Created attachment 178164 [details]
Full trace of all threads of kwin_wayland crash when logging out of Plasma

SUMMARY

I was using Plasma 6.3.0 on Wayland in a Fedora 41 KDE installation. I logged out of Plasma. kwin_wayland crashed sometimes when logging out of Plasma with a failed assertion in libinput "(elm->next != NULL && elm->prev != NULL) || !\"list->next|prev is NULL, possibly missing list_init()\"" in frames 9-10 of the trace.

Core was generated by `/usr/bin/kwin_wayland --wayland-fd 7 --socket wayland-0 --xwayland-fd 8 --xwayl'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at pthread_kill.c:44
44            return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
[Current thread is 1 (Thread 0x7fadd5ffb6c0 (LWP 1753))]

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at pthread_kill.c:44
#1  0x00007fae03c7b183 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:78
#2  0x00007fae03c21f9e in __GI_raise (sig=6) at ../sysdeps/posix/raise.c:26
#3  0x00007fae0776c1a2 in KCrash::defaultCrashHandler(int) () at /lib64/libKF6Crash.so.6
#4  0x00007fae03c22050 in <signal handler called> () at /lib64/libc.so.6
#5  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at pthread_kill.c:44
#6  0x00007fae03c7b183 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:78
#7  0x00007fae03c21f9e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#8  0x00007fae03c09942 in __GI_abort () at abort.c:79
#9  0x00007fae03c0985e in __assert_fail_base
    (fmt=0x7fae03dbecb0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7fae036be580 "(elm->next != NULL && elm->prev != NULL) || !\"list->next|prev is NULL, possibly missing list_init()\"", file=file@entry=0x7fae036bc273 "../src/util-list.c", line=line@entry=71, function=function@entry=0x7fae036c19d8 <__PRETTY_FUNCTION__.1.lto_priv.12> "list_remove") at assert.c:96
#10 0x00007fae03c1a0c7 in __assert_fail
    (assertion=assertion@entry=0x7fae036be580 "(elm->next != NULL && elm->prev != NULL) || !\"list->next|prev is NULL, possibly missing list_init()\"", file=file@entry=0x7fae036bc273 "../src/util-list.c", line=line@entry=71, function=0x7fae036c19d8 <__PRETTY_FUNCTION__.1.lto_priv.12> "list_remove") at assert.c:105
#11 0x00007fae036a3237 in list_remove (elm=<optimized out>) at ../src/util-list.c:71
#12 0x00007fae03680e3d in list_remove (elm=<optimized out>) at ../src/libinput.c:2104
#13 libinput_seat_destroy (seat=<optimized out>) at ../src/libinput.c:2095
#14 libinput_seat_unref (seat=<optimized out>) at ../src/libinput.c:2107
#15 0x00007fae03697830 in evdev_device_destroy (device=0x55da3ca40de0) at ../src/evdev.c:3120
#16 0x00007fae03680ede in libinput_device_destroy (device=<optimized out>) at ../src/libinput.c:2164
#17 libinput_device_unref (device=<optimized out>) at ../src/libinput.c:2173
--Type <RET> for more, q to quit, c to continue without paging--c
#18 0x00007fae03682a16 in libinput_event_destroy (event=0x7fada80030f0) at ../src/libinput.c:2039
#19 0x00007fae07132a03 in KWin::LibInput::Event::~Event (this=0x7fada8003c40, this=<optimized out>)
    at /usr/src/debug/kwin-6.3.0-1.fc41.x86_64/src/backends/libinput/events.cpp:82
#20 KWin::LibInput::PointerEvent::~PointerEvent (this=0x7fada8003c40, this=<optimized out>)
    at /usr/src/debug/kwin-6.3.0-1.fc41.x86_64/src/backends/libinput/events.cpp:137
#21 KWin::LibInput::PointerEvent::~PointerEvent (this=0x7fada8003c40, this=<optimized out>)
    at /usr/src/debug/kwin-6.3.0-1.fc41.x86_64/src/backends/libinput/events.cpp:137
#22 0x00007fae0712764e in std::default_delete<KWin::LibInput::Event>::operator()
    (this=<optimized out>, __ptr=<optimized out>) at /usr/include/c++/14/bits/unique_ptr.h:87
#23 std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> >::~unique_ptr
    (this=0x7fada80056a8, this=<optimized out>) at /usr/include/c++/14/bits/unique_ptr.h:399
#24 std::destroy_at<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> > >
    (__location=0x7fada80056a8) at /usr/include/c++/14/bits/stl_construct.h:88
#25 std::_Destroy<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> > >
    (__pointer=0x7fada80056a8) at /usr/include/c++/14/bits/stl_construct.h:149
#26 std::_Destroy_aux<false>::__destroy<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> >*> (__first=0x7fada80056a8, __last=<optimized out>) at /usr/include/c++/14/bits/stl_construct.h:163
#27 std::_Destroy<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> >*>
    (__first=<optimized out>, __last=<optimized out>) at /usr/include/c++/14/bits/stl_construct.h:196
#28 std::_Destroy<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> >*, std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> > > (__first=<optimized out>, __last=<optimized out>)
    at /usr/include/c++/14/bits/alloc_traits.h:993
#29 std::deque<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> >, std::allocator<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> > > >::_M_destroy_data_aux
    (this=<optimized out>, __first=Python Exception <class 'gdb.error'>: value has been optimized out
