Bug 515234 - plasmashell crashes in ShellCorona::~ShellCorona() with systemctl restart while using multiple monitors
Summary: plasmashell crashes in ShellCorona::~ShellCorona() with systemctl restart wh...
Status: RESOLVED FIXED
Alias: None
Product: plasmashell
Classification: Plasma
Component: generic-crash (other bugs)
Version First Reported In: 6.5.5
Platform: Arch Linux Linux
: HI crash
Target Milestone: 1.0
Assignee: Plasma Bugs List
URL:
Keywords: drkonqi, multiscreen
: 517610 518757 (view as bug list)
Depends on:
Blocks:
 
Reported: 2026-01-29 00:50 UTC by Devin Bidwell
Modified: 2026-05-12 18:10 UTC (History)
5 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In: 6.6.6
Sentry Crash Report: https://crash-reports.kde.org/organizations/kde/issues/353103/


Attachments
New crash information added by DrKonqi (135.10 KB, text/plain)
2026-01-29 00:50 UTC, Devin Bidwell
Details
full backtrace (109.67 KB, text/plain)
2026-03-04 09:44 UTC, Akseli Lahtinen
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Devin Bidwell 2026-01-29 00:50:19 UTC
Application: plasmashell (6.5.5)

ApplicationNotResponding [ANR]: false
Qt Version: 6.10.1
Frameworks Version: 6.22.0
Operating System: Linux 6.18.6-arch1-1 x86_64
Windowing System: Wayland
Distribution: "Arch Linux"
DrKonqi: 6.5.5 [CoredumpBackend]

-- Information about the crash:
When attempting to restart my plasma shell with `systemctl restart --user plasma-plasmashell`, the following crash handler happens. Plasmashell comes back just fine, but is very laggy when coming back to life. Stabilizes after 10 seconds or so. Using 3 monitors, all 3 monitors have cloned panels that I think might be causing the issue.

The crash can be reproduced every time.

-- Backtrace (Reduced):
#5  0x00007f0fdd0b2817 in unlink_chunk (p=p@entry=0x558ecb43c460, av=0x7f0fdd1f6ac0 <main_arena>) at malloc.c:1627
#6  0x00007f0fdd0b3cb8 in _int_free_merge_chunk (av=av@entry=0x7f0fdd1f6ac0 <main_arena>, p=0x558ecb43c460, size=<optimized out>) at malloc.c:4799
#7  0x00007f0fdd0b3f51 in _int_free_chunk (av=0x7f0fdd1f6ac0 <main_arena>, p=<optimized out>, size=<optimized out>, have_lock=<optimized out>) at malloc.c:4729
#8  0x00007f0fde41e835 in QAction::~QAction (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/gui/kernel/qaction.cpp:463
#9  0x00007f0fdd7bcde2 in QObjectPrivate::deleteChildren (this=this@entry=0x558ecb4004b0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2212
#10 0x00007f0fdd7c37de in QObject::~QObject (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:1122
#11 0x00007f0fb3fe8b20 in org_kde_panel_Plugin::~org_kde_panel_Plugin (this=<optimized out>, this=<optimized out>) at /usr/src/debug/plasma-desktop/build/containments/panel/org.kde.panel.cpp:5
#12 org_kde_panel_Plugin::~org_kde_panel_Plugin (this=<optimized out>, this=<optimized out>) at /usr/src/debug/plasma-desktop/build/containments/panel/org.kde.panel.cpp:5
#13 0x0000558e97d28696 in ShellCorona::~ShellCorona (this=<optimized out>, this=<optimized out>) at /usr/src/debug/plasma-workspace/plasma-workspace-6.5.5/shell/shellcorona.cpp:355
#14 0x0000558e97cf92f4 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/plasma-workspace/plasma-workspace-6.5.5/shell/main.cpp:189


Reported using DrKonqi
Comment 1 Devin Bidwell 2026-01-29 00:50:21 UTC
Created attachment 189009 [details]
New crash information added by DrKonqi

DrKonqi auto-attaching complete backtrace.
Comment 2 Akseli Lahtinen 2026-01-29 11:15:28 UTC
I have had this occasionally, but it's very random. But I can confirm this happens. I will send backtrace next time it does.

