Application: plasmashell (5.27.10) Qt Version: 5.15.12 Frameworks Version: 5.115.0 Operating System: Linux 6.7.6-zen1-1-zen x86_64 Windowing System: X11 Distribution: "Arch Linux" DrKonqi: 5.27.10 [KCrashBackend] -- Information about the crash: I'm seeing intermittent crashes of plasmashell without an obvious cause. Seems to be random. I'm seeing it happen once or twice within 10 minutes. The crash can be reproduced sometimes. -- Backtrace: Application: Plasma (plasmashell), signal: Segmentation fault Content of s_kcrashErrorMessage: std::unique_ptr<char []> = {get() = <optimized out>} [KCrash Handler] #6 0x00007c61f8039930 in std::__atomic_base<int>::load (__m=std::memory_order_relaxed, this=0x7c662a1c8c1d) at /usr/include/c++/13.2.1/bits/atomic_base.h:505 #7 QAtomicOps<int>::loadRelaxed<int> (_q_value=<error reading variable: Cannot access memory at address 0x7c662a1c8c1d>) at /usr/include/qt/QtCore/qatomic_cxx11.h:239 #8 QBasicAtomicInteger<int>::loadRelaxed (this=0x7c662a1c8c1d) at /usr/include/qt/QtCore/qbasicatomic.h:107 #9 QtPrivate::RefCount::deref (this=0x7c662a1c8c1d) at /usr/include/qt/QtCore/qrefcount.h:66 #10 QVector<int>::~QVector (this=0x7c61ec01dfa0, this=<optimized out>) at /usr/include/qt/QtCore/qvector.h:73 #11 TaskManager::TaskGroupingProxyModel::Private::sourceRowsAboutToBeRemoved (this=0x6051ad8358e0, parent=<optimized out>, first=<optimized out>, last=2) at /usr/src/debug/plasma-workspace/plasma-workspace-5.27.10/libtaskmanager/taskgroupingproxymodel.cpp:148 #12 0x00007c61ffac8e27 in QtPrivate::QSlotObjectBase::call (a=0x7ffd1e8661d0, r=<optimized out>, this=0x6051ad83b0b0, this=<optimized out>, r=<optimized out>, a=<optimized out>) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398 #13 doActivate<false> (sender=0x6051ad831610, signal_index=14, argv=0x7ffd1e8661d0) at kernel/qobject.cpp:3925 #14 0x00007c61ffa4fa23 in QAbstractItemModel::rowsAboutToBeRemoved (this=this@entry=0x6051ad831610, _t1=..., _t2=<optimized out>, _t2@entry=2, _t3=<optimized out>, _t3@entry=2, _t4=...) at .moc/moc_qabstractitemmodel.cpp:599 #15 0x00007c61ffa4faaa in QAbstractItemModel::beginRemoveRows (this=0x6051ad831610, parent=..., first=2, last=2) at itemmodels/qabstractitemmodel.cpp:2820 #16 0x00007c61ffa6c91e in QSortFilterProxyModelPrivate::remove_proxy_interval (this=0x6051ad838550, emit_signal=true, orient=Qt::Vertical, proxy_parent=..., proxy_end=2, proxy_start=2, proxy_to_source=..., source_to_proxy=...) at itemmodels/qsortfilterproxymodel.cpp:804 #17 QSortFilterProxyModelPrivate::remove_source_items (this=0x6051ad838550, source_to_proxy=..., proxy_to_source=..., source_items=<optimized out>, source_parent=<optimized out>, orient=Qt::Vertical, emit_signal=true) at itemmodels/qsortfilterproxymodel.cpp:792 #18 0x00007c61ffa7a1ad in QSortFilterProxyModelPrivate::_q_sourceDataChanged (this=0x6051ad838550, source_top_left=<optimized out>, source_bottom_right=<optimized out>, roles=...) at itemmodels/qsortfilterproxymodel.cpp:1483 #19 0x00007c61ffac8fe3 in doActivate<false> (sender=0x6051ad82e740, signal_index=3, argv=0x7ffd1e8665d0) at kernel/qobject.cpp:3937 #20 0x00007c61ffa4f361 in QAbstractItemModel::dataChanged (this=<optimized out>, _t1=<optimized out>, _t2=<optimized out>, _t3=<optimized out>) at .moc/moc_qabstractitemmodel.cpp:557 #21 0x00007c61ffa70cbe in QConcatenateTablesProxyModelPrivate::_q_slotDataChanged (this=<optimized out>, roles=..., to=<optimized out>, from=<optimized out>) at itemmodels/qconcatenatetablesproxymodel.cpp:634 #22 QConcatenateTablesProxyModel::qt_static_metacall (_o=<optimized out>, _c=<optimized out>, _id=<optimized out>, _a=<optimized out>) at .moc/moc_qconcatenatetablesproxymodel.cpp:155 #23 0x00007c61ffac8fe3 in doActivate<false> (sender=0x6051ad82f390, signal_index=3, argv=0x7ffd1e8667c0) at kernel/qobject.cpp:3937 #24 0x00007c61ffa4f361 in QAbstractItemModel::dataChanged (this=<optimized out>, _t1=<optimized out>, _t2=<optimized out>, _t3=<optimized