Bug 509192 - plasmashell crashes due to QQuickStackElement::initialize null dereference
Summary: plasmashell crashes due to QQuickStackElement::initialize null dereference
Status: ASSIGNED
Alias: None
Product: plasmashell
Classification: Plasma
Component: generic-crash (other bugs)
Version First Reported In: 6.4.4
Platform: Arch Linux Linux
: VHI crash
Target Milestone: 1.0
Assignee: Plasma Bugs List
URL: https://bugreports.qt.io/browse/QTBUG...
Keywords:
: 509154 509175 509193 509194 509340 509433 509436 509443 509472 509507 509536 509565 509575 509576 509578 509585 509592 509619 509631 509647 (view as bug list)
Depends on:
Blocks:
 
Reported: 2025-09-06 13:36 UTC by mydarkstar
Modified: 2025-09-18 20:39 UTC (History)
30 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report: https://crash-reports.kde.org/organizations/kde/issues/240550/events/6506c328b4c246edb6a47b4d16960c1f/


Attachments
kcrash report (236.06 KB, text/vnd.kde.kcrash-report)
2025-09-06 13:36 UTC, mydarkstar
Details
stack trace from gdb running plasmashell (12.87 KB, text/plain)
2025-09-13 07:12 UTC, Biswapriyo Nath
Details

Note You need to log in before you can comment on or make changes to this bug.
Description mydarkstar 2025-09-06 13:36:19 UTC
Created attachment 184767 [details]
kcrash report

#SUMMARY
When using the Clementine Flatpak, there are certain edge cases where plasmashell crashes in a loop.

# JOURNALCTL LOGS
plasmashell[2004]: qrc:/qt/qml/plasma/applet/org/kde/plasma/mediacontroller/main.qml:70:28: QML CompactRepresentation (parent or ancestor of Image): Cannot open: file:///tmp/clementine-art-GMfmnV.jpg
plasmashell[2004]: KCrash: Application 'plasmashell' crashing... crashRecursionCounter = 2
systemd-coredump[204219]: Process 2004 (plasmashell) of user 1000 terminated abnormally with signal 11/SEGV, processing...

# STEPS TO REPRODUCE
I am currently unsure how to reproduce the issue on other machines.
Multiple mp3 files were dragged into Clementine and then I tried to play them.
The Clementine Flatpak only has read-only access to the media directory.