Operating System: KDE Linux 2026-01-28
KDE Plasma Version: 6.6.80
KDE Frameworks Version: 6.23.0
Qt Version: 6.10.1
Kernel Version: 6.18.6-zen1-1-zen (64-bit)
Graphics Platform: Wayland
Processors: 12 × AMD Ryzen 5 3600 6-Core Processor
Memory: 16 GiB of RAM (15.5 GiB usable)
Graphics Processor: AMD Radeon RX 6600
Comment 3 Akseli Lahtinen 2026-03-04 09:43:35 UTC
Got the backtrace!

Thread 1 (Thread 0x7f6bfde67180 (LWP 50254)):
[KCrash Handler]
#4  0x00007f6c042b63b7 in unlink_chunk (p=p@entry=0x5654219f7880, av=0x7f6c043faac0 <main_arena>) at malloc.c:1600
#5  0x00007f6c042b76a0 in _int_free_merge_chunk (av=0x7f6c043faac0 <main_arena>, p=0x5654219f7880, size=<optimized out>) at malloc.c:4458
#6  0x00007f6c042b7814 in _int_free_chunk (av=0x7f6c043faac0 <main_arena>, p=<optimized out>, size=<optimized out>, have_lock=<optimized out>) at malloc.c:4386
#7  0x00007f6c0497de49 in QObjectPrivate::~QObjectPrivate (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:212
#8  0x00007f6c054d3fb6 in QActionPrivate::~QActionPrivate (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/gui/kernel/qaction.cpp:65
#9  0x00007f6c06a6d677 in QtWidgetsActionPrivate::~QtWidgetsActionPrivate (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qaction_widgets.cpp:25
#10 QtWidgetsActionPrivate::~QtWidgetsActionPrivate (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qaction_widgets.cpp:25
#11 0x00007f6c054d0875 in QAction::~QAction (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/gui/kernel/qaction.cpp:463
#12 0x00007f6c049765c2 in QObjectPrivate::deleteChildren (this=this@entry=0x5654217799c0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2212
#13 0x00007f6c0497d2be in QObject::~QObject (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:1122
#14 0x00007f6bd81a93f0 in org_kde_plasma_pager_Plugin::~org_kde_plasma_pager_Plugin (this=<optimized out>, this=<optimized out>) at /usr/src/debug/kde-banana-plasma-desktop-git/build/applets/pager/org.kde.plasma.pager.cpp:5
#15 org_kde_plasma_pager_Plugin::~org_kde_plasma_pager_Plugin (this=<optimized out>, this=<optimized out>) at /usr/src/debug/kde-banana-plasma-desktop-git/build/applets/pager/org.kde.plasma.pager.cpp:5
#16 0x00007f6c049765c2 in QObjectPrivate::deleteChildren (this=this@entry=0x565421779940) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2212
#17 0x00007f6c0497d2be in QObject::~QObject (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:1122
#18 0x00007f6bf40ce1b0 in org_kde_panel_Plugin::~org_kde_panel_Plugin (this=<optimized out>, this=<optimized out>) at /usr/src/debug/kde-banana-plasma-desktop-git/build/containments/panel/org.kde.panel.cpp:5
#19 org_kde_panel_Plugin::~org_kde_panel_Plugin (this=<optimized out>, this=<optimized out>) at /usr/src/debug/kde-banana-plasma-desktop-git/build/containments/panel/org.kde.panel.cpp:5
#20 0x00005653f3a0bed6 in ShellCorona::~ShellCorona (this=<optimized out>, this=<optimized out>) at /usr/src/debug/kde-banana-plasma-workspace-git/plasma-workspace/shell/shellcorona.cpp:325
#21 0x00005653f39dc0ec in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kde-banana-plasma-workspace-git/plasma-workspace/shell/main.cpp:205
Comment 4 Akseli Lahtinen 2026-03-04 09:44:07 UTC
Created attachment 190337 [details]
full backtrace
Comment 5 TraceyC 2026-04-11 12:33:03 UTC
Sentry shows 365 events for this crash and 31 user reports, 6.6.4 included. Raising priority
Comment 6 Nate Graham 2026-04-21 20:13:50 UTC
I can reproduce this 100% of the time in KDE Linux when using more than one screen. A simple `systemctl restart --user plasma-plasmashell.service` is indeed enough to make it happen.
Comment 7 TraceyC 2026-04-23 18:16:35 UTC
I can also reproduce with a laptop and one external monitor on Plasma git-master running  `systemctl restart --user plasma-plasmashell.service`
Comment 8 TraceyC 2026-04-23 18:24:54 UTC
*** Bug 518757 has been marked as a duplicate of this bug. ***
Comment 9 TraceyC 2026-04-23 18:25:09 UTC
*** Bug 517610 has been marked as a duplicate of this bug. ***
Comment 10 Akseli Lahtinen 2026-04-23 18:59:47 UTC
I cant repro this on desktop PC with two monitors
Comment 11 Nate Graham 2026-04-23 19:01:23 UTC
Weird, maybe it requires one monitor to be a laptop monitor?

