Can you tell me what legacy apps you have running?

Not really sure about how to exacltly identify legacy apps, however when the crash happened the apps running were:

hp-systray; 
akonaditray, kleopatra,knotes  (kde4/qt4)
smplayer (qt5 based)

I received a similar crash in Debian Stretch with plasma-workspace and
plasma-workspace-dbgsym in version 4:5.8.6-2.
At the time it crashed I assume just kradio4 tray icon was running
additionally to the default ones. (Saw just later the crash in dmesg.)


# coredumpctl gdb
Core was generated by `/usr/bin/xembedsniproxy'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  SNIProxy::getImageNonComposite (this=this@entry=0x5636e8f4b460) at ./xembed-sni-proxy/sniproxy.cpp:273
273         QImage naiveConversion = QImage(image->data, image->width, image->height, QImage::Format_ARGB32);
[Current thread is 1 (Thread 0x7f15c8ff25c0 (LWP 1559))]
(gdb) bt
#0  SNIProxy::getImageNonComposite (this=this@entry=0x5636e8f4b460) at ./xembed-sni-proxy/sniproxy.cpp:273
#1  0x00005636e7509507 in SNIProxy::update (this=0x5636e8f4b460) at ./xembed-sni-proxy/sniproxy.cpp:214
#2  0x00005636e7506583 in FdoSelectionManager::nativeEventFilter (this=0x7fff86289810, eventType=..., message=<optimized out>, result=<optimized out>) at ./xembed-sni-proxy/fdoselectionmanager.cpp:154
#3  0x00007f15c7b0ab0f in QAbstractEventDispatcher::filterNativeEvent(QByteArray const&, void*, long*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#4  0x00007f15beaa2334 in QXcbConnection::handleXcbEvent(xcb_generic_event_t*) () from /usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#5  0x00007f15beaa3015 in QXcbConnection::processXcbEvents() () from /usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#6  0x00007f15c7b3a499 in QObject::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#7  0x00007f15c7b0d87a in QCoreApplication::notify(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#8  0x00007f15c7b0d9e0 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#9  0x00007f15c7b1016d in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#10 0x00007f15c7b61c43 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#11 0x00007f15c3b757f7 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#12 0x00007f15c3b75a60 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#13 0x00007f15c3b75b0c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#14 0x00007f15c7b6204f in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#15 0x00007f15c7b0b9ca in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#16 0x00007f15c7b1413c in QCoreApplication::exec() () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#17 0x00005636e7503972 in main (argc=<optimized out>, argv=<optimized out>) at ./xembed-sni-proxy/main.cpp:68


(gdb) list SNIProxy::getImageNonComposite
...
270         xcb_image_t *image = xcb_image_get(c, m_windowId, 0, 0, geom->width, geom->height, 0xFFFFFFFF, XCB_IMAGE_FORMAT_Z_PIXMAP);
271
272         // Don't hook up cleanup yet, we may use a different QImage after all
273         QImage naiveConversion = QImage(image->data, image->width, image->height, QImage::Format_ARGB32);


(gdb) print/x image
$1 = <optimized out>


(gdb) disassemble SNIProxy::getImageNonComposite
...
   0x00005636e750922a <+106>:   mov    %rax,%r12
   0x00005636e750922d <+109>:   callq  0x5636e7502bf0 <xcb_image_get@plt>
=> 0x00005636e7509232 <+114>:   movzwl 0x2(%rax),%ecx
   0x00005636e7509236 <+118>:   movzwl (%rax),%edx


(gdb) print/x $ecx
$3 = 0xc6f61ffa
(gdb) print/x $rax
$4 = 0x0


As far as I found the callq instruction is supposed to write the
return value into the rax register.

So I assume function xcb_image_get returned a NULL pointer.
Shouldn't there be a "if (image)" before
the QImage construction?

Are some more informations needed from the core dump?

Kind regards,
Bernhard

Thanks for the feedback; changing status.

I can confirm this problem occurs in my environment.
OS: Fedora 27
$ rpm -qf /usr/bin/xembedsniproxy
plasma-workspace-5.11.3-2.fc27.x86_64

I think it occurs when accidentally pressing "AltGr" + "PrtSc" on the notebooks keyboard. Immediately whole KDE crashes.

