516607 – KCM crashes in Qt model code when saving a change to the name of a custom command/script shortcut

Bug 516607 - KCM crashes in Qt model code when saving a change to the name of a custom command/script shortcut

Summary: KCM crashes in Qt model code when saving a change to the name of a custom com...

Status:	RESOLVED FIXED

Alias:	None

Product:	systemsettings
Classification:	Applications
Component:	kcm_keys (other bugs)
Version First Reported In:	6.5.80
Platform:	KDE Linux Linux

Importance:	NOR crash
Target Milestone:	---
Assignee:	Plasma Bugs List

URL:
Keywords:	qt-crash

Depends on:
Blocks:

Reported:	2026-02-23 18:46 UTC by Nate Graham
Modified:	2026-02-28 00:15 UTC (History)
CC List:	5 users (show)

See Also:
Latest Commit:	https://invent.kde.org/plasma/plasma-desktop/-/commit/7160d3bee99eda83c934a1a638cbb4d6cd52e91d
Version Fixed/Implemented In:	6.6.2
Sentry Crash Report:

Attachments
Add an attachment

Note You need to log in before you can comment on or make changes to this bug.

Description Nate Graham 2026-02-23 18:46:33 UTC

STEPS TO REPRODUCE
1. Add new > Command or Script
2. for the script, enter "/usr/bin/zsh"
3. for the name, enter "zsh"
4. Click "Add"
5. Select it in the list view and click the edit button
6. Change "zsh" in the name to "zshhhhh"
7. Click "Save"

OBSERVED RESULT
System Settings crashes 100% of the time with the following backtrace:

#0  __pthread_kill_implementation
    (threadid=<optimized out>, signo=signo@entry=11, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007f2a68e1eaf3 in __pthread_kill_internal (threadid=<optimized out>, signo=11)
    at pthread_kill.c:89
#2  0x00007f2a68dc41a0 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#3  0x00007f2a6ae94e65 in KCrash::defaultCrashHandler (sig=11)
    at /usr/src/debug/kde-banana-kcrash-git/kcrash/src/kcrash.cpp:623
#4  0x00007f2a68dc42d0 in <signal handler called> () at /usr/lib/libc.so.6
#5  std::__atomic_base<QQmlData::NotifyList*>::load
    (this=0x100000017, __m=std::memory_order_relaxed)
    at /usr/include/c++/15.2.1/bits/atomic_base.h:828
#6  std::atomic<QQmlData::NotifyList*>::load (this=0x100000017, __m=std::memory_order_relaxed)
    at /usr/include/c++/15.2.1/atomic:586
#7  QAtomicOps<QQmlData::NotifyList*>::loadRelaxed<QQmlData::NotifyList*>
    (_q_value=<error reading variable: Cannot access memory at address 0x100000017>)
    at /usr/include/qt6/QtCore/qatomic_cxx11.h:203
#8  QBasicAtomicPointer<QQmlData::NotifyList>::loadRelaxed (this=0x100000017)
    at /usr/include/qt6/QtCore/qbasicatomic.h:171
#9  QQmlData::signalHasEndpoint (this=0xffffffff, index=4)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmldata_p.h:373
#10 QQmlData::isSignalConnected (d=0xffffffff, index=4)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlengine.cpp:358
#11 0x00007f2a69501b63 in QObjectPrivate::isDeclarativeSignalConnected
    (this=<optimized out>, signal_index=4)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject_p.h:87
#12 doActivate<false> (sender=0x55c8e29e5290, signal_index=4, argv=0x0)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4159
#13 0x00007f2a68a1d477 in QQmlDelegateModelItem::rowChanged (this=0x55c8e29e5290)
    at /usr/src/debug/qt6-declarative/build/src/qmlmodels/QmlModels_autogen/include/moc_qqmldelegatemodel_p_p.cpp:163
#14 QQmlDelegateModelItem::setModelIndex
    (this=0x55c8e29e5290, idx=<optimized out>, newRow=<optimized out>, newColumn=<optimized out>, alwaysEmit=false)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:2548
#15 0x00007f2a68a19c8a in QQmlDelegateModel::_q_itemsInserted
    (this=this@entry=0x55c8e06fb5b0, index=index@entry=0, count=count@entry=1)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:1687
#16 0x00007f2a68a1a84d in QQmlDelegateModel::setRootIndex
    (this=0x55c8e06fb5b0, root=<optimized out>)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:534
#17 0x00007f2a68a30a22 in QQmlDelegateModel::qt_metacall
    (this=0x55c8e06fb5b0, _c=QMetaObject::WriteProperty, _id=7, _a=0x7ffe01fdda60)
    at /usr/src/debug/qt6-declarative/build/src/qmlmodels/QmlModels_autogen/include/moc_qqmldelegatemodel_p.cpp:372
#18 0x00007f2a6b3b7513 in QQmlPropertyData::doMetacall<(QMetaObject::Call)2>
    (this=<optimized out>, object=<optimized out>, idx=<optimized out>, argv=0x7ffe01fdda60)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlpropertydata_p.h:397
#19 QQmlPropertyData::doMetacall<(QMetaObject::Call)2>
    (this=<optimized out>, object=<optimized out>, idx=<optimized out>, argv=0x7ffe01fdda60)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlpropertydata_p.h:392
#20 QQmlPropertyData::writeProperty
    (this=<optimized out>, target=<optimized out>, value=<optimized out>, flags=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlpropertydata_p.h:415
#21 0x00007f2a6b490638 in QQmlPropertyPrivate::write
    (object=0x55c8e06fb5b0, property=..., value=..., context=..., flags=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1956
#22 0x00007f2a6b33052f in QV4::QObjectWrapper::setProperty
    (engine=engine@entry=0x55c8dfc4f1e0, object=object@entry=0x55c8e06fb5b0, property=0x7f2a185e65b0, value=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:795
#23 0x00007f2a6b330f71 in QV4::QObjectWrapper::setQmlProperty
    (engine=engine@entry=0x55c8dfc4f1e0, qmlContext=..., object=0x55c8e06fb5b0, name=name@entry=0x7f2a1d5f65b0, flags=..., flags@entry=..., value=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:580
#24 0x00007f2a6b331118 in QV4::QObjectWrapper::virtualPut
    (m=0x7f2a1d5f65a0, id=..., value=..., receiver=0x7f2a1d5f65a0)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4qobjectwrapper.cpp:980
#25 0x00007f2a6b30541d in QV4::Object::put
    (receiver=<optimized out>, this=<optimized out>, name=<optimized out>, v=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4string_p.h:141
#26 QV4::Lookup::setterFallback
    (lookup=0x55c8e0508058, engine=0x55c8dfc4f1e0, object=<optimized out>, value=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4lookup.cpp:664
#27 0x00007f2a6b397ccb in QV4::Moth::VME::interpret (frame=0xffffffff, 
    frame@entry=0x7ffe01fde560, engine=0x55c8dfc4f1e0, code=0x7f2a1c19d2d4 "\032\b\006\324\026\006\002") at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4vme_moth.cpp:709
#28 0x00007f2a6b39b2c6 in QV4::Moth::VME::exec (frame=<optimized out>, engine=<optimized out>)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4vme_moth.cpp:493
#29 0x00007f2a6b2e3300 in QV4::doCall
    (self=<optimized out>, thisObject=<optimized out>, argv=<optimized out>, argc=argc@entry=0, context=<optimized out>)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4function.cpp:53
#30 0x00007f2a6b2e9619 in QV4::Function::call
    (this=this@entry=0x55c8e050e900, thisObject=<optimized out>, argv=argv@entry=0x7f2a1d5f6500, argc=argc@entry=0, context=context@entry=0x7f2a1c198c60)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4function.cpp:78