# SOFTWARE/OS VERSIONS
Operating System: Arch Linux 
KDE Plasma Version: 6.4.4
KDE Frameworks Version: 6.17.0
Qt Version: 6.9.2
Kernel Version: 6.12.44-1-lts (64-bit)
Graphics Platform: Wayland
Comment 1 mydarkstar 2025-09-06 13:37:02 UTC
Thread 1 (Thread 0x7d56e433ea40 (LWP 2004)):
[KCrash Handler]
#5  0x00007d56e33393f8 in QJSEngine::handle (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsapi/qjsengine.h:320
#6  QQmlEnginePrivate::getV4Engine (e=<optimized out>, e=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlengine_p.h:334
#7  QQuickStackElement::initialize (this=this@entry=0x6283e859d020, requiredProperties=requiredProperties@entry=0x0) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quicktemplates/qquickstackelement.cpp:210
#8  0x00007d56e3339efb in QQuickStackElement::load (this=0x6283e859d020, parent=0x6283e87b14b0) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quicktemplates/qquickstackelement.cpp:180
#9  0x00007d56e334412f in QQuickStackView::replace (this=0x6283e87b14b0, args=0x7ffcd7975b30) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quicktemplates/qquickstackview.cpp:910
#10 0x00007d56e3345dac in QQuickStackView::qt_static_metacall (_o=<optimized out>, _c=<optimized out>, _id=<optimized out>, _a=<optimized out>) at /usr/src/debug/qt6-declarative/build/src/quicktemplates/QuickTemplates2_autogen/include/moc_qquickstackview_p.cpp:465
#11 0x00007d56e33465d7 in QQuickStackView::qt_metacall (this=0x6283e87b14b0, _c=<optimized out>, _id=18, _a=0x7ffcd7975b50) at /usr/src/debug/qt6-declarative/build/src/quicktemplates/QuickTemplates2_autogen/include/moc_qquickstackview_p.cpp:725
#12 0x00007d56eb7542c3 in QQmlObjectOrGadget::metacall (this=<optimized out>, type=<optimized out>, index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlobjectorgadget.cpp:14
#13 0x00007d56eb611945 in operator() (__closure=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:3070
#14 operator()<QV4::QObjectMethod::callInternal(const QV4::Value*, const QV4::Value*, int) const::<lambda()> > (__closure=<synthetic pointer>, call=...) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:3053
#15 QV4::QObjectMethod::callInternal (this=<optimized out>, thisObject=<optimized out>, argv=0x7d56b33be560, argc=3) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:3064
#16 0x00007d56eb66ba6e in QV4::Moth::VME::interpret (frame=0x6283e87b14b0, frame@entry=0x7ffcd7976080, engine=0x6283e29fa140, code=0x7d56b33be548 "\200B\025\350U}") at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4vme_moth.cpp:798
#17 0x00007d56eb66f584 in QV4::Moth::VME::exec (frame=<optimized out>, engine=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4vme_moth.cpp:487
#18 0x00007d56eb5c4140 in QV4::Moth::VME::exec (frame=0x7ffcd7976080, engine=0x6283e29fa140) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4engine_p.h:830
#19 qfoDoCall (fo=<optimized out>, thisObject=<optimized out>, argv=<optimized out>, argc=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4functionobject.cpp:527
#20 0x00007d56eb60515c in QV4::QObjectSlotDispatcher::impl (which=<optimized out>, this_=<optimized out>, receiver=<optimized out>, metaArgs=<optimized out>, ret=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4jscall_p.h:81
#21 0x00007d56ea1d466f in QtPrivate::QSlotObjectBase::call (this=<optimized out>, r=<optimized out>, a=<optimized out>, this=<optimized out>, r=<optimized out>, a=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#22 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4157
#23 0x00007d56ebb98239 in QMetaObject::activate<void, QQuickImageBase::Status> (sender=0x6283e7676580, mo=<optimized out>, local_signal_index=2, ret=0x0) at /usr/include/qt6/QtCore/qobjectdefs.h:306
#24 QQuickImageBase::statusChanged (this=0x6283e7676580, _t1=<optimized out>) at /usr/src/debug/qt6-declarative/build/src/quick/Quick_autogen/include/moc_qquickimagebase_p.cpp:325
#25 QQuickImageBase::requestFinished (this=0x6283e7676580) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickimagebase.cpp:384
#26 0x00007d56ebb93c47 in QQuickImageBase::qt_metacall (this=this@entry=0x6283e7676580, _c=_c@entry=QMetaObject::InvokeMetaMethod, _id=13, _a=_a@entry=0x7ffcd7976558) at /usr/src/debug/qt6-declarative/build/src/quick/Quick_autogen/include/moc_qquickimagebase_p.cpp:293
#27 0x00007d56ebb96c3e in QQuickImage::qt_metacall (this=0x6283e7676580, _c=QMetaObject::InvokeMetaMethod, _id=<optimized out>, _a=0x7ffcd7976558) at /usr/src/debug/qt6-declarative/build/src/quick/Quick_autogen/include/moc_qquickimage_p.cpp:249
#28 0x00007d56ea1d4aab in doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4183
#29 0x00007d56ebdc349f in QQuickPixmapReply::finished (this=0x6283e9c0f6e0) at /usr/src/debug/qt6-declarative/build/src/quick/Quick_autogen/include/qquickpixmapcache.moc:123
#30 QQuickPixmapReply::event (this=0x6283e9c0f6e0, event=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/util/qquickpixmapcache.cpp:1430
#31 QQuickPixmapReply::event (this=0x6283e9c0f6e0, event=<optimized out>) at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/util/qquickpixmapcache.cpp:1408
#32 0x00007d56ec301dd0 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x6283e9c0f6e0, e=0x7d56dc1eadb0) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:3300
#33 0x00007d56ea168678 in QCoreApplication::notifyInternal2 (receiver=0x6283e9c0f6e0, event=event@entry=0x7d56dc1eadb0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1106
#34 0x00007d56ea168a5b in QCoreApplication::sendEvent (receiver=<optimized out>, event=0x7d56dc1eadb0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1546
#35 QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x6283e1ddcec0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1891
#36 0x00007d56ea4437f8 in QCoreApplication::sendPostedEvents (receiver=0x0, event_type=0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1744
#37 postEventSourceDispatch (s=0x6283e1de5c40) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:246
#38 0x00007d56e8c68880 in g_main_dispatch (context=0x7d56dc000f70) at ../glib/glib/gmain.c:3398
#39 0x00007d56e8c69cd7 in g_main_context_dispatch_unlocked (context=0x7d56dc000f70) at ../glib/glib/gmain.c:4249
#40 g_main_context_iterate_unlocked (context=context@entry=0x7d56dc000f70, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4314
#41 0x00007d56e8c69ee5 in g_main_context_iteration (context=0x7d56dc000f70, may_block=1) at ../glib/glib/gmain.c:4379
#42 0x00007d56ea43ffe2 in QEventDispatcherGlib::processEvents (this=0x6283e1de6920, flags=...) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:399
#43 0x00007d56ea174ca6 in QEventLoop::processEvents (this=0x7ffcd7976a20, flags=...) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:104
#44 QEventLoop::exec (this=0x7ffcd7976a20, flags=...) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:186
#45 0x00007d56ea16cd21 in QCoreApplication::exec () at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1449
#46 0x00007d56ec2fc5ea in QApplication::exec () at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:2567
#47 0x00006283dfff93f1 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/plasma-workspace/plasma-workspace-6.4.4/shell/main.cpp:188
Comment 2 mydarkstar 2025-09-08 02:37:48 UTC
I did some further analysis on the Qt crash. This looks very much like a null dereference.

