Bug 499218 - plasmashell crashed in std::__atomic_base<int>::fetch_sub when clicking on the Networks icon in the System Tray
Summary: plasmashell crashed in std::__atomic_base<int>::fetch_sub when clicking on th...
Status: RESOLVED UPSTREAM
Alias: None
Product: plasmashell
Classification: Plasma
Component: generic-crash (show other bugs)
Version: 6.2.90
Platform: Fedora RPMs Linux
: NOR crash
Target Milestone: 1.0
Assignee: Plasma Bugs List
URL:
Keywords: drkonqi
: 496961 499469 (view as bug list)
Depends on:
Blocks:
 
Reported: 2025-01-28 00:47 UTC by Matt Fagnani
Modified: 2025-02-23 16:41 UTC (History)
6 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report: https://crash-reports.kde.org/organizations/kde/issues/128458/events/5df180aef38b43bb834ad970ee8b525d/


Attachments
New crash information added by DrKonqi (126.13 KB, text/plain)
2025-01-28 00:47 UTC, Matt Fagnani
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Fagnani 2025-01-28 00:47:47 UTC
Application: plasmashell (6.2.90)

ApplicationNotResponding [ANR]: false
Qt Version: 6.8.1
Frameworks Version: 6.10.0
Operating System: Linux 6.13.0-0.rc7.20250114gitc45323b7560e.56.fc42.x86_64 x86_64
Windowing System: Wayland
Distribution: "Fedora Linux 42 (KDE Plasma Prerelease)"
DrKonqi: 6.2.90 [CoredumpBackend]

-- Information about the crash:
I booted the Fedora Rawhide KDE live image Fedora-KDE-Desktop-Live-Rawhide-20250127.n.0.x86_64.iso on bare metal. Plasma 6.2.90 on Wayland started.  I clicked on the Networks icon in the System Tray. I clicked on the Bluetooth icon in the System Tray. I disabled Bluetooth from the Bluetooth applet. I clicked on the Networks icon in the System Tray. The Networks applet appeared and froze midway through a sliding to the left animation. plasmashell disappeared and reappeared automatically. plasmashell crashed in std::__atomic_base<int>::fetch_sub with a segmentation fault. The trace was different from the crashes I reported at https://bugs.kde.org/show_bug.cgi?id=499081 The crash didn't happen when I clicked on the Networks icon a couple more times.

The reporter is unsure if this crash is reproducible.

-- Backtrace (Reduced):
#5  std::__atomic_base<int>::fetch_sub (this=<optimized out>, __i=<optimized out>, __m=<optimized out>, this=<optimized out>, __i=<optimized out>, __m=<optimized out>) at /usr/include/c++/15/bits/atomic_base.h:642
#6  QAtomicOps<int>::deref<int> (_q_value=..., _q_value=...) at /usr/include/qt6/QtCore/qatomic_cxx11.h:266
[...]
#10 QArrayDataPointer<QSharedPointer<NetworkManager::Device> >::~QArrayDataPointer (this=<optimized out>, this=<optimized out>) at /usr/include/qt6/QtCore/qarraydatapointer.h:108
#11 0x00007fae28068dd7 in QList<QSharedPointer<NetworkManager::Device> >::~QList (this=<optimized out>, this=<optimized out>) at /usr/include/qt6/QtCore/qlist.h:72
#12 Handler::requestScanInternal (frame_ptr=0x55791ef53390) at /usr/src/debug/plasma-nm-6.2.90-2.fc42.x86_64/libs/handler.cpp:654


Reported using DrKonqi
Comment 1 Matt Fagnani 2025-01-28 00:47:48 UTC
Created attachment 177739 [details]
New crash information added by DrKonqi

