Bug 351839 - segfault in QV4::ExecutionEngine::newStringObject
Summary: segfault in QV4::ExecutionEngine::newStringObject
Status: RESOLVED WORKSFORME
Alias: None
Product: kwin
Classification: Plasma
Component: aurorae (show other bugs)
Version: 5.3.2
Platform: Arch Linux Linux
: NOR crash
Target Milestone: ---
Assignee: KWin default assignee
URL:
Keywords:
: 349921 356480 357631 357742 358204 358966 359064 360323 363094 366385 368297 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-08-27 07:01 UTC by Josh
Modified: 2022-02-24 00:06 UTC (History)
16 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
KWin supportInformation (4.70 KB, text/plain)
2015-08-27 07:23 UTC, Josh
Details
Backtrace of KWin stopped process when crash happens (36.50 KB, text/plain)
2016-01-26 10:47 UTC, Angelos Skembris
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Josh 2015-08-27 07:01:19 UTC
kwin_x11 crashes if multiple windows are launched soon (seems to be about 15 seconds in) after plasma 5 has started (SDDM).

Firstly i apologize if this report isn't up to standard, haven't filed a bug report before, since this is reproducible with drivers (Arch packaged): "nvidia-340xx", "nvidia" and nouveau, I thought it would be worth reporting.

I've tried removing ~/.kde4 with no fix, i've disabled all Desktop effects, installed themes and icons, still the issue persists.



Reproducible: Always

Steps to Reproduce:
1.Start Plasma
2.Open "System Settings" then "Konsole" from Application Launcher quickly
3.kwin locks up

Actual Results:  
With Nvidia drivers, Kwin normally relaunches and starts error reporting. otherwise locks up as soon as the second window is drawn

With Nouveau, Kwin freezes before second window is launched (instantly after click)

Expected Results:  
Kwin doesn't lock up

Application: KWin (kwin_x11), signal: Segmentation fault
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[Current thread is 1 (Thread 0x7f00ec765840 (LWP 2733))]

full backtrace pulled when using nvidia drivers,
http://pastebin.com/GcSgDcfH

hardware configuration:

GPU: GTX 570 (primary)
# GPU: AMD R9 290 (added to pci-stub so not relevant)
CPU: AMD FX8320
RAM: 16gb ddr3
Comment 1 Thomas Lübking 2015-08-27 07:05:32 UTC
Do never use pastebin for relevant bug information.
------------------

Application: KWin (kwin_x11), signal: Segmentation fault
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[Current thread is 1 (Thread 0x7f00ec765840 (LWP 2733))]

Thread 6 (Thread 0x7f00ca0e4700 (LWP 2743)):
#0  0x00007f00eba02428 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007f00e9d08c66 in QWaitCondition::wait(QMutex*, unsigned long) () from /usr/lib/libQt5Core.so.5
#2  0x00007f00e9d04723 in ?? () from /usr/lib/libQt5Core.so.5
#3  0x00007f00e9d07a9e in ?? () from /usr/lib/libQt5Core.so.5
#4  0x00007f00eb9fc4a4 in start_thread () from /usr/lib/libpthread.so.0
#5  0x00007f00ec19612d in clone () from /usr/lib/libc.so.6

Thread 5 (Thread 0x7f00c941c700 (LWP 2747)):
#0  0x00007f00ec18ee23 in select () from /usr/lib/libc.so.6
#1  0x00007f00e9f3a91f in qt_safe_select(int, fd_set*, fd_set*, fd_set*, timespec const*) () from /usr/lib/libQt5Core.so.5
#2  0x00007f00e9f3c3f7 in QEventDispatcherUNIXPrivate::doSelect(QFlags<QEventLoop::ProcessEventsFlag>, timespec*) () from /usr/lib/libQt5Core.so.5
#3  0x00007f00e9f3c8fe in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#4  0x00007f00e9ee626a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#5  0x00007f00e9d02af4 in QThread::exec() () from /usr/lib/libQt5Core.so.5
#6  0x00007f00e41bd335 in ?? () from /usr/lib/libQt5Qml.so.5
#7  0x00007f00e9d07a9e in ?? () from /usr/lib/libQt5Core.so.5
#8  0x00007f00eb9fc4a4 in start_thread () from /usr/lib/libpthread.so.0
#9  0x00007f00ec19612d in clone () from /usr/lib/libc.so.6

