Application: plasmashell (6.7.4)

ApplicationNotResponding [ANR]: false
Qt Version: 6.11.1
Frameworks Version: 6.29.0
Operating System: Linux 7.1.10-200.fc44.x86_64 x86_64
Windowing System: Wayland
Distribution: "Fedora release 44 (Forty Four)"
DrKonqi: 6.7.4 [CoredumpBackend]

-- Information about the crash:
The crash occurs during startup of my Plasma user session. In most cases when this issue occurs, `plasmashell` crashes almost immediately after I log in to my Plasma session. However, the problem is not fully deterministic: it does not happen after every login, and some sessions start normally.

The crash has occurred repeatedly in this same general situation, i.e. during the first moments after logging in, when Plasma is initializing the desktop, panel, System Tray and its applets.

I obtained a core dump from one of these crashes and generated a fully symbolized backtrace using Fedora's debuginfod service. The crash itself occurs in:

`Plasma::Applet::status()`
`libplasma/src/plasma/applet.cpp:547`

called from:

`PlasmoidModel::data()`
`plasma-workspace/applets/systemtray/systemtraymodel.cpp:141`

while `SortedSystemTrayModel` is re-evaluating/sorting System Tray entries:

`SortedSystemTrayModel::lessThanSystemTray()`
`sortedsystemtraymodel.cpp:54`

`SortedSystemTrayModel::lessThan()`
`sortedsystemtraymodel.cpp:35`

The full stack is particularly interesting because the System Tray update appears to be triggered by an applet status change while another part of Plasma is already being destroyed.

The relevant sequence visible in the backtrace is approximately:

`QDBusServiceWatcher::serviceUnregistered()`
→ `PowerProfilesControl::onServiceUnregistered()` (`powerprofilescontrol.cpp:277`)
→ `PowerProfilesControl::updatePowerProfileCurrentProfile()` (`powerprofilescontrol.cpp:393`)
→ Qt property/QML binding notifications
→ `Plasma::Applet::statusChanged()`
→ `PlasmoidModel` emits `dataChanged()`
→ `SortedSystemTrayModel` starts re-evaluating the System Tray ordering
→ `PlasmoidModel::data()` requests another applet's status
→ `Plasma::Applet::status()`
→ SIGSEGV

At the same time, further down the same call stack, the Weather applet is in its destruction path. In particular, the backtrace contains:

`QEventDispatcherGlib::processEvents()`
→ `IonControl::~IonControl()` (`weather/ioncontrol_p.cpp:68` / `:71`)
→ `WeatherDataMonitor::~WeatherDataMonitor()` (`weatherdatamonitor_p.cpp:53`)
→ `ForecastControl::~ForecastControl()` (`forecastcontrol.cpp:72`)
→ QML/Plasmoid object destruction

This suggests that `IonControl::~IonControl()` is processing pending Qt events while the Weather applet object hierarchy is being torn down. During this nested event processing, a D-Bus `serviceUnregistered` notification is delivered to `PowerProfilesControl`, which causes a QML/property update and subsequently a System Tray model update.

The System Tray then performs sorting and calls `Plasma::Applet::status()` on an applet while destruction of Plasma/QML objects is already in progress.

Another potentially relevant detail is that the applet object whose `statusChanged()` signal initiates the System Tray update is not the same object on which the final crashing `Plasma::Applet::status()` call is made. This may indicate that a model-wide re-sort triggered by one applet causes the System Tray model to access another applet whose lifetime/state is no longer valid.

I therefore suspect a reentrancy/object-lifetime issue involving System Tray model updates during applet destruction. However, I cannot determine from the backtrace alone whether the actual defect is in the System Tray model, Weather applet teardown, PowerProfiles handling, or the interaction between these components.

I am attaching/pasting the complete symbolized backtrace because it contains source file and line information for Plasma, plasma-workspace, PowerDevil, kdeplasma-addons and Qt.

System information visible in the backtrace:

* Fedora 44
* Plasma 6.7.4
* plasma-workspace 6.7.4
* libplasma 6.7.4
* PowerDevil 6.7.4
* kdeplasma-addons 6.7.4
* Qt 6.11.1