DrKonqi auto-attaching complete backtrace.
Comment 2 Marco Martin 2025-01-28 08:30:01 UTC
#5  std::__atomic_base<int>::fetch_sub (this=<optimized out>, __i=<optimized out>, __m=<optimized out>, this=<optimized out>, __i=<optimized out>, __m=<optimized out>) at /usr/include/c++/15/bits/atomic_base.h:642
#6  QAtomicOps<int>::deref<int> (_q_value=..., _q_value=...) at /usr/include/qt6/QtCore/qatomic_cxx11.h:266
#7  QBasicAtomicInteger<int>::deref (this=<optimized out>, this=<optimized out>) at /usr/include/qt6/QtCore/qbasicatomic.h:48
#8  QArrayData::deref (this=<optimized out>, this=<optimized out>) at /usr/include/qt6/QtCore/qarraydata.h:66
#9  QArrayDataPointer<QSharedPointer<NetworkManager::Device> >::deref (this=0x7fffc87365e0) at /usr/include/qt6/QtCore/qarraydatapointer.h:439
#10 QArrayDataPointer<QSharedPointer<NetworkManager::Device> >::~QArrayDataPointer (this=<optimized out>, this=<optimized out>) at /usr/include/qt6/QtCore/qarraydatapointer.h:108
#11 0x00007fae28068dd7 in QList<QSharedPointer<NetworkManager::Device> >::~QList (this=<optimized out>, this=<optimized out>) at /usr/include/qt6/QtCore/qlist.h:72
#12 Handler::requestScanInternal (frame_ptr=0x55791ef53390) at /usr/src/debug/plasma-nm-6.2.90-2.fc42.x86_64/libs/handler.cpp:654
#13 0x00007fae2806e291 in std::__n4861::coroutine_handle<void>::resume (this=<optimized out>) at /usr/include/c++/15/coroutine:142
#14 QCoro::detail::QCoroDBusPendingReply<QDBusObjectPath>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}::operator()<QDBusPendingCallWatcher>(QDBusPendingCallWatcher*) (__closure=<optimized out>, watcher=0x55791cbd08c0) at /usr/include/qcoro6/qcoro/qcorodbuspendingreply.h:43
#15 QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QDBusPendingCallWatcher*>, void, QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}>::call(QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}&, void**)::{lambda()#1}::operator()() const (__closure=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:141
#16 QtPrivate::FunctorCallBase::call_internal<void, QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QDBusPendingCallWatcher*>, void, QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}>::call(QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}&, void**)::{lambda()#1}>(void**, QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QDBusPendingCallWatcher*>, void, QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}>::call(QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}&, void**)::{lambda()#1}&&) (args=<optimized out>, fn=...) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:65
#17 QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QDBusPendingCallWatcher*>, void, QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}>::call(QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}&, void**) (f=..., arg=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:140
#18 QtPrivate::FunctorCallable<QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}, QDBusPendingCallWatcher*>::call<QtPrivate::List<QDBusPendingCallWatcher*>, void>(QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}&, void*, void**) (f=..., arg=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:362
#19 QtPrivate::QCallableObject<QCoro::detail::QCoroDBusPendingReply<>::WaitForFinishedOperation::await_suspend(std::__n4861::coroutine_handle<void>)::{lambda(auto:1*)#1}, QtPrivate::List<QDBusPendingCallWatcher*>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (which=<optimized out>, this_=<optimized out>, r=<optimized out>, a=<optimized out>, ret=<optimized out>) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:572
#20 0x00007faed2a602fa in QtPrivate::QSlotObjectBase::call (this=0x55791dd0bc90, r=0x55791cbd08c0, a=0x7fffc8736790) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qobjectdefs_impl.h:486
#21 doActivate<false> (sender=0x55791cbd08c0, signal_index=3, argv=argv@entry=0x7fffc8736790) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qobject.cpp:4124