(gdb) f 7
#7  QQuickStackElement::initialize (this=this@entry=0x6283e859d020, requiredProperties=requiredProperties@entry=0x0)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/quicktemplates/qquickstackelement.cpp:210
210             QV4::ExecutionEngine *v4 = QQmlEnginePrivate::getV4Engine(engine);

(gdb) l -
195     void QQuickStackElement::initialize(RequiredProperties *requiredProperties)
196     {
197         if (!item || init)
198             return;
199
200         QQuickItemPrivate *p = QQuickItemPrivate::get(item);
201         if (!(widthValid = p->widthValid()))
202             item->setWidth(view->width());
203         if (!(heightValid = p->heightValid()))
204             item->setHeight(view->height());
(gdb) l +
205         item->setParentItem(view);
206
207         if (!properties.isUndefined()) {
208             QQmlEngine *engine = qmlEngine(view);
209             Q_ASSERT(engine);
210             QV4::ExecutionEngine *v4 = QQmlEnginePrivate::getV4Engine(engine);
211             Q_ASSERT(v4);
212             QV4::Scope scope(v4);
213             QV4::ScopedValue ipv(scope, properties.value());
214             QV4::Scoped<QV4::QmlContext> qmlContext(scope, qmlCallingContext.value());
(gdb) l +
215             QV4::ScopedValue qmlObject(scope, QV4::QObjectWrapper::wrap(v4, item));
216             QQmlComponentPrivate::setInitialProperties(
217                 v4, qmlContext, qmlObject, ipv, requiredProperties, item,
218                 component ? QQmlComponentPrivate::get(component)->state.creator() : nullptr);
219             properties.clear();
220         }
221
222         if (requiredProperties && !requiredProperties->empty()) {
223             QString error;
224             for (const auto &property: *requiredProperties) {