#31 0x00007f2a6b2e9909 in operator()
    (__closure=<synthetic pointer>, thisObject=<optimized out>, argv=0x7f2a1d5f6500, argc=0)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4function.cpp:29
#32 QV4::convertAndCall<QV4::Function::call(QObject*, void**, const QMetaType*, int, QV4::ExecutionContext*)::<lambda(const QV4::Value*, const QV4::Value*, int)> >
    (engine=<optimized out>, thisObject=0x55c8e06454d0, a=0x7ffe01fde830, types=0x7ffe01fde820, argc=0, call=...) at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4jscall_p.h:200
#33 QV4::Function::call
    (this=0x55c8e050e900, thisObject=0x55c8e06454d0, a=0x7ffe01fde830, types=0x7ffe01fde820, argc=0, context=0x7f2a1c198c60)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/jsruntime/qv4function.cpp:26
#34 0x00007f2a6b4402b0 in QQmlJavaScriptExpression::evaluate
    (this=<optimized out>, a=<optimized out>, types=<optimized out>, argc=<optimized out>)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmljavascriptexpression.cpp:270
#35 0x00007f2a6b3d72cb in QQmlBoundSignalExpression::evaluate
    (this=<optimized out>, a=a@entry=0x0)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlboundsignal.cpp:200
#36 0x00007f2a6b3dc80d in QQmlBoundSignal_callback (e=0x55c8e068ee50, a=0x0)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/ftw/qqmlrefcount_p.h:73
#37 QQmlBoundSignal_callback (e=0x55c8e068ee50, a=0x0)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlboundsignal.cpp:294
#38 0x00007f2a6b469f58 in QQmlNotifier::emitNotify (endpoint=<optimized out>, a=0x0)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlnotifier.cpp:74
#39 0x00007f2a69501b82 in doActivate<false> (sender=0x55c8e06454d0, signal_index=82, argv=0x0)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4162
#40 0x00007f2a6bb95fb3 in QQuickItemView::currentItemChanged (this=0x55c8e06454d0)
    at /usr/src/debug/qt6-declarative/build/src/quick/Quick_autogen/include/moc_qquickitemview_p.cpp:712
#41 QQuickItemViewPrivate::applyModelChanges
    (this=0x55c8e06455b0, totalInsertionResult=0x7ffe01fe0470, totalRemovalResult=0x7ffe01fe0440)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickitemview.cpp:2276
#42 QQuickItemViewPrivate::layout (this=0x55c8e06455b0)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickitemview.cpp:2037
#43 0x00007f2a6b9193ed in QQuickWindowPrivate::polishItems (this=0x55c8e06edf20)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickwindow.cpp:345
#44 0x00007f2a6b899357 in QQuickRenderControl::polishItems (this=<optimized out>)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/quick/items/qquickrendercontrol.cpp:341
#45 0x00007f2a6be9be16 in QQuickWidgetPrivate::render
    (this=0x55c8e075da90, needsSync=<optimized out>)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/quickwidgets/qquickwidget.cpp:409
#46 0x00007f2a6be9c248 in QQuickWidgetPrivate::renderSceneGraph (this=0x55c8e075da90)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/quickwidgets/qquickwidget.cpp:447
#47 QQuickWidget::timerEvent (this=<optimized out>, e=<optimized out>)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/quickwidgets/qquickwidget.cpp:1434
#48 0x00007f2a694ef416 in QObject::event (this=<optimized out>, e=<optimized out>)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:1388
#49 0x00007f2a6a453380 in QApplicationPrivate::notify_helper
    (this=<optimized out>, receiver=0x55c8e075da60, e=0x7ffe01fe0960)
    at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:3305
#50 0x00007f2a69494f48 in QCoreApplication::notifyInternal2
    (receiver=0x55c8e075da60, event=0x7ffe01fe0960)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1109
#51 0x00007f2a69657d2f in QCoreApplication::sendEvent
    (receiver=<optimized out>, event=0x7ffe01fe0960)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1549
#52 QTimerInfoList::activateTimers (this=<optimized out>)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qtimerinfo_unix.cpp:426
#53 0x00007f2a6977ac39 in timerSourceDispatch (source=<optimized out>)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:152
#54 0x00007f2a6826ff4d in g_main_dispatch (context=0x7f2a5c000f00) at ../glib/glib/gmain.c:3565
#55 0x00007f2a68271617 in g_main_context_dispatch_unlocked (context=0x7f2a5c000f00)
    at ../glib/glib/gmain.c:4425
#56 g_main_context_iterate_unlocked
    (context=context@entry=0x7f2a5c000f00, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4490
#57 0x00007f2a68271825 in g_main_context_iteration (context=0x7f2a5c000f00, may_block=1)
    at ../glib/glib/gmain.c:4556
#58 0x00007f2a69778cb2 in QEventDispatcherGlib::processEvents (this=0x55c8df5a3ef0, flags=...)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:399
#59 0x00007f2a6949fcf6 in QEventLoop::processEvents (this=0x7ffe01fe0c30, flags=...)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:104
#60 QEventLoop::exec (this=0x7ffe01fe0c30, flags=...)
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qeventloop.cpp:186
#61 0x00007f2a694999f1 in QCoreApplication::exec ()
    at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1452
#62 0x00007f2a6a44e4ea in QApplication::exec ()
    at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:2575
#63 0x000055c8a5b304a0 in main (argc=<optimized out>, argv=<optimized out>)
    at /usr/src/debug/kde-banana-systemsettings-git/systemsettings/app/main.cpp:175