, __last=Python Exception <class 'gdb.error'>: value has been optimized out
) at /usr/include/c++/14/bits/deque.tcc:878
#30 std::deque<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> >, std::allocator<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> > > >::_M_destroy_data
    (this=0x55da3ca67390, __first=Python Exception <class 'gdb.error'>: value has been optimized out
, __last=Python Exception <class 'gdb.error'>: value has been optimized out
) at /usr/include/c++/14/bits/stl_deque.h:2091
#31 std::deque<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> >, std::allocator<std::unique_ptr<KWin::LibInput::Event, std::default_delete<KWin::LibInput::Event> > > >::~deque
    (this=0x55da3ca67390, this=<optimized out>) at /usr/include/c++/14/bits/stl_deque.h:1028
#32 KWin::LibInput::Connection::~Connection (this=0x55da3ca67360, this=<optimized out>)
    at /usr/src/debug/kwin-6.3.0-1.fc41.x86_64/src/backends/libinput/connection.cpp:121
#33 0x00007fae071276d5 in KWin::LibInput::Connection::~Connection (this=0x55da3ca67360, this=<optimized out>)
    at /usr/src/debug/kwin-6.3.0-1.fc41.x86_64/src/backends/libinput/connection.cpp:121
#34 0x00007fae0434b8ae in QObject::event (this=0x55da3ca67360, e=0x55da3cb6a660)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/kernel/qobject.cpp:1403
#35 0x00007fae0543d9b8 in QApplicationPrivate::notify_helper
    (this=<optimized out>, receiver=0x55da3ca67360, e=0x55da3cb6a660)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/widgets/kernel/qapplication.cpp:3296
#36 0x00007fae042f3590 in QCoreApplication::notifyInternal2 (receiver=0x55da3ca67360, event=0x55da3cb6a660)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/kernel/qcoreapplication.cpp:1172
#37 0x00007fae042f37ed in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/kernel/qcoreapplication.cpp:1612
#38 0x00007fae042f6f51 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x55da3c9b8fb0)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/kernel/qcoreapplication.cpp:1946
#39 0x00007fae042f71fd in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/kernel/qcoreapplication.cpp:1800
#40 0x00007fae045efb5f in postEventSourceDispatch (s=0x7fada8000f20)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/kernel/qeventdispatcher_glib.cpp:246
#41 0x00007fae02b1828c in g_main_dispatch (context=0x7fada8000c60) at ../glib/gmain.c:3357
#42 g_main_context_dispatch_unlocked (context=0x7fada8000c60) at ../glib/gmain.c:4208
#43 0x00007fae02b787b8 in g_main_context_iterate_unlocked.isra.0
    (context=context@entry=0x7fada8000c60, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at ../glib/gmain.c:4273
#44 0x00007fae02b19783 in g_main_context_iteration (context=0x7fada8000c60, may_block=1) at ../glib/gmain.c:4338
#45 0x00007fae045ef2b3 in QEventDispatcherGlib::processEvents (this=0x7fada8000b70, flags=...)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/kernel/qeventdispatcher_glib.cpp:399
#46 0x00007fae04300993 in QEventLoop::exec (this=this@entry=0x7fadd5ffa830, flags=..., flags@entry=...)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/global/qflags.h:34
#47 0x00007fae04419095 in QThread::exec (this=<optimized out>)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/global/qflags.h:74
#48 0x00007fae044b67e9 in operator() (__closure=<optimized out>)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/thread/qthread_unix.cpp:375
#49 (anonymous namespace)::terminate_on_exception<QThreadPrivate::start(void*)::<lambda()> > (t=<optimized out>)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/thread/qthread_unix.cpp:311
#50 QThreadPrivate::start (arg=0x55da3c9b68d8)
    at /usr/src/debug/qt6-qtbase-6.8.2-2.fc41.x86_64/src/corelib/thread/qthread_unix.cpp:339
#51 0x00007fae03c79168 in start_thread (arg=<optimized out>) at pthread_create.c:448
#52 0x00007fae03cfd14c in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

A crash notification from abrt was shown the next time I logged in. drkonqi crashed when trying to handle the crash. I'm attaching the full trace of all threads. The crash happened 2 of about 10 times I logged out of Plasma 6.3.0. I didn't see this problem with Plasma 6.2.90 or earlier. There might be a race condition involved. Maybe destroying KWin::LibInput::Event objects sometimes led to one of the variables in the assertion being used after being freed.

STEPS TO REPRODUCE
1. Log in to Plasma 6.3.0 on Wayland in a Fedora 41 KDE installation updated with the updates-testing repo enabled
2. Log out of Plasma from the Application Launcher menu
3. If the problem didn't happen, repeat 1-2 until it does

OBSERVED RESULT
kwin_wayland crashed sometimes when logging out of Plasma with a failed assertion in libinput

EXPECTED RESULT
No crashes should've happened.

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Fedora 41
KDE Plasma Version: 6.3.0
KDE Frameworks Version: 6.10.0
Qt Version: 6.8.2

ADDITIONAL INFORMATION