out>) at .moc/moc_qabstractitemmodel.cpp:557 #25 0x00007c61ffa722a1 in QIdentityProxyModelPrivate::_q_sourceDataChanged (this=<optimized out>, roles=..., bottomRight=<optimized out>, topLeft=...) at itemmodels/qidentityproxymodel.cpp:507 #26 QIdentityProxyModel::qt_static_metacall (_o=<optimized out>, _id=<optimized out>, _a=<optimized out>, _c=<optimized out>) at .moc/moc_qidentityproxymodel.cpp:164 #27 0x00007c61ffac8fe3 in doActivate<false> (sender=0x6051ad82f520, signal_index=3, argv=0x7ffd1e866980) at kernel/qobject.cpp:3937 #28 0x00007c61ffa4f361 in QAbstractItemModel::dataChanged (this=<optimized out>, _t1=..., _t2=..., _t3=...) at .moc/moc_qabstractitemmodel.cpp:557 #29 0x00007c61f80696ef in TaskManager::XWindowTasksModel::Private::dataChanged (this=0x6051ad82f7f0, window=<optimized out>, roles=...) at /usr/src/debug/plasma-workspace/plasma-workspace-5.27.10/libtaskmanager/xwindowtasksmodel.cpp:417 #30 0x00007c61f8072bea in TaskManager::XWindowTasksModel::Private::windowChanged (properties2=..., properties=..., window=<optimized out>, this=0x6051ad82f7f0) at /usr/src/debug/plasma-workspace/plasma-workspace-5.27.10/libtaskmanager/xwindowtasksmodel.cpp:404 #31 operator() (properties2=..., properties=..., window=85983236, __closure=<optimized out>) at /usr/src/debug/plasma-workspace/plasma-workspace-5.27.10/libtaskmanager/xwindowtasksmodel.cpp:162 #32 QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1, 2>, QtPrivate::List<long long unsigned int, QFlags<NET::Property>, QFlags<NET::Property2> >, void, TaskManager::XWindowTasksModel::Private::init()::<lambda(WId, NET::Properties, NET::Properties2)> >::call (f=<optimized out>, arg=<optimized out>) at /usr/include/qt/QtCore/qobjectdefs_impl.h:146 #33 QtPrivate::Functor<TaskManager::XWindowTasksModel::Private::init()::<lambda(WId, NET::Properties, NET::Properties2)>, 3>::call<QtPrivate::List<unsigned long long, QFlags<NET::Property>, QFlags<NET::Property2> >, void> (arg=<optimized out>, f=<optimized out>) at /usr/include/qt/QtCore/qobjectdefs_impl.h:256 #34 QtPrivate::QFunctorSlotObject<TaskManager::XWindowTasksModel::Private::init()::<lambda(WId, NET::Properties, NET::Properties2)>, 3, QtPrivate::List<long long unsigned int, QFlags<NET::Property>, QFlags<NET::Property2> >, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void **, bool *) (which=<optimized out>, this_=<optimized out>, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/qt/QtCore/qobjectdefs_impl.h:443 #35 0x00007c61ffac8e27 in QtPrivate::QSlotObjectBase::call (a=0x7ffd1e866c00, r=<optimized out>, this=0x6051ad830ec0, this=<optimized out>, r=<optimized out>, a=<optimized out>) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398 #36 doActivate<false> (sender=0x6051ad83c770, signal_index=5, argv=0x7ffd1e866c00) at kernel/qobject.cpp:3925 #37 0x00007c61f8067a88 in XWindowSystemEventBatcher::windowChanged (_t3=..., _t2=..., _t1=<optimized out>, this=<optimized out>) at /usr/src/debug/plasma-workspace/build/libtaskmanager/taskmanager_autogen/EWIEGA46WW/moc_xwindowsystemeventbatcher.cpp:176 #38 operator() (properties2=..., properties=..., window=<optimized out>, __closure=0x6051ad830ca0) at /usr/src/debug/plasma-workspace/plasma-workspace-5.27.10/libtaskmanager/xwindowsystemeventbatcher.cpp:46 #39 QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1, 2>, QtPrivate::List<long long unsigned int, QFlags<NET::Property>, QFlags<NET::Property2> >, void, XWindowSystemEventBatcher::XWindowSystemEventBatcher(QObject*)::<lambda(WId, NET::Properties, NET::Properties2)> >::call (arg=<optimized out>, f=...) at /usr/include/qt/QtCore/qobjectdefs_impl.h:146 #40 QtPrivate::Functor<XWindowSystemEventBatcher::XWindowSystemEventBatcher(QObject*)::<lambda(WId, NET::Properties, NET::Properties2)>, 3>::call<QtPrivate::List<unsigned long long, QFlags<NET::Property>, QFlags<NET::Property2> >, void> (arg=<optimized out>, f=...) at /usr/include/qt/QtCore/qobjectdefs_impl.h:256 #41 