514776 – kwin_wayland crashed in KWin::TransactionEntry::~TransactionEntry after alt-tabbing away from a game into Firefox

Bug 514776 - kwin_wayland crashed in KWin::TransactionEntry::~TransactionEntry after alt-tabbing away from a game into Firefox

Summary: kwin_wayland crashed in KWin::TransactionEntry::~TransactionEntry after alt-t...

Status:	NEEDSINFO WAITINGFORINFO

Alias:	None

Product:	kwin
Classification:	Plasma
Component:	generic-crash (other bugs)
Version First Reported In:	6.5.5
Platform:	Arch Linux Linux

Importance:	HI crash
Target Milestone:	---
Assignee:	KWin default assignee

URL:
Keywords:

Depends on:
Blocks:

Reported:	2026-01-18 02:54 UTC by Paulo Henrique
Modified:	2026-01-25 21:57 UTC (History)
CC List:	2 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:

Attachments
log bt with interactive debugger. (7.45 KB, text/x-log) 2026-01-18 02:54 UTC, Paulo Henrique	Details
View All Add an attachment

Note You need to log in before you can comment on or make changes to this bug.

Description Paulo Henrique 2026-01-18 02:54:44 UTC

Created attachment 188632 [details]
log bt with interactive debugger.

Playing FFXIV with firefox open then kwin wayland crashed after alt+tabbing.


SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Arch Linux
KDE Plasma Version: 6.5.5
KDE Frameworks Version: 6.22.0
Qt Version: 6.10.1