Thread 4 (Thread 0x7f00c3dfa700 (LWP 2752)):
#0  0x00007f00eba02428 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007f00e9d08c66 in QWaitCondition::wait(QMutex*, unsigned long) () from /usr/lib/libQt5Core.so.5
#2  0x00007f00e9d04723 in ?? () from /usr/lib/libQt5Core.so.5
#3  0x00007f00e9d07a9e in ?? () from /usr/lib/libQt5Core.so.5
#4  0x00007f00eb9fc4a4 in start_thread () from /usr/lib/libpthread.so.0
#5  0x00007f00ec19612d in clone () from /usr/lib/libc.so.6

Thread 3 (Thread 0x7f00c349c700 (LWP 2753)):
#0  0x00007f00eba0207f in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
#1  0x00007f00e8c44564 in ?? () from /usr/lib/libQt5Script.so.5
#2  0x00007f00e8c445a9 in ?? () from /usr/lib/libQt5Script.so.5
#3  0x00007f00eb9fc4a4 in start_thread () from /usr/lib/libpthread.so.0
#4  0x00007f00ec19612d in clone () from /usr/lib/libc.so.6

Thread 2 (Thread 0x7f0036364700 (LWP 2974)):
#0  0x00007f00ec18ee23 in select () from /usr/lib/libc.so.6
#1  0x00007f00e9f3a91f in qt_safe_select(int, fd_set*, fd_set*, fd_set*, timespec const*) () from /usr/lib/libQt5Core.so.5
#2  0x00007f00e9f3c3f7 in QEventDispatcherUNIXPrivate::doSelect(QFlags<QEventLoop::ProcessEventsFlag>, timespec*) () from /usr/lib/libQt5Core.so.5
#3  0x00007f00e9f3c8fe in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#4  0x00007f00e9ee626a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt5Core.so.5
#5  0x00007f00e9d02af4 in QThread::exec() () from /usr/lib/libQt5Core.so.5
#6  0x00007f00e41bd335 in ?? () from /usr/lib/libQt5Qml.so.5
#7  0x00007f00e9d07a9e in ?? () from /usr/lib/libQt5Core.so.5
#8  0x00007f00eb9fc4a4 in start_thread () from /usr/lib/libpthread.so.0
#9  0x00007f00ec19612d in clone () from /usr/lib/libc.so.6

Thread 1 (Thread 0x7f00ec765840 (LWP 2733)):
[KCrash Handler]
#5  0x00007f00e411453a in QV4::Heap::String::append(QV4::Heap::String const*, QChar*) () from /usr/lib/libQt5Qml.so.5
#6  0x00007f00e4114615 in QV4::Heap::String::simplifyString() const () from /usr/lib/libQt5Qml.so.5
#7  0x00007f00e40cf818 in ?? () from /usr/lib/libQt5Qml.so.5
#8  0x00007f00e4076973 in QV4::ExecutionEngine::newStringObject(QV4::Value const&) () from /usr/lib/libQt5Qml.so.5
#9  0x00007f00e410f922 in QV4::Runtime::getProperty(QV4::ExecutionEngine*, QV4::Value const&, int) () from /usr/lib/libQt5Qml.so.5
#10 0x00007f00eb364b39 in ?? ()
#11 0x00007f00e4ad4fc2 in QQuickItem::staticMetaObject () from /usr/lib/libQt5Quick.so.5
#12 0x00007f002cea6260 in ?? ()
#13 0x0000000003c6cfb0 in ?? ()
#14 0x00007f002cea6258 in ?? ()
#15 0x0000000002771190 in ?? ()
#16 0x00007f00ea46d7f9 in ?? () from /usr/lib/libQt5Gui.so.5
#17 0x0000000002771190 in ?? ()
#18 0x0000000002771190 in ?? ()
#19 0x0000000003c69ff8 in ?? ()
#20 0x0000000000000003 in ?? ()
#21 0x0000000003c71500 in ?? ()
#22 0x00007f00e44fe300 in ?? () from /usr/lib/libQt5Qml.so.5
#23 0x00007f002cea61f8 in ?? ()
#24 0x0000000002771190 in ?? ()
#25 0x00007ffddd2df4f0 in ?? ()
#26 0x00007f00c82136b0 in ?? ()
#27 0x0000000000000000 in ?? ()
Comment 2 Thomas Lübking 2015-08-27 07:09:13 UTC
Looks related to bug #351767 or bug #349921