(gdb) p view
$47 = (QQuickStackView *) 0x6283e87b14b0
(gdb) p engine
$46 = (QQmlEngine *) 0x0

(gdb) disassemble/s $pc-64, $pc+64
Dump of assembler code from 0x7d56e33393b8 to 0x7d56e3339438:
/usr/src/debug/qt6-declarative/qtdeclarative/src/quicktemplates/qquickstackelement.cpp:
203         if (!(heightValid = p->heightValid()))
   0x00007d56e33393b8 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+104>:  imul   $0x24748b49,(%rcx),%eax

204             item->setHeight(view->height());
205         item->setParentItem(view);
   0x00007d56e33393be <_ZN18QQuickStackElement10initializeEP18RequiredProperties+110>:  js     0x7d56e3339409 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+185>
   0x00007d56e33393c0 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+112>:  mov    0x40(%rsp),%edi
   0x00007d56e33393c4 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+116>:  call   *0x132bbe(%rip)        # 0x7d56e346bf88

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4persistent_p.h:
113         bool isUndefined() const { return !val || val->isUndefined(); }
   0x00007d56e33393ca <_ZN18QQuickStackElement10initializeEP18RequiredProperties+122>:  mov    0x98(%r12),%rax
   0x00007d56e33393d2 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+130>:  test   %rax,%rax
   0x00007d56e33393d5 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+133>:  je     0x7d56e3339507 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+439>

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/common/qv4staticvalue_p.h:
287         inline bool isUndefined() const { return _val == 0; }
   0x00007d56e33393db <_ZN18QQuickStackElement10initializeEP18RequiredProperties+139>:  cmpq   $0x0,(%rax)
   0x00007d56e33393df <_ZN18QQuickStackElement10initializeEP18RequiredProperties+143>:  je     0x7d56e3339507 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+439>

/usr/src/debug/qt6-declarative/qtdeclarative/src/quicktemplates/qquickstackelement.cpp:
208             QQmlEngine *engine = qmlEngine(view);
   0x00007d56e33393e5 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+149>:  mov    0x78(%r12),%rdi
   0x00007d56e33393ea <_ZN18QQuickStackElement10initializeEP18RequiredProperties+154>:  call   *0x132900(%rip)        # 0x7d56e346bcf0

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsapi/qjsengine.h:
320         QV4::ExecutionEngine *handle() const { return m_v4Engine; }
   0x00007d56e33393f0 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+160>:  mov    0x98(%r12),%rdx
=> 0x00007d56e33393f8 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+168>:  mov    0x10(%rax),%r13

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4scopedvalue_p.h:
66          explicit Scope(ExecutionEngine *e)
   0x00007d56e33393fc <_ZN18QQuickStackElement10initializeEP18RequiredProperties+172>:  xor    %eax,%eax

67              : engine(e)
68              , mark(engine->jsStackTop)
   0x00007d56e33393fe <_ZN18QQuickStackElement10initializeEP18RequiredProperties+174>:  mov    0x8(%r13),%r15

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4persistent_p.h:
90              return (val ? val->asReturnedValue() : Encode::undefined());
   0x00007d56e3339402 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+178>:  test   %rdx,%rdx
   0x00007d56e3339405 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+181>:  je     0x7d56e333940a <_ZN18QQuickStackElement10initializeEP18RequiredProperties+186>

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/common/qv4staticvalue_p.h:
452         constexpr ReturnedValue asReturnedValue() const { return _val; }
   0x00007d56e3339407 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+183>:  mov    (%rdx),%rax