Or maybe scaling/mixed scale factors are required? My laptop screen is at 175% scale, while the external one is at 100% scale.
Comment 12 Angel Parra 2026-04-23 19:19:00 UTC
Peeking here as my bug report was linked to this and I do have a laptop monitor (the crash occured in my laptop) and its scale factor is set to 150%. I don't remember if this happened right when I connected an external monitor (projector) of different resolution, though.
Comment 13 Bug Janitor Service 2026-05-07 23:56:55 UTC
A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/6561
Comment 14 Akseli Lahtinen 2026-05-11 14:51:09 UTC
I have tried to build plasmashell with address sanitizer but when I do that, the crash never happens. Though I'm beginning to suspect the crash I'm hunting is something different from this one, since it likely happens when systemd restarts the plasmashell.
Comment 15 Nate Graham 2026-05-11 14:52:09 UTC
It turns out that panels and panel contents matter. If I put a panel on each screen and a stocky note on one, I can reproduce it 100% of the time.
Comment 16 Nate Graham 2026-05-12 15:47:59 UTC
Git commit 6f8417e5412052e5f7b2afc7d481d6699df94c75 by Nate Graham.
Committed on 12/05/2026 at 15:47.
Pushed by ngraham into branch 'master'.

shellcorona: always use safe containment destruction order

We clean up the containments safely in unload(), by first deleting the
inner panels and desktop views, and then the outer containments.

But in the destructor, we delete the outer containments first, and let them
delete the inner ones at their leisure.

This is unsafe (per the comment in the safe teardown code); fix it by
unifying on the same teardown ordering in both places, and also first
set m_closingDown in the destructor to prevent
availableScreenRectChanged() from being inappropriately emitted during
destruction.

Adapt shellTest to cover this case.
FIXED-IN: 6.6.6

M  +6    -4    shell/autotests/shelltest.cpp
M  +19   -11   shell/shellcorona.cpp
M  +1    -0    shell/shellcorona.h

https://invent.kde.org/plasma/plasma-workspace/-/commit/6f8417e5412052e5f7b2afc7d481d6699df94c75
Comment 17 Nate Graham 2026-05-12 18:10:45 UTC
Git commit 4a91adb58af3245f77d6add97443781171e55ee8 by Nate Graham.
Committed on 12/05/2026 at 15:48.
Pushed by ngraham into branch 'Plasma/6.6'.

shellcorona: always use safe containment destruction order

We clean up the containments safely in unload(), by first deleting the
inner panels and desktop views, and then the outer containments.

But in the destructor, we delete the outer containments first, and let them
delete the inner ones at their leisure.

This is unsafe (per the comment in the safe teardown code); fix it by
unifying on the same teardown ordering in both places, and also first
set m_closingDown in the destructor to prevent
availableScreenRectChanged() from being inappropriately emitted during
destruction.

Adapt shellTest to cover this case.
FIXED-IN: 6.6.6


(cherry picked from commit 6f8417e5412052e5f7b2afc7d481d6699df94c75)

bf674d20 shellcorona: always use safe containment destruction order

Co-authored-by: Nate Graham <nate@kde.org>

M  +6    -4    shell/autotests/shelltest.cpp
M  +19   -11   shell/shellcorona.cpp
M  +1    -0    shell/shellcorona.h

https://invent.kde.org/plasma/plasma-workspace/-/commit/4a91adb58af3245f77d6add97443781171e55ee8