Comment 1 Nate Graham 2026-01-18 21:55:26 UTC

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007fbc736989d3 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
#2  0x00007fbc7363e3a0 in __GI_raise (sig=6) at ../sysdeps/posix/raise.c:26
#3  0x00007fbc77187e57 in KCrash::defaultCrashHandler (sig=6) at /usr/src/debug/kcrash/kcrash-6.22.0/src/kcrash.cpp:605
#4  <signal handler called>
#5  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#6  0x00007fbc736989d3 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
#7  0x00007fbc7363e3a0 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#8  0x00007fbc7362557a in __GI_abort () at abort.c:77
#9  0x00007fbc73626613 in __libc_message_impl (fmt=fmt@entry=0x7fbc737b3355 "%s\n") at ../sysdeps/posix/libc_fatal.c:138
#10 0x00007fbc736a2d25 in malloc_printerr (str=str@entry=0x7fbc737b65b0 "free(): invalid next size (fast)") at malloc.c:5895
#11 0x00007fbc736a4ff6 in _int_free_chunk (av=<optimized out>, p=<optimized out>, size=<optimized out>, have_lock=have_lock@entry=0)
    at malloc.c:4670
#12 0x00007fbc736a7ff4 in __GI___libc_free (mem=<optimized out>) at malloc.c:3571
#13 0x00007fbc73ab062a in operator delete (ptr=ptr@entry=0x558ba8e48fc0) at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/del_op.cc:49
#14 0x00007fbc73ab063a in operator delete (ptr=ptr@entry=0x558ba8e48fc0) at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/del_ops.cc:33
#15 0x00007fbc76dd37a1 in std::__new_allocator<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> > >::deallocate (this=<optimized out>, __p=<optimized out>, __n=<optimized out>) at /usr/include/c++/15.2.1/bits/new_allocator.h:172
#16 std::allocator<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> > >::deallocate (
    this=<optimized out>, __p=<optimized out>, __n=<optimized out>) at /usr/include/c++/15.2.1/bits/allocator.h:215
#17 std::allocator_traits<std::allocator<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> > > >::deallocate (__a=..., __p=<optimized out>, __n=<optimized out>) at /usr/include/c++/15.2.1/bits/alloc_traits.h:649
#18 std::_Vector_base<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> >, std::allocator<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> > > >::_M_deallocate (this=<optimized out>, __p=<optimized out>,
    __n=<optimized out>) at /usr/include/c++/15.2.1/bits/stl_vector.h:396
#19 std::_Vector_base<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> >, std::allocator<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> > > >::_M_deallocate (this=<optimized out>, __p=<optimized out>,
    __n=<optimized out>) at /usr/include/c++/15.2.1/bits/stl_vector.h:392
#20 std::_Vector_base<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> >, std::allocator<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> > > >::~_Vector_base (this=<optimized out>, this=<optimized out>)
    at /usr/include/c++/15.2.1/bits/stl_vector.h:375
#21 std::vector<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> >, std::allocator<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> > > >::~vector (this=<optimized out>, this=<optimized out>)
    at /usr/include/c++/15.2.1/bits/stl_vector.h:805
#22 KWin::TransactionEntry::~TransactionEntry (this=<optimized out>, this=<optimized out>)
    at /usr/src/debug/kwin/kwin-6.5.5/src/wayland/transaction.h:47
--Type <RET> for more, q to quit, c to continue without paging--c
#23 std::destroy_at<KWin::TransactionEntry> (__location=0x558ba90412f0) at /usr/include/c++/15.2.1/bits/stl_construct.h:88
#24 std::_Destroy<KWin::TransactionEntry> (__pointer=0x558ba90412f0) at /usr/include/c++/15.2.1/bits/stl_construct.h:164
#25 std::_Destroy<KWin::TransactionEntry*> (__first=0x558ba90412f0, __last=0x558ba9041338)
    at /usr/include/c++/15.2.1/bits/stl_construct.h:226
#26 std::_Destroy<KWin::TransactionEntry*, KWin::TransactionEntry> (__first=<optimized out>, __last=0x558ba9041338)
    at /usr/include/c++/15.2.1/bits/alloc_traits.h:1045
#27 std::vector<KWin::TransactionEntry, std::allocator<KWin::TransactionEntry> >::~vector (this=<optimized out>, this=<optimized out>)
    at /usr/include/c++/15.2.1/bits/stl_vector.h:802
#28 KWin::Transaction::~Transaction (this=<optimized out>, this=<optimized out>)
    at /usr/src/debug/kwin/kwin-6.5.5/src/wayland/transaction.h:94
#29 KWin::Transaction::apply (this=0x558ba984f420) at /usr/src/debug/kwin/kwin-6.5.5/src/wayland/transaction.cpp:194
#30 0x00007fbc73fd734f in QtPrivate::QSlotObjectBase::call (this=<optimized out>, r=<optimized out>, a=<optimized out>,
    this=<optimized out>, r=<optimized out>, a=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#31 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4257
#32 0x00007fbc73fe23c0 in QMetaObject::activate<void, QSocketDescriptor, QSocketNotifier::Type, QSocketNotifier::QPrivateSignal> (
    sender=0x558ba9a4f3b0, mo=<optimized out>, local_signal_index=0, ret=0x0)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs.h:319
#33 QSocketNotifier::activated (this=0x558ba9a4f3b0, _t1=..., _t2=<optimized out>, _t3=...)
    at /usr/src/debug/qt6-base/build/src/corelib/Core_autogen/include/moc_qsocketnotifier.cpp:161
#34 QSocketNotifier::event (this=0x558ba9a4f3b0, e=<optimized out>)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qsocketnotifier.cpp:324
#35 0x00007fbc751021c0 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x558ba9a4f3b0, e=0x7ffcaf1709e0)
    at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:3305
#36 0x00007fbc73f6a958 in QCoreApplication::notifyInternal2 (receiver=0x558ba9a4f3b0, event=0x7ffcaf1709e0)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1109
#37 0x00007fbc7412dcb9 in QCoreApplication::sendEvent (receiver=<optimized out>, event=0x7ffcaf1709e0)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1549
#38 QEventDispatcherUNIXPrivate::activateSocketNotifiers (this=this@entry=0x558ba7114a30)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_unix.cpp:276
#39 0x00007fbc7412e77c in QEventDispatcherUNIX::processEvents (this=<optimized out>, flags=...)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_unix.cpp:498
#40 0x00007fbc74d34b73 in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQt6Gui.so.6
#41 0x00007fbc73f75786 in QEventLoop::processEvents (this=0x7ffcaf170bb0, flags=...)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:104
#42 QEventLoop::exec (this=0x7ffcaf170bb0, flags=...) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:186
#43 0x00007fbc73f6f3f1 in QCoreApplication::exec () at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1452
#44 0x0000558b97680a94 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kwin/kwin-6.5.5/src/main_wayland.cpp:635

Comment 2 Vlad Zahorodnii 2026-01-21 15:03:06 UTC

Does it happen consistently?