130         QV4_NEARLY_ALWAYS_INLINE constexpr void setRawValue(quint64 raw) { _val = raw; }
   0x00007d56e333940a <_ZN18QQuickStackElement10initializeEP18RequiredProperties+186>:  mov    %rax,(%r15)

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4persistent_p.h:
90              return (val ? val->asReturnedValue() : Encode::undefined());
   0x00007d56e333940d <_ZN18QQuickStackElement10initializeEP18RequiredProperties+189>:  mov    0xa0(%r12),%rax

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4engine_p.h:
167             jsStackTop = ptr + nValues;
   0x00007d56e3339415 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+197>:  lea    0x10(%r15),%rdx

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4persistent_p.h:
90              return (val ? val->asReturnedValue() : Encode::undefined());
   0x00007d56e3339419 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+201>:  test   %rax,%rax
   0x00007d56e333941c <_ZN18QQuickStackElement10initializeEP18RequiredProperties+204>:  je     0x7d56e3339c0f <_ZN18QQuickStackElement10initializeEP18RequiredProperties+2239>

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/common/qv4staticvalue_p.h:
452         constexpr ReturnedValue asReturnedValue() const { return _val; }
   0x00007d56e3339422 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+210>:  mov    (%rax),%rax

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4engine_p.h:
167             jsStackTop = ptr + nValues;
   0x00007d56e3339425 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+213>:  mov    %rdx,0x8(%r13)

/usr/src/debug/qt6-declarative/qtdeclarative/src/qml/common/qv4staticvalue_p.h:
315         inline bool isManagedOrUndefined() const { return (_val & ManagedMask) == 0; }
   0x00007d56e3339429 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+217>:  movabs $0x7ff1000000000000,%rdx
   0x00007d56e3339433 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+227>:  test   %rdx,%rax
   0x00007d56e3339436 <_ZN18QQuickStackElement10initializeEP18RequiredProperties+230>:  jne    0x7d56e333945d <_ZN18QQuickStackElement10initializeEP18RequiredProperties+269>
End of assembler dump.

We are doing MOV 0x10(%rax), %r13 with %rax = 0x0.

I'm not sure why qmlEngine(view) returned null, as I'm working from a coredump.
Although I was previously able to reproduce this issue on the same device, currently I am unable to.

I would appreciate if someone could help me out re-filing this issue and potentially submitting it upstream.
I do not have any accounts for that, nor do I know whether it is relevant.
Comment 3 mydarkstar 2025-09-08 15:43:46 UTC
I just had this same crash again, but unrelated to Media Player. Renaming and refiling as generic-crash.

Sep 08 17:29:31 plasmashell[2017]: qrc:/qt/qml/org/kde/kirigami/dialogs/PromptDialog.qml:138: TypeError: Cannot read property 'Success' of undefined
Sep 08 17:29:31 plasmashell[2017]: qrc:/qt/qml/org/kde/kirigami/dialogs/PromptDialog.qml:100: TypeError: Cannot read property 'None' of undefined
Sep 08 17:29:31 plasmashell[2017]: KCrash: Application 'plasmashell' crashing... crashRecursionCounter = 2
Sep 08 17:29:31 systemd-coredump[21798]: Process 2017 (plasmashell) of user 1000 terminated abnormally with signal 11/SEGV, processing...
Comment 4 mydarkstar 2025-09-08 15:54:21 UTC
*** Bug 509154 has been marked as a duplicate of this bug. ***
Comment 5 mydarkstar 2025-09-08 15:54:44 UTC
*** Bug 509175 has been marked as a duplicate of this bug. ***
Comment 6 mydarkstar 2025-09-08 15:55:11 UTC
*** Bug 509194 has been marked as a duplicate of this bug. ***
Comment 7 mydarkstar 2025-09-08 16:02:08 UTC
I found a couple more crashes like this.
All have in common that Qt Version 6.9.2 is used.
All crashes occur due to a QQuickImage usage.

