Bug 500749 - plasmashell crashes on infinite recursion in QSortFilterProxyModelPrivate::recursiveChildAcceptsRow() when trying to create default panel while "undo panel deletion" notification is visible
Summary: plasmashell crashes on infinite recursion in QSortFilterProxyModelPrivate::re...
Status: RESOLVED FIXED
Alias: None
Product: plasmashell
Classification: Plasma
Component: Edit Mode (show other bugs)
Version: master
Platform: Other Linux
: NOR crash
Target Milestone: 1.0
Assignee: Plasma Bugs List
URL: https://bugreports.qt.io/browse/QTBUG...
Keywords: regression
: 501068 (view as bug list)
Depends on:
Blocks:
 
Reported: 2025-02-25 19:36 UTC by Nate Graham
Modified: 2025-03-05 17:39 UTC (History)
3 users (show)

See Also:
Latest Commit: https://invent.kde.org/plasma/plasma-workspace/-/commit/85f194c7fc04810af6761f7d5b875e12726dbd3f
Version Fixed In: Plasma 6.3.3 and Qt 6.9.1
Sentry Crash Report:

Attachments
Add an attachment

Note You need to log in before you can comment on or make changes to this bug.
Description Nate Graham 2025-02-25 19:36:09 UTC 
STEPS TO REPRODUCE
1. Right-click on desktop > Enter Edit Mode
2. Add Panel > Default Panel
3. While still in edit mode, click on newly-created panel
4. Click "Delete Panel" in panel config window
5. Do NOT dismiss the notification giving you the chance to undo deleting the panel
6. Add Panel > Default Panel again


OBSERVED RESULT
Plasma crashes 100% of the time. When it re-launches, the default panel is visible but with no system tray or applets that normally appear to the right of it. The crash backtrace indicates infinite recursion:

(gdb) bt
#0  QConcatenateTablesProxyModel::index (this=0x3c363090, row=0, column=0, parent=...)
    at /usr/src/debug/qt6-qtbase-6.8.2-3.fc41.x86_64/src/corelib/itemmodels/qconcatenatetablesproxymodel.cpp:283
#1  0x00007f3c7c5b833a in QSortFilterProxyModelPrivate::recursiveChildAcceptsRow
    (this=this@entry=0x3c3636a0, source_row=source_row@entry=0, source_parent=...)
    at /usr/src/debug/qt6-qtbase-6.8.2-3.fc41.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:437
#2  0x00007f3c7c5b839d in QSortFilterProxyModelPrivate::recursiveChildAcceptsRow
    (this=this@entry=0x3c3636a0, source_row=source_row@entry=0, source_parent=...)
    at /usr/src/debug/qt6-qtbase-6.8.2-3.fc41.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:444
#3  0x00007f3c7c5b839d in QSortFilterProxyModelPrivate::recursiveChildAcceptsRow
    (this=this@entry=0x3c3636a0, source_row=source_row@entry=0, source_parent=...)
    at /usr/src/debug/qt6-qtbase-6.8.2-3.fc41.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:444
#4  0x00007f3c7c5b839d in QSortFilterProxyModelPrivate::recursiveChildAcceptsRow
    (this=this@entry=0x3c3636a0, source_row=source_row@entry=0, source_parent=...)
    at /usr/src/debug/qt6-qtbase-6.8.2-3.fc41.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:444

[repeats forever]

Maybe it's trying to infinitely recurse into the System Tray?


EXPECTED RESULT
Default panel is created, as requested.


SOFTWARE/OS VERSIONS
Operating System: Fedora Linux 41
KDE Plasma Version: 6.3.80
KDE Frameworks Version: 6.12.0
Qt Version: 6.8.2
Kernel Version: 6.12.13-200.fc41.x86_64 (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 7840U w/ Radeon™ 780M Graphics
Memory: 16 GB of RAM (14.9 GB usable)


ADDITIONAL INFORMATION
I recall this working a month or so ago, so it's a relatively recent regression.
Comment 1 Akseli Lahtinen 2025-02-27 13:07:58 UTC 
Can also confirm. For me though, it also crashed on the first time I added default panel. It's backtrace was neverending recursion loop so I couldn't really get it out.
Comment 2 Marco Martin 2025-02-27 15:54:20 UTC 
A simpler way is:

* send a permanent notification:    notify-send foo -u critical
* without closing it, add a new notification applet, even in the desktop

The culript seems somehow NotificationFilterProxyModel::filterAcceptsRow  but i couldn't figure out what exactly is happening yet
Comment 3 Marco Martin 2025-02-28 12:49:58 UTC 
It's actually a Qt bug: https://bugreports.qt.io/browse/QTBUG-134210

It should be possible to work around downstream
Comment 4 Bug Janitor Service 2025-02-28 13:20:42 UTC 
A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/5271
Comment 5 Marco Martin 2025-03-03 09:46:08 UTC 
Git commit 354c4c5eeec73ba9a17be36d1c133fd022ee122c by Marco Martin.
Committed on 03/03/2025 at 09:46.
Pushed by mart into branch 'master'.

libnotificationmanager: Fix infinite recursion when adding a second applet

Add a QConcatenateTablesProxyModel subclass which always
has 1 column.

This is a workaround to https://bugreports.qt.io/browse/QTBUG-134210
and https://bugs.kde.org/show_bug.cgi?id=500749
if a model is added to an empty QConcatenateTablesProxyModel
it will report zero columns and non-zero rows, causing a data inconsistence
which causes an infinite recursion in NotificationFilterProxyModel::filterAcceptsRow
remove when the upstream bug is fixed

M  +20   -1    libnotificationmanager/notifications.cpp

https://invent.kde.org/plasma/plasma-workspace/-/commit/354c4c5eeec73ba9a17be36d1c133fd022ee122c
Comment 6 Nate Graham 2025-03-04 22:47:15 UTC 
Git commit 85f194c7fc04810af6761f7d5b875e12726dbd3f by Nate Graham.
Committed on 04/03/2025 at 22:24.
Pushed by ngraham into branch 'Plasma/6.3'.

libnotificationmanager: Fix infinite recursion when adding a second applet

Add a QConcatenateTablesProxyModel subclass which always
has 1 column.

This is a workaround to https://bugreports.qt.io/browse/QTBUG-134210
and https://bugs.kde.org/show_bug.cgi?id=500749
if a model is added to an empty QConcatenateTablesProxyModel
it will report zero columns and non-zero rows, causing a data inconsistence
which causes an infinite recursion in NotificationFilterProxyModel::filterAcceptsRow
remove when the upstream bug is fixed


(cherry picked from commit 354c4c5eeec73ba9a17be36d1c133fd022ee122c)

32115e18 libnotificationmanager: Fix infinite recursion when adding a second applet
25f0a36f apply suggestions

Co-authored-by: Marco Martin <notmart@gmail.com>

M  +20   -1    libnotificationmanager/notifications.cpp

https://invent.kde.org/plasma/plasma-workspace/-/commit/85f194c7fc04810af6761f7d5b875e12726dbd3f
Comment 7 Nate Graham 2025-03-05 17:39:27 UTC 
*** Bug 501068 has been marked as a duplicate of this bug. ***