Can you please attach (to the bug) the output of
    qdbus org.kde.KWin /KWin supportInformation
Comment 3 Josh 2015-08-27 07:23:32 UTC
Created attachment 94243 [details]
KWin supportInformation
Comment 4 Thomas Lübking 2015-08-27 07:28:49 UTC
> Plugin: org.kde.kwin.aurorae
> Theme: __aurorae__svg__PapirusDark

Please try to select the "breeze" decoration (not an aurorae theme) in "kcmshell5 kwindecoration"

> OpenGL vendor string: nouveau
> OpenGL renderer string: Gallium 0.4 on NVC8

nouveau is at this point considered to be generally less reliable than the nvidia blob.
Comment 5 Josh 2015-08-27 07:41:24 UTC
(In reply to Thomas Lübking from comment #4)
> > Plugin: org.kde.kwin.aurorae
> > Theme: __aurorae__svg__PapirusDark
> 
> Please try to select the "breeze" decoration (not an aurorae theme) in
> "kcmshell5 kwindecoration"
> 
> > OpenGL vendor string: nouveau
> > OpenGL renderer string: Gallium 0.4 on NVC8
> 
> nouveau is at this point considered to be generally less reliable than the
> nvidia blob.

Thats awkward, changing the theme back to "breeze" appears to have solved the crashing, tested with both nvidia and nouveau. thanks
Comment 6 Josh 2015-08-28 00:24:27 UTC
Seems to be resolved with Plasma 5.4 in Arch testing repos, themes working with kwin as expected (no crashing). I'll mark as  resolved.
Comment 7 Thomas Lübking 2015-12-14 15:52:36 UTC
*** Bug 356480 has been marked as a duplicate of this bug. ***
Comment 8 Thomas Lübking 2016-01-19 11:11:24 UTC
*** Bug 357742 has been marked as a duplicate of this bug. ***
Comment 9 Thomas Lübking 2016-01-19 11:11:35 UTC
*** Bug 358204 has been marked as a duplicate of this bug. ***
Comment 10 Thomas Lübking 2016-01-19 11:12:53 UTC
*** Bug 349921 has been marked as a duplicate of this bug. ***
Comment 11 Angelos Skembris 2016-01-26 10:47:07 UTC
Created attachment 96847 [details]
Backtrace of KWin stopped process when crash happens
Comment 12 Angelos Skembris 2016-01-26 10:53:47 UTC
I was informed I came across this bug, see https://forum.kde.org/viewtopic.php?f=111&t=130565 for the investigation that took place.

In order to reproduce the bug consistently, using an aurorae-based theme and a dual monitor set up, I do the following:

1) Open a VM in Virtualbox in the second monitor and close Virtualbox Manager so that only the VM window is in the second monitor, maximized.
2) Open Firefox (via taskbar icon).

Firefox will try to open on the main monitor and kwin will crash, with no DrKonqi to help out. Breeze decorations don't have this problem.

The VM window needs to be the last active window before opening firefox, otherwise it's not triggered.

I have attached a backtrace using gdb, but some symbols are missing, not sure from which packages.

I am on OpenSUSE Tumbleweed, with KWin 5.5.3. Can reproduce consistently on Intel graphics laptop and ATI graphics desktop.
Comment 13 Martin Flöser 2016-01-26 12:03:42 UTC
> 2) Open Firefox (via taskbar icon).

you mean launching a firefox instance?
Comment 14 Angelos Skembris 2016-01-26 12:08:03 UTC
 (In reply to Martin Gräßlin from comment #13)
> > 2) Open Firefox (via taskbar icon).
> 
> you mean launching a firefox instance?

Yes, It definitely triggers when the only and last activated window is the Virtualbox window, and I click on the taskbar icon of Firefox. I also have an icon in the  "Desktop folder" widget, but I hardly use it.
Comment 15 Martin Flöser 2016-01-26 12:15:32 UTC
For me the steps don't work. This could either mean there is more in it to reproduce it or it's fixed with Qt 5.6 (which I doubt).

The backtraces never show from where in KWin the crash happens. If there is a chance to get the ?? sections in the backtrace filled, I have hope that we can fix it.
Comment 16 Martin Flöser 2016-01-26 12:32:25 UTC
> or it's fixed with Qt 5.6

which might be the case. The code in question changed significantly. The line 
QV4::Heap::StringObject::StringObject (this=<optimized out>, engine=0x2ac1220, val=...)
    at /usr/src/debug/qtdeclarative-opensource-src-5.5.1/src/qml/jsruntime/qv4stringobject.cpp:91

doesn't exist at all in 5.6 branch.
Comment 17 Fabian Vogt 2016-01-26 12:44:55 UTC
I can reproduce it reliably by running

while true; do (kwrite &); sleep 1; killall kwrite; done

for a few minutes and then switching to an aurorae based theme.
I'm also using Qt 5.5.1, so it might be fixed.