Bug 509154 contains a Sentry crash report.
Comment 8 mydarkstar 2025-09-08 16:11:54 UTC
*** Bug 509193 has been marked as a duplicate of this bug. ***
Comment 9 mydarkstar 2025-09-08 16:50:30 UTC
I just opened an upstream Qt bug for this issue here:
https://bugreports.qt.io/browse/QTBUG-140018

If anybody can provide further information, for example:
* How to reproduce the bug?
* Why does `call qmlEngine(view)` return null in frame 7?

That would be very much appreciated!
Comment 10 SplatMattPingPong 2025-09-09 05:35:03 UTC

(In reply to mydarkstar from comment #7)
> I found a couple more crashes like this.
> All have in common that Qt Version 6.9.2 is used.
> All crashes occur due to a QQuickImage usage.
> 
> Bug 509154 contains a Sentry crash report.

I was the one to originally file the bug. 

I updated the laptop using apt full-upgrade, then ran flatpak update and rebooted afterwards. 

I log in and immediately the crash starts happening without launching anything. Drkonqi launches about 10 crash reports withing a minute of launch and then plasmashell starts going in a crash loop. 

I have the Nord VPN client on auto start but even disabling it did not seem to have an effect. I tried switching to X11 and the same seems to be happening using that as well. I do not have Clementine installed as someone else has mentioned.
Comment 11 mateMat 2025-09-09 11:46:48 UTC
Hi,
I was able to make it go away by resetting the Global theme to the default.
You want to try, it worked for me after few months of struggle.
Best
Comment 12 SplatMattPingPong 2025-09-09 13:14:50 UTC
(In reply to mateMat from comment #11)
> Hi,
> I was able to make it go away by resetting the Global theme to the default.
> You want to try, it worked for me after few months of struggle.
> Best

Just tried it, didn't seem to have any impact. Applied the defaults to layout and appearance. Thanks for the suggestion though.
Comment 13 Michał 2025-09-09 17:01:56 UTC
I'm getting this too, not sure of the direct cause. I certainly don't use Clementine. One thing's certain: once it starts happening, plasmashell keeps crashing in a loop, no matter how many times you restart it.

One time it was happening all the time right after login, but after rebooting it was okay for 6 days of uptime, then just now randomly started happening again, and it started after I clicked on the notification applet and scrolled down my notification list. I don't see anything uniquely common printed in journal before crashing either (and nothing about any images logged at all).
Comment 14 mydarkstar 2025-09-09 17:25:17 UTC
I want to note that this is a regression when updating to Qt 6.9.2, released at the end of August (~2 weeks ago).

I originally assumed that this crash had to do with the Media Player widget, but have since revised that.
The original issue summary can be disregarded.

We will have to wait for the issue to be resolved in Qt.
Comment 15 David Edmundson 2025-09-11 08:15:34 UTC
*** Bug 509340 has been marked as a duplicate of this bug. ***
Comment 16 David Edmundson 2025-09-11 08:15:53 UTC
See also https://crash-reports.kde.org/organizations/kde/issues/240550
Comment 17 Biswapriyo Nath 2025-09-13 07:11:17 UTC
I can reproduce the issue in ArchLinux with plasmashell 6.4.5. Here are the steps to reproduce the issue - open dolphin > click on any audio file > opens vlc > plasmashell crash. The issue does not happen if vlc is already running. I have attached a plasmashell-gdb-output.txt file with the stack trace. Please let me know if I need to provide more info.
Comment 18 Biswapriyo Nath 2025-09-13 07:12:19 UTC
Created attachment 184930 [details]
stack trace from gdb running plasmashell
Comment 19 Sebastian Goth 2025-09-14 14:24:28 UTC
Just started to see this today after a reboot for KF 6.18.0 updates on Arch.
Qt 6.9.2 and plasma 6.4.5 was installed yesterday and working fine until now.