QtPrivate::QFunctorSlotObject<XWindowSystemEventBatcher::XWindowSystemEventBatcher(QObject*)::<lambda(WId, NET::Properties, NET::Properties2)>, 3, QtPrivate::List<long long unsigned int, QFlags<NET::Property>, QFlags<NET::Property2> >, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void **, bool *) (which=<optimized out>, this_=0x6051ad830c90, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/qt/QtCore/qobjectdefs_impl.h:443 #42 0x00007c61ffac8e27 in QtPrivate::QSlotObjectBase::call (a=0x7ffd1e866d50, r=<optimized out>, this=0x6051ad830c90, this=<optimized out>, r=<optimized out>, a=<optimized out>) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398 #43 doActivate<false> (sender=0x7c62019be530 <KX11Extras::self()::instance>, signal_index=12, argv=0x7ffd1e866d50) at kernel/qobject.cpp:3925 #44 0x00007c62019a1d99 in KX11Extras::windowChanged (this=<optimized out>, _t1=<optimized out>, _t1@entry=85983236, _t2=..., _t3=...) at /usr/src/debug/kwindowsystem5/build/src/KF5WindowSystem_autogen/include/moc_kx11extras.cpp:316 #45 0x00007c61f85df6da in NETEventFilter::nativeEventFilter (this=0x6051acc015a0, ev=0x7c61ec024310) at /usr/src/debug/kwindowsystem5/kwindowsystem-5.115.0/src/platforms/xcb/kwindowsystem.cpp:344 #46 0x00007c61ffa9028f in QAbstractEventDispatcher::filterNativeEvent (this=<optimized out>, eventType=..., message=message@entry=0x7c61ec024310, result=result@entry=0x7ffd1e866ee0) at kernel/qabstracteventdispatcher.cpp:495 #47 0x00007c61fab23fb1 in QXcbConnection::handleXcbEvent (this=this@entry=0x6051ac247300, event=event@entry=0x7c61ec024310) at /usr/src/debug/qt5-base/qtbase/src/plugins/platforms/xcb/qxcbconnection.cpp:583 #48 0x00007c61fab28550 in QXcbConnection::processXcbEvents (this=0x6051ac247300, flags=...) at /usr/src/debug/qt5-base/qtbase/src/plugins/platforms/xcb/qxcbconnection.cpp:1067 #49 0x00007c61fab4d538 in xcbSourceDispatch (source=<optimized out>) at /usr/src/debug/qt5-base/qtbase/src/plugins/platforms/xcb/qxcbeventdispatcher.cpp:103 #50 0x00007c61fe782f69 in g_main_dispatch (context=0x7c61f4000ec0) at ../glib/glib/gmain.c:3476 #51 0x00007c61fe7e13a7 in g_main_context_dispatch_unlocked (context=0x7c61f4000ec0) at ../glib/glib/gmain.c:4284 #52 g_main_context_iterate_unlocked.isra.0 (context=context@entry=0x7c61f4000ec0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4349 #53 0x00007c61fe781162 in g_main_context_iteration (context=0x7c61f4000ec0, may_block=1) at ../glib/glib/gmain.c:4414 #54 0x00007c61ffae2d0c in QEventDispatcherGlib::processEvents (this=0x6051ac3e86c0, flags=...) at kernel/qeventdispatcher_glib.cpp:423 #55 0x00007c61ffa92c04 in QEventLoop::exec (this=this@entry=0x7ffd1e867260, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69 #56 0x00007c61ffa940a3 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121 #57 0x00007c61fff2bef2 in QGuiApplication::exec () at kernel/qguiapplication.cpp:1870 #58 0x00007c6200755cda in QApplication::exec () at kernel/qapplication.cpp:2832 #59 0x00006051aa5e516c in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/plasma-workspace/plasma-workspace-5.27.10/shell/main.cpp:235 [Inferior 1 (process 3642) detached] Reported using DrKonqi
Edited title as I seem to have found the cause. Plasmashell crashes when trying to group a newly created window of an app with an already existing window in the task manager. The easiest way for me to reproduce is to detach a tab from firefox, which causes a crash.
After staring at the code for a bit I am of the opinion that this takeAt is unsafe https://invent.kde.org/plasma/plasma-workspace/-/blob/5de0f7f4599dbcc294ecd1f5a4bbfa122db7e518/libtaskmanager/taskgroupingproxymodel.cpp#L148 We are forward iterating, so if j is not at the end we'll break the offset of j. After that a crash may manifest at any time. Trouble is I can't quite reproduce the crash because for me j is always at the end so things don't actually get corrupted.
*** This bug has been marked as a duplicate of bug 474768 ***