Comment 3 Paulo Henrique 2026-01-21 18:07:55 UTC

(In reply to Vlad Zahorodnii from comment #2)
> Does it happen consistently?

Only happened once so far.

Comment 4 Paulo Henrique 2026-01-25 21:57:45 UTC

Happened again today 

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007f9121e989d3 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
#2  0x00007f9121e3e3a0 in __GI_raise (sig=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f91257a1e57 in KCrash::defaultCrashHandler (sig=6) at /usr/src/debug/kcrash/kcrash-6.22.0/src/kcrash.cpp:605
#4  <signal handler called>
#5  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#6  0x00007f9121e989d3 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
#7  0x00007f9121e3e3a0 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#8  0x00007f9121e2557a in __GI_abort () at abort.c:77
#9  0x00007f9121e26613 in __libc_message_impl (fmt=fmt@entry=0x7f9121fb3355 "%s\n") at ../sysdeps/posix/libc_fatal.c:138
#10 0x00007f9121ea2d25 in malloc_printerr (str=str@entry=0x7f9121fb65b0 "free(): invalid next size (fast)") at malloc.c:5895
#11 0x00007f9121ea4ff6 in _int_free_chunk (av=<optimized out>, p=<optimized out>, size=<optimized out>, have_lock=have_lock@entry=0) at malloc.c:4670
#12 0x00007f9121ea7ff4 in __GI___libc_free (mem=<optimized out>) at malloc.c:3571
#13 0x00007f91222b062a in operator delete (ptr=ptr@entry=0x55dc33288f90) at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/del_op.cc:49
#14 0x00007f91222b063a in operator delete (ptr=ptr@entry=0x55dc33288f90) at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/del_ops.cc:33
#15 0x00007f91253d37a1 in std::__new_allocator<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> > >::deallocate (this=<optimized out>, __p=<optimized out>, __n=<optimized out>) at /usr/include/c++/15.2.1/bits/new_allocator.h:172
#16 std::allocator<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> > >::deallocate (this=<optimized out>, 
    __p=<optimized out>, __n=<optimized out>) at /usr/include/c++/15.2.1/bits/allocator.h:215
#17 std::allocator_traits<std::allocator<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> > > >::deallocate (
    __a=..., __p=<optimized out>, __n=<optimized out>) at /usr/include/c++/15.2.1/bits/alloc_traits.h:649
#18 std::_Vector_base<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> >, std::allocator<std::unique_ptr<KWin::ColorPipelineStage, std::default_delete<KWin::ColorPipelineStage> > > >::_M_deallocate (this=<optimized out>, __p=<optimized out>, 
    __n=<optimized out>) at /usr/include/c++/15.2.1/bits/stl_vector.h:396
#19 std::_Vector_base<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> >, std::allocator<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> > > >::_M_deallocate (this=<optimized out>, __p=<optimized out>, __n=<optimized out>)
    at /usr/include/c++/15.2.1/bits/stl_vector.h:392
#20 std::_Vector_base<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> >, std::allocator<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> > > >::~_Vector_base (this=<optimized out>, this=<optimized out>)
    at /usr/include/c++/15.2.1/bits/stl_vector.h:375
#21 std::vector<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> >, std::allocator<std::unique_ptr<KWin::TransactionFence, std::default_delete<KWin::TransactionFence> > > >::~vector (this=<optimized out>, this=<optimized out>)
--Type <RET> for more, q to quit, c to continue without paging--c
    at /usr/include/c++/15.2.1/bits/stl_vector.h:805
#22 KWin::TransactionEntry::~TransactionEntry (this=<optimized out>, this=<optimized out>)