#22 0x00007faed2a571c9 in QMetaObject::activate (sender=<optimized out>, m=m@entry=0x7faed3070f00, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7fffc8736790) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qobject.cpp:4184
#23 0x00007faed3021cb1 in QDBusPendingCallWatcher::finished (this=<optimized out>, _t1=<optimized out>) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/redhat-linux-build/src/dbus/DBus_autogen/include/moc_qdbuspendingcall.cpp:163
#24 0x00007faed2a5129c in QObject::event (this=<optimized out>, e=<optimized out>) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qobject.cpp:1419
#25 0x00007faed4d32eca in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /lib64/libQt6Widgets.so.6
#26 0x00007faed29f5280 in QCoreApplication::notifyInternal2 (receiver=0x55791cbd08c0, event=0x7faeb808e5f0) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qcoreapplication.cpp:1168
#27 0x00007faed29f54dd in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qcoreapplication.cpp:1612
#28 0x00007faed29f90d2 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, event_type@entry=32686, data=0x55791b182330) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qcoreapplication.cpp:1968
#29 0x00007faed29fa500 in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=32686) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qcoreapplication.cpp:1800
#30 0x00007faed2cf62ff in postEventSourceDispatch (s=0x55791b187690) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qeventdispatcher_glib.cpp:246
#31 0x00007faed161df16 in g_main_dispatch (context=0x7faeb8000f30) at ../glib/gmain.c:3361
#32 g_main_context_dispatch_unlocked (context=0x7faeb8000f30) at ../glib/gmain.c:4212
#33 0x00007faed1627068 in g_main_context_iterate_unlocked (context=context@entry=0x7faeb8000f30, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4277
#34 0x00007faed1627217 in g_main_context_iteration (context=0x7faeb8000f30, may_block=1) at ../glib/gmain.c:4342
#35 0x00007faed2cf5b43 in QEventDispatcherGlib::processEvents (this=0x55791b188470, flags=...) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qeventdispatcher_glib.cpp:399
#36 0x00007faed2a038eb in QEventLoop::exec (this=this@entry=0x7fffc8736d00, flags=..., flags@entry=...) at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/global/qflags.h:34
#37 0x00007faed29ff555 in QCoreApplication::exec () at /usr/src/debug/qt6-qtbase-6.8.1-11.fc42.x86_64/src/corelib/kernel/qcoreapplication.cpp:1513
#38 0x0000557911b22ca6 in main ()
Comment 3 Nate Graham 2025-01-28 16:26:03 UTC
Could this and Bug 499081 be caused by compiler issues? IIRC Fedora was having issues with GCC 15; see Bug 499100.
Comment 4 Nate Graham 2025-01-31 16:23:32 UTC
Apparently it's a GCC 15 bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116506
Comment 5 Nicolas Fella 2025-02-03 19:39:36 UTC
*** Bug 499469 has been marked as a duplicate of this bug. ***
Comment 6 Nicolas Fella 2025-02-03 19:45:05 UTC
(In reply to Nate Graham from comment #4)
> Apparently it's a GCC 15 bug:
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116506

It's plausible, looking at https://crash-reports.kde.org/organizations/kde/issues/122628 all reports come from Fedora Rawhide with that GCC version

We do have some slightly different but still very similar crashes involving other distros though: 

https://crash-reports.kde.org/organizations/kde/issues/122339

https://crash-reports.kde.org/organizations/kde/issues/100399

https://crash-reports.kde.org/organizations/kde/issues/108886

so I wouldn't tell for sure.
Comment 7 Nicolas Fella 2025-02-03 19:45:29 UTC
https://invent.kde.org/plasma/plasma-nm/-/merge_requests/409 sounds like it should fix this
Comment 8 Sam James 2025-02-15 16:41:18 UTC
*** Bug 496961 has been marked as a duplicate of this bug. ***
Comment 9 Nicolas Fella 2025-02-23 16:41:38 UTC
Fedora applied a workaround for the GCC bug, that should fix it

https://src.fedoraproject.org/rpms/plasma-nm/c/91545a88f47b496a14d6f1fdee37b2564f6a0a37?branch=rawhide