No new applications started, no new widgets or styles used. No clementine, no vlc or anything. All plain default breeze.
Comment 20 TraceyC 2025-09-16 00:14:38 UTC
*** Bug 509507 has been marked as a duplicate of this bug. ***
Comment 21 TraceyC 2025-09-16 00:17:15 UTC
*** Bug 509443 has been marked as a duplicate of this bug. ***
Comment 22 TraceyC 2025-09-16 00:19:03 UTC
*** Bug 509436 has been marked as a duplicate of this bug. ***
Comment 23 Fushan Wen 2025-09-16 14:55:07 UTC
Does setting `QV4_GC_TIMELIMIT=0` help?
Comment 24 Bug Janitor Service 2025-09-16 15:29:28 UTC
A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/5817
Comment 25 TraceyC 2025-09-16 17:18:12 UTC
*** Bug 509472 has been marked as a duplicate of this bug. ***
Comment 26 Oliver Beard 2025-09-16 18:16:48 UTC
(In reply to Biswapriyo Nath from comment #17)
> I can reproduce the issue in ArchLinux with plasmashell 6.4.5.

I originally asked this user to report their findings with the VLC crash relation here.

I've now asked this user externally to see if the crash stops happening with the mediacontrollerr tray applet disabled, and they have confirmed this is the case. It's now relatively certain that the mediacontroller applet is responsible.
Comment 27 Oliver Beard 2025-09-16 18:46:19 UTC
I am able to reproduce this with the Clementine flatpak, by playing a song with album art, and restarting plasmashell — it enters a crash loop with the same backtrace.
Comment 28 TraceyC 2025-09-16 18:52:46 UTC
*** Bug 509433 has been marked as a duplicate of this bug. ***
Comment 29 TraceyC 2025-09-16 18:54:01 UTC
*** Bug 509536 has been marked as a duplicate of this bug. ***
Comment 30 TraceyC 2025-09-16 21:28:27 UTC
*** Bug 509565 has been marked as a duplicate of this bug. ***
Comment 31 furioness 2025-09-17 11:22:16 UTC
Maybe it's a bit too early to say confidently, but disabling the Media Player System Tray plugin seems to fix the problem.
My last crash (before disabling) was when I played some music in Firefox.
I'll write if I get another crash with the same stacktrace.

To disable it: click Status and Notification arrow, then "Configure system tray" in the upper right corner, then tab "Entry", and there will be "Media Player".
Comment 32 Nate Graham 2025-09-17 14:53:30 UTC
*** Bug 509592 has been marked as a duplicate of this bug. ***
Comment 33 Nate Graham 2025-09-17 15:09:50 UTC
*** Bug 509585 has been marked as a duplicate of this bug. ***
Comment 34 Nate Graham 2025-09-17 15:26:02 UTC
*** Bug 509575 has been marked as a duplicate of this bug. ***
Comment 35 Nate Graham 2025-09-17 15:26:07 UTC
*** Bug 509576 has been marked as a duplicate of this bug. ***
Comment 36 TraceyC 2025-09-17 20:53:33 UTC
*** Bug 509619 has been marked as a duplicate of this bug. ***
Comment 37 Oliver Beard 2025-09-18 05:03:04 UTC
After bisecting qtdeclarative, I've identified the cause as https://invent.kde.org/qt/qt/qtdeclarative/-/commit/f68cfe5ceb903f2091b2ce23032823a863f184c7 (Loader: Also drop engine when clearing contexts recursively).
Comment 38 Bug Janitor Service 2025-09-18 14:39:20 UTC
A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/5821
Comment 39 Nate Graham 2025-09-18 19:27:03 UTC
*** Bug 509578 has been marked as a duplicate of this bug. ***
Comment 40 Nate Graham 2025-09-18 19:57:49 UTC
*** Bug 509631 has been marked as a duplicate of this bug. ***
Comment 41 Nate Graham 2025-09-18 20:39:22 UTC
*** Bug 509647 has been marked as a duplicate of this bug. ***