    at /usr/src/debug/kwin/kwin-6.5.5/src/wayland/transaction.h:47
#23 std::destroy_at<KWin::TransactionEntry> (__location=0x55dc330fcf80) at /usr/include/c++/15.2.1/bits/stl_construct.h:88
#24 std::_Destroy<KWin::TransactionEntry> (__pointer=0x55dc330fcf80) at /usr/include/c++/15.2.1/bits/stl_construct.h:164
#25 std::_Destroy<KWin::TransactionEntry*> (__first=0x55dc330fcf80, __last=0x55dc330fcfc8) at /usr/include/c++/15.2.1/bits/stl_construct.h:226
#26 std::_Destroy<KWin::TransactionEntry*, KWin::TransactionEntry> (__first=<optimized out>, __last=0x55dc330fcfc8)
    at /usr/include/c++/15.2.1/bits/alloc_traits.h:1045
#27 std::vector<KWin::TransactionEntry, std::allocator<KWin::TransactionEntry> >::~vector (this=<optimized out>, this=<optimized out>)
    at /usr/include/c++/15.2.1/bits/stl_vector.h:802
#28 KWin::Transaction::~Transaction (this=<optimized out>, this=<optimized out>) at /usr/src/debug/kwin/kwin-6.5.5/src/wayland/transaction.h:94
#29 KWin::Transaction::apply (this=0x55dc336b7490) at /usr/src/debug/kwin/kwin-6.5.5/src/wayland/transaction.cpp:194
#30 0x00007f91227d734f in QtPrivate::QSlotObjectBase::call (this=<optimized out>, r=<optimized out>, a=<optimized out>, this=<optimized out>, 
    r=<optimized out>, a=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:461
#31 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=<optimized out>)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4257
#32 0x00007f91227e23c0 in QMetaObject::activate<void, QSocketDescriptor, QSocketNotifier::Type, QSocketNotifier::QPrivateSignal> (
    sender=0x55dc32c5fbf0, mo=<optimized out>, local_signal_index=0, ret=0x0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs.h:319
#33 QSocketNotifier::activated (this=0x55dc32c5fbf0, _t1=..., _t2=<optimized out>, _t3=...)
    at /usr/src/debug/qt6-base/build/src/corelib/Core_autogen/include/moc_qsocketnotifier.cpp:161
#34 QSocketNotifier::event (this=0x55dc32c5fbf0, e=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qsocketnotifier.cpp:324
#35 0x00007f91239021c0 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x55dc32c5fbf0, e=0x7fff1e4360d0)
    at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:3305
#36 0x00007f912276a958 in QCoreApplication::notifyInternal2 (receiver=0x55dc32c5fbf0, event=0x7fff1e4360d0)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1109
#37 0x00007f912292dcb9 in QCoreApplication::sendEvent (receiver=<optimized out>, event=0x7fff1e4360d0)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1549
#38 QEventDispatcherUNIXPrivate::activateSocketNotifiers (this=this@entry=0x55dc30da4a50)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_unix.cpp:276
#39 0x00007f912292e77c in QEventDispatcherUNIX::processEvents (this=<optimized out>, flags=..., flags@entry=...)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_unix.cpp:498
#40 0x00007f9123534b73 in QUnixEventDispatcherQPA::processEvents (this=<optimized out>, flags=...)
    at /usr/src/debug/qt6-base/qtbase/src/gui/platform/unix/qunixeventdispatcher.cpp:28
#41 0x00007f9122775786 in QEventLoop::processEvents (this=0x7fff1e4362a0, flags=...)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:104
#42 QEventLoop::exec (this=0x7fff1e4362a0, flags=...) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:186
#43 0x00007f912276f3f1 in QCoreApplication::exec () at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1452
#44 0x00007f91238fd32a in QApplication::exec () at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:2575
#45 0x000055dbfc60fa94 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kwin/kwin-6.5.5/src/main_wayland.cpp:635