I'm attaching similar debug as Bernhard did:
# coredumpctl gdb /usr/bin/xembedsniproxy
           PID: 2465 (xembedsniproxy)
           UID: 500 (username)
           GID: 500 (username)
        Signal: 11 (SEGV)
     Timestamp: Fri 2017-12-15 08:24:13 CET (6h ago)
  Command Line: /usr/bin/xembedsniproxy
    Executable: /usr/bin/xembedsniproxy
 Control Group: /user.slice/user-500.slice/session-1.scope
          Unit: session-1.scope
         Slice: user-500.slice
       Session: 1
     Owner UID: 500 (username)
       Boot ID: BOOT_ID
    Machine ID: MACHINE_ID
      Hostname: username.domain
       Storage: /var/lib/systemd/coredump/core.xembedsniproxy.500.7393c2684dc648f1aba76839af1e6948.2465.1513322653000000.lz4
       Message: Process 2465 (xembedsniproxy) of user 500 dumped core.
                
                Stack trace of thread 2465:
                #0  0x000055e790410157 _ZNK8SNIProxy20getImageNonCompositeEv (xembedsniproxy)
                #1  0x000055e790410424 _ZN8SNIProxy6updateEv (xembedsniproxy)
                #2  0x000055e79040d5ad _ZN19FdoSelectionManager17nativeEventFilterERK10QByteArrayPvPl (xembedsniproxy)
                #3  0x00007fbcd6ebbbe4 _ZN24QAbstractEventDispatcher17filterNativeEventERK10QByteArrayPvPl (libQt5Core.so.5)
                #4  0x00007fbcc8076fe0 _ZN14QXcbConnection14handleXcbEventEP19xcb_generic_event_t (libQt5XcbQpa.so.5)
                #5  0x00007fbcc8077c6c _ZN14QXcbConnection16processXcbEventsEv (libQt5XcbQpa.so.5)
                #6  0x00007fbcd6ee791a _ZN7QObject5eventEP6QEvent (libQt5Core.so.5)
                #7  0x00007fbcd6ebe27a _ZL8doNotifyP7QObjectP6QEvent (libQt5Core.so.5)
                #8  0x00007fbcd6ebe367 _ZN16QCoreApplication15notifyInternal2EP7QObjectP6QEvent (libQt5Core.so.5)
                #9  0x00007fbcd6ec0aeb _ZN23QCoreApplicationPrivate16sendPostedEventsEP7QObjectiP11QThreadData (libQt5Core.so.5)
                #10 0x00007fbcd6f0f553 _ZL23postEventSourceDispatchP8_GSourcePFiPvES1_ (libQt5Core.so.5)
                #11 0x00007fbcd0fc8bb7 g_main_context_dispatch (libglib-2.0.so.0)
                #12 0x00007fbcd0fc8f60 g_main_context_iterate.isra.25 (libglib-2.0.so.0)
                #13 0x00007fbcd0fc8fec g_main_context_iteration (libglib-2.0.so.0)
                #14 0x00007fbcd6f0f33f _ZN20QEventDispatcherGlib13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE (libQt5Core.so.5)
                #15 0x00007fbcd6ebd0ea _ZN10QEventLoop4execE6QFlagsINS_17ProcessEventsFlagEE (libQt5Core.so.5)
                #16 0x00007fbcd6ec5744 _ZN16QCoreApplication4execEv (libQt5Core.so.5)
                #17 0x000055e79040aa53 main (xembedsniproxy)
                #18 0x00007fbcd5ba603a __libc_start_main (libc.so.6)
                #19 0x000055e79040af3a _start (xembedsniproxy)
                
                Stack trace of thread 2474:
                #0  0x00007fbcd5c928bb __poll (libc.so.6)
                #1  0x00007fbcd945cfe7 _xcb_conn_wait (libxcb.so.1)
                #2  0x00007fbcd945edda xcb_wait_for_event (libxcb.so.1)
                #3  0x00007fbcc8075a49 _ZN15QXcbEventReader3runEv (libQt5XcbQpa.so.5)
                #4  0x00007fbcd6d12b92 _ZN14QThreadPrivate5startEPv (libQt5Core.so.5)
                #5  0x00007fbcd596d609 start_thread (libpthread.so.0)
                #6  0x00007fbcd5c9ee6f __clone (libc.so.6)
                
