs-4.10.97/kdeui/kernel/kapplication.cpp:311
#32 0xb6d335ca in QCoreApplication::notifyInternal (this=0x88848d8,
receiver=0x89f6298, event=0xbf82ace0) at kernel/qcoreapplication.cpp:949
#33 0xb621db9d in sendSpontaneousEvent (event=0xbf82ace0,
receiver=0x89f6298) at ../../src/corelib/kernel/qcoreapplication.h:234
#34 qt_sendSpontaneousEvent (receiver=0x89f6298, event=0xbf82ace0) at
kernel/qapplication.cpp:5560
#35 0xb68c3efd in QGraphicsViewPrivate::mouseMoveEventHandler
(this=this@entry=0x966cc28, event=event@entry=0xbf82b284) at
graphicsview/qgraphicsview.cpp:646
#36 0xb68c5010 in QGraphicsView::mouseMoveEvent (this=0x966c818,
event=0xbf82b284) at graphicsview/qgraphicsview.cpp:3276
#37 0xb62796bc in QWidget::event (this=0x966c818, event=0xbf82b284) at
kernel/qwidget.cpp:8361
#38 0xb667ed3c in QFrame::event (this=0x966c818, e=0xbf82b284) at
widgets/qframe.cpp:557
#39 0xb670dfe8 in QAbstractScrollArea::viewportEvent (this=0x966c818,
e=0xbf82b284) at widgets/qabstractscrollarea.cpp:1043
#40 0xb68c6a57 in QGraphicsView::viewportEvent (this=<optimized out>,
event=<optimized out>) at graphicsview/qgraphicsview.cpp:2866
#41 0xb670e266 in viewportEvent (event=0xbf82b284, this=<optimized out>) at
widgets/qabstractscrollarea_p.h:100
#42 QAbstractScrollAreaFilter::eventFilter (this=0x962f288, o=0x96358d0,
e=0xbf82b284) at widgets/qabstractscrollarea_p.h:116
#43 0xb6d3373e in QCoreApplicationPrivate::sendThroughObjectEventFilters
(this=0x88930f8, receiver=0x96358d0, event=0xbf82b284) at
kernel/qcoreapplication.cpp:1059
#44 0xb621f491 in QApplicationPrivate::notify_helper (this=0x88930f8,
receiver=receiver@entry=0x96358d0, e=0xbf82b284) at
kernel/qapplication.cpp:4558
#45 0xb6227105 in QApplication::notify (this=0x88848d8, receiver=0x96358d0,
e=0xbf82b284) at kernel/qapplication.cpp:4105
#46 0xb7482ae4 in KApplication::notify (this=0x88848d8, receiver=0x96358d0,
event=0xbf82b284) at
/usr/src/debug/kdelibs-4.10.97/kdeui/kernel/kapplication.cpp:311
#47 0xb6d335ca in QCoreApplication::notifyInternal (this=0x88848d8,
receiver=0x96358d0, event=0xbf82b284) at kernel/qcoreapplication.cpp:949
#48 0xb6225741 in sendSpontaneousEvent (event=0xbf82b284,
receiver=0x96358d0) at ../../src/corelib/kernel/qcoreapplication.h:234
#49 QApplicationPrivate::sendMouseEvent (receiver=0x96358d0,
event=0xbf82b284, alienWidget=0x96358d0, nativeWidget=0x966c818,
buttonDown=0xb6b95c84 <qt_button_down>, lastMouseReceiver=...,
spontaneous=true) at kernel/qapplication.cpp:3171
#50 0xb62a6068 in QETWidget::translateMouseEvent (this=0x966c818,
event=event@entry=0xbf82b49c) at kernel/qapplication_x11.cpp:4528
#51 0xb62a4730 in QApplication::x11ProcessEvent (this=0x88848d8,
event=0xbf82b49c) at kernel/qapplication_x11.cpp:3651
#52 0xb62cf434 in x11EventSourceDispatch (s=0x88939b0, callback=0x0,
user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#53 0xb58ce48e in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#54 0xb58ce838 in ?? () from /usr/lib/libglib-2.0.so.0
#55 0xb58ce8f8 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#56 0xb6d62c2f in QEventDispatcherGlib::processEvents (this=0x88721e8,
flags=...) at kernel/qeventdispatcher_glib.cpp:427
#57 0xb62cf4ee in QGuiEventDispatcherGlib::processEvents (this=0x88721e8,
flags=...) at kernel/qguieventdispatcher_glib.cpp:204
#58 0xb6d32013 in QEventLoop::processEvents (this=this@entry=0xbf82b758,
flags=...) at kernel/qeventloop.cpp:149
#59 0xb6d32339 in QEventLoop::exec (this=0xbf82b758, flags=...) at
kernel/qeventloop.cpp:204
#60 0xb6d37b1e in QCoreApplication::exec () at
kernel/qcoreapplication.cpp:1221
#61 0xb621d944 in QApplication::exec () at kernel/qapplication.cpp:3823
#62 0xaf7a4f77 in kdemain () from /usr/lib/libkdeinit4_plasma-desktop.so
#63 0x0804fba3 in _start ()

(In reply to comment #89)
> Hrvoje, I would suggest you backport those patches instead of the LANG thing.
OK, done.
 