The backtrace looks like:

#25 0x00007fffef9c6c70 in QQmlComponent::create(QQmlContext*) () at /usr/lib64/libQt5Qml.so.5
#26 0x00007fffc42b5474 in  () at /usr/lib64/qt5/plugins/org.kde.kdecoration2/kwin5_aurorae.so
#27 0x00007ffff73278c0 in  () at /usr/lib64/libkwin.so.5
#28 0x00007ffff721cba9 in  () at /usr/lib64/libkwin.so.5
#29 0x00007ffff7225c3b in  () at /usr/lib64/libkwin.so.5
#30 0x00007ffff725b669 in  () at /usr/lib64/libkwin.so.5
#31 0x00007ffff73273ec in  () at /usr/lib64/libkwin.so.5
#32 0x00007ffff7329942 in  () at /usr/lib64/libkwin.so.5
#33 0x00007ffff5727e17 in QMetaObject::activate(QObject*, int, int, void**) () at /usr/lib64/libQt5Core.so.5
#34 0x00007ffff720cef1 in KWin::Workspace::slotReconfigure() () at /usr/lib64/libkwin.so.5

with full debug info. Somehow gdb does not like kwin debugging, it does not show some symbols.
Comment 18 Thomas Lübking 2016-01-26 12:58:46 UTC
No idea whether it's "fixed", but QML apparently gets a completely new data allocation mechanism:
http://code.qt.io/cgit/qt/qtdeclarative.git/commit/src/qml/jsruntime/qv4stringobject.cpp?id=17a0c271e0ec606d15fc87dab23b2e3750c0e301

So we won't see *this* backtrace for sure on Qt 5.6
The problem is however the nullptr deref of the "string" member and that "merely" changed from "string = ic->engine->newString();" to "string = internalClass->engine->id_empty()->d();" - neither looks like there should ever be a nullptr. Maybe even the StringObject is nullptr.
Comment 19 Thomas Lübking 2016-01-26 13:00:32 UTC
Stupid question: FF is gtk3 on at least fedora. Do your FFs have a system titlebar?
Comment 20 Thomas Lübking 2016-01-26 14:04:37 UTC
Another thing I could think of because of the described pattern would be a problem w/ the Helper::ref/unref stuff - eg. if anything in QtQuick keeps/kept a dead engine around?

Also what about operating on m_context /after/ the ::unref() call might have nuked engine and components and stuff?
Comment 21 Martin Flöser 2016-01-26 14:27:07 UTC
> if anything in QtQuick keeps/kept a dead engine around?

I can add asserts to my local build.
Comment 22 Thomas Lübking 2016-02-06 12:18:02 UTC
*** Bug 359064 has been marked as a duplicate of this bug. ***
Comment 23 Thomas Lübking 2016-03-09 18:31:25 UTC
*** Bug 360323 has been marked as a duplicate of this bug. ***
Comment 24 Martin Flöser 2016-04-01 13:40:52 UTC
seems like we have a Qt 5.6 variant: https://bugs.kde.org/show_bug.cgi?id=361236
Comment 25 Thomas Lübking 2016-05-15 11:51:25 UTC
*** Bug 363094 has been marked as a duplicate of this bug. ***
Comment 26 Martin Flöser 2016-08-04 15:49:04 UTC
*** Bug 366385 has been marked as a duplicate of this bug. ***
Comment 27 Martin Flöser 2016-09-02 12:12:36 UTC
*** Bug 358966 has been marked as a duplicate of this bug. ***
Comment 28 Martin Flöser 2016-09-09 10:51:16 UTC
*** Bug 368297 has been marked as a duplicate of this bug. ***
Comment 29 Steven Dobai 2016-10-25 07:04:51 UTC
Hello,
 These crashes happen with KDE neon too.
Comment 30 Christoph Feck 2017-01-04 14:50:21 UTC
*** Bug 357631 has been marked as a duplicate of this bug. ***
Comment 31 David Edmundson 2022-02-24 00:06:59 UTC
This is super old with no duplicates. Closing