                Stack trace of thread 2707:
                #0  0x00007fbcd5c928bb __poll (libc.so.6)
                #1  0x00007fbcd0fc8ed9 g_main_context_iterate.isra.25 (libglib-2.0.so.0)
                #2  0x00007fbcd0fc8fec g_main_context_iteration (libglib-2.0.so.0)
                #3  0x00007fbcd6f0f33f _ZN20QEventDispatcherGlib13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE (libQt5Core.so.5)
                #4  0x00007fbcd6ebd0ea _ZN10QEventLoop4execE6QFlagsINS_17ProcessEventsFlagEE (libQt5Core.so.5)
                #5  0x00007fbcd6d0e8ba _ZN7QThread4execEv (libQt5Core.so.5)
                #6  0x00007fbcd98dc479 _ZN22QDBusConnectionManager3runEv (libQt5DBus.so.5)
                #7  0x00007fbcd6d12b92 _ZN14QThreadPrivate5startEPv (libQt5Core.so.5)
                #8  0x00007fbcd596d609 start_thread (libpthread.so.0)
                #9  0x00007fbcd5c9ee6f __clone (libc.so.6)

GNU gdb (GDB) Fedora 8.0.1-33.fc27
<LINES REMOVED>
Reading symbols from /usr/bin/xembedsniproxy...Reading symbols from /usr/lib/debug/usr/bin/xembedsniproxy-5.11.3-2.fc27.x86_64.debug...done.
done.
[New LWP 2465]
[New LWP 2474]
[New LWP 2707]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/bin/xembedsniproxy'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  SNIProxy::getImageNonComposite (this=this@entry=0x55e791fc3d30) at /usr/src/debug/plasma-workspace-5.11.3-2.fc27.x86_64/xembed-sni-proxy/sniproxy.cpp:291
291         QImage naiveConversion = QImage(image->data, image->width, image->height, QImage::Format_ARGB32);
[Current thread is 1 (Thread 0x7fbcd9d20d40 (LWP 2465))]
Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.6-24.fc27.x86_64
<LINES REMOVED>
(gdb) list SNIProxy::getImageNonComposite
273
274         return true;
275     }
276
277     QImage SNIProxy::getImageNonComposite() const
278     {
279         auto c = QX11Info::connection();
280         auto cookie = xcb_get_geometry(c, m_windowId);
281         QScopedPointer<xcb_get_geometry_reply_t, QScopedPointerPodDeleter>
282             geom(xcb_get_geometry_reply(c, cookie, Q_NULLPTR));
(gdb) disassemble SNIProxy::getImageNonComposite
Dump of assembler code for function SNIProxy::getImageNonComposite() const:
<LINES REMOVED>
   0x000055e790410142 <+98>:    xor    %edx,%edx
   0x000055e790410144 <+100>:   mov    0x18(%rbx),%esi
   0x000055e790410147 <+103>:   mov    %r13,%rdi
   0x000055e79041014a <+106>:   mov    %rax,%rbp
   0x000055e79041014d <+109>:   lea    0x30(%rsp),%r13
   0x000055e790410152 <+114>:   callq  0x55e790409cb0 <xcb_image_get@plt>
=> 0x000055e790410157 <+119>:   movzwl 0x2(%rax),%ecx
   0x000055e79041015b <+123>:   movzwl (%rax),%edx
   0x000055e79041015e <+126>:   xor    %r9d,%r9d
   0x000055e790410161 <+129>:   mov    0x28(%rax),%rsi
   0x000055e790410165 <+133>:   mov    $0x5,%r8d
<LINES REMOVED>
   0x000055e7904101a7 <+199>:   mov    $0x5,%r9d
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) print/x $ecx
$1 = 0xd5974685
(gdb) print/x $rax
$2 = 0x0
(gdb)

Created attachment 109733 [details]
Check if image returned by xcb_image_get is null

I added simple patch to mitigate the problem. Just checks if the 'image' is not null'. If it is just return QImage().

https://cgit.kde.org/plasma-workspace.git/commit/?id=e2b7c395ecdb660b7bec960f3c938fba175ca4f8

Be nice if this were backported to 5.11 branch too (for 5.11.5 release).  I can help do that... is cherry-picking acceptable?

Confirmed backport to 5.8 lts branch, skipped 5.11 as 5.11.5 is already out (and 5.11 is now closed)