> However, the hover crash is still there and a separate matter, but I was
> able to get a better backtrace for it now that will make it easier to figure
> out:
I'm already lost in the sea of the backtraces posted here, but this one seems quite similar to previous one, no?

Yeah, but it has more detail at exactly what property animation we're crashing in - the IconItem. That makes it easier to audit the code paths and figure out the fix now. Post dinner at the earliest though, it's Sunday ;).

The crashes at login and when closing an app after clicking "Show a launcher" should be fixed by the commits on the other hand.

Aha :-)
I could swear i saw IconItem somewhere in the traces already ;-)

Well, those two where the most critical, so take your time in analyzing the rest ;-)
Thanks to everyone for input, help, (potential) fixes, nerves, etc

No problem, and thanks everyone for helping out - this bug report is starting to feel like Apollo 13 mission control ;).

Last pre-dinner news: I currently have a work branch on my box that refactors some of the mouse and DND handling in the applet to fix another rage edge case crash (bug 323742, crash when performing the drop part of a DND operation after the source task item has been destroyed due to a virtual desktop switch), and very interestingly and promisingly, this work branch no longer causes the hover crash in the openSUSE VM, probably because it vastly simplifies the mouse event routing through the QGraphics* scene sub-hierarchy in task items. I'd like to actually properly determine the reason instead of just shrugging it off, but it sounds like that might just kill two bugs with one stone when I finish it.

Since IconItem apparently abuses QPropertyAnimation (sets no property to animate) all those "name=0x50 <Address 0x50 out of bounds>" lines mean that m_animation or rather its private is junk.

Can anybody cause this bug with tooltips DISabled?

(In reply to comment #94)
> Can anybody cause this bug with tooltips DISabled?

IIRC it crashed with tooltips disabled also, but maybe my memory serves me wrong.
I think i even tried disabling them in applet itself (that's why i remember seeing IconItem already)

(In reply to comment #95)
> (In reply to comment #94)
> > Can anybody cause this bug with tooltips DISabled?
> 
> IIRC it crashed with tooltips disabled also, but maybe my memory serves me
> wrong.
I just tried disabling the tooltips, but that didn't change anything: plasma still crashed on login. (openSUSE Factory 32bit here)

What fixes the crash for me:
- changing the Exec line to "LANG=de_AT.UTF-8 plasma-desktop" (my standard locale; but even LANG=$LANG works...)
- the patch from comment#49 does fix the crash for me
- the commit from comment#77 also makes the crash disappear here

So because of the last item, for me this is fixed now.
Thank you.

(In reply to comment #96)

> I just tried disabling the tooltips, but that didn't change anything: plasma
> still crashed on login. (openSUSE Factory 32bit here)

The tooltips are not related to "the other crash", that one's pretty much sorted out (see commits and Bhushan's review request/comments)

Afaiu there's however another crash that occurs when hovering the item and causes the backtraces that end in IconItem starting an animation, suggesting that IconItem is either none or already deleted.

Eike suggested that some cleanup of input redirection (where i'm not sure what he means since that should be done by QGraphicsScene) was the cause.
Tooltips are popups, thus grab the pointer thus might generate pointer events an infrastructure initally designed towards cellphones may be not prepared for. Therefore my guess (and the other guess that Eikes changes might have moved tooltip spawning behind the hover triggering)

> where i'm not sure what he means since that should be done by QGraphicsScene

Plasma's mouse-related QML components, like MouseEventListener and DragArea, are generally implemented to listen for events both on themselves and to filter the scene for events on their children. This makes their code fairly ugly and has caused bugs in there multiple times (I just fixed one the other day where the ungrab event caused by a popup menu opening would cause MouseEventListener to lose track of what events it has already pushed into slots and push the same press twice, for example).

The refactoring I'm working on simplifies the internals of the task delegate as a side-effect of moving drag instantiation out of QML (since the components can't handle our requirements for the moment) and as a side-effect gets rid of two mouse event handlers one of which filtered the other ... and this ends up addressing or at least hiding the hover crash, since the path into the crash is related to event delivery and the flow is now different.

I'm not really entirely happy with that because it doesn't conclusively prove it's fixed / entirely race-free, so I'm still investigating (but will push the rework anyway, since it was originally motivated by and addresses a different issue).