EXPECTED RESULT
No crash!


SOFTWARE/OS VERSIONS
Operating System: KDE Linux 2026-02-22
KDE Plasma Version: 6.6.80
KDE Frameworks Version: 6.24.0
Qt Version: 6.10.2
Kernel Version: 6.18.9-zen1-2-zen (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 7840U w/ Radeon™ 780M Graphics
Memory: 17 GB of RAM (16.0 GB usable)
Graphics Processor: AMD Radeon 780M Graphics

Comment 1 Nicolas Fella 2026-02-26 17:51:07 UTC


*** This bug has been marked as a duplicate of bug 516488 ***

Comment 2 Akseli Lahtinen 2026-02-27 14:38:32 UTC

Git commit e6023ff02ec3b1f3f081b07f6b942cfb2b9c0793 by Akseli Lahtinen.
Committed on 27/02/2026 at 14:08.
Pushed by akselmo into branch 'master'.

keys/FilteredModel: Remove deprecated invalidation, check if currentItem exists

invalidateFilter is deprecated,  begin/endFilterChange instead.

During deletion or rapid changes, currentItem can be null.
In those cases, reset the index to -1 and return early to avoid working
on null item.

This fixes crashing when user changes search filter rapidly.
Related: bug 516488

M  +4    -2    kcms/keys/filteredmodel.cpp
M  +7    -1    kcms/keys/ui/main.qml

https://invent.kde.org/plasma/plasma-desktop/-/commit/e6023ff02ec3b1f3f081b07f6b942cfb2b9c0793

Comment 3 Akseli Lahtinen 2026-02-27 15:30:56 UTC

Git commit 7160d3bee99eda83c934a1a638cbb4d6cd52e91d by Akseli Lahtinen.
Committed on 27/02/2026 at 14:40.
Pushed by akselmo into branch 'Plasma/6.6'.

keys/FilteredModel: Remove deprecated invalidation, check if currentItem exists

invalidateFilter is deprecated,  begin/endFilterChange instead.

During deletion or rapid changes, currentItem can be null.
In those cases, reset the index to -1 and return early to avoid working
on null item.

This fixes crashing when user changes search filter rapidly.
Related: bug 516488
(cherry picked from commit e6023ff02ec3b1f3f081b07f6b942cfb2b9c0793)

M  +4    -2    kcms/keys/filteredmodel.cpp
M  +7    -1    kcms/keys/ui/main.qml

https://invent.kde.org/plasma/plasma-desktop/-/commit/7160d3bee99eda83c934a1a638cbb4d6cd52e91d