Do the LANG/KLocalizedString related crashes need to be fixed separately before this can be resolved? I am a bit confused by all the different backtraces.

Anyway, Eike, you did a good job huntung that down, merci!

In case you want to debug more wired QML crashes, please check bug 311871 :)

Git commit 3ff3f433e07e78d12e1081e6e571c097216de591 by Eike Hein.
Committed on 26/08/2013 at 21:54.
Pushed by hein into branch 'KDE/4.11'.

Queue signal delivery for launcher toggling.

This allows QGraphicsScene to perform a mouse ungrab after
the popup menu is dismissed before the launcher delegate is
destroyed, avoiding a crash.
CCMAIL:carlosdgtorres@gmail.com

M  +1    -1    libs/taskmanager/taskactions.cpp

http://commits.kde.org/kde-workspace/3ff3f433e07e78d12e1081e6e571c097216de591

Git commit af6653c766981ca81bac499de284abcdc2c7f08f by Eike Hein.
Committed on 26/08/2013 at 21:57.
Pushed by hein into branch 'KDE/4.11'.

Factor drag instanciation out into a C++ helper.

This moves the drag source out of the task delegate, making
sure it survives the delegate in scenarios where it might be
destroyed prior to dropping (e.g. due to a virtual desktop
switch), avoiding a crash. I'd like to move this back into
QML in Plasma 2 if we can add a programmatic way to initiate
a drag to DragArea, or work through some of the event hand-
ling issues involved with having a single drag area below
the repeater (though this would mean pretty ugly spaghetti
code regardless), or QML gains the ability to reparent
objects including transferring object ownership (unlikely ...).
Related: bug 323742

This also reduces the number of sub-items the task delegate
instanciates and specifically the number of mouse event-
handling items per task from two to one, simplifying the
scene mouse event filtering that's going on, which appears
to address a second rare crash (or at least it has become
unreproducable here), although further investigation to
prove this conclusively would be nice.

M  +1    -0    plasma/desktop/applets/tasks/CMakeLists.txt
M  +4    -4    plasma/desktop/applets/tasks/package/contents/ui/MouseHandler.qml
M  +58   -49   plasma/desktop/applets/tasks/package/contents/ui/Task.qml
M  +11   -0    plasma/desktop/applets/tasks/package/contents/ui/main.qml
A  +61   -0    plasma/desktop/applets/tasks/support/draghelper.cpp     [License: GPL (v2+)]
A  +45   -0    plasma/desktop/applets/tasks/support/draghelper.h     [License: GPL (v2+)]
M  +2    -0    plasma/desktop/applets/tasks/tasks.cpp

http://commits.kde.org/kde-workspace/af6653c766981ca81bac499de284abcdc2c7f08f

@Christoph: I believe the LANG-related crashes were due to garbage in an XError handled by KApplication:xErrhandler as a consequence of QWidget::mapToGlobal on bogus coordinates, somehow setting the locale seemed to avoid the string re-encoding stuff it ended up crashing in ... 

I'm not really sure about that toolbox crasher ending in KLocalizedString, but there's tooltip code leading up to it, and another thing af6653c does as a side-effect of refactoring the task delegate sub-item hierarchy is changing the target item for the tooltip to being the always-visible, "inert" FrameSvg item instead of having it be the DragArea that used to be the delegate's root item. This might be relevant because DragArea obviously mouse event handling, and setting an item to be the tooltip's target causes the tooltip manager to have to filter its events too, so it was another case of quite convoluted mouse handling and possibly events getting dropped on the floor somehow ...

It's all a bit vague overall, but ultimately the delegate is constructed in a much simpler way now and that seems to be avoiding all this trouble now as far as I can tell.

Sorry, s/obviously mouse event handling/obviously does mouse event handling/ up there.

(And to add to the above, sorry for the noise: To reiterate, that faulty mapToGlobal business got fixed by the commtis made on Sunday.)

*** Bug 324092 has been marked as a duplicate of this bug. ***

*** Bug 323903 has been marked as a duplicate of this bug. ***

Git commit edf70199767b574583003091745fcc67d3a4827c by Eike Hein.
Committed on 26/08/2013 at 21:54.
Pushed by hein into branch 'frameworks-scratch'.

Queue signal delivery for launcher toggling.

This allows QGraphicsScene to perform a mouse ungrab after
the popup menu is dismissed before the launcher delegate is
destroyed, avoiding a crash.
CCMAIL:carlosdgtorres@gmail.com

M  +1    -1    libs/taskmanager/taskactions.cpp

http://commits.kde.org/kde-workspace/edf70199767b574583003091745fcc67d3a4827c

*** Bug 324527 has been marked as a duplicate of this bug. ***

I'm seeing plasma crashes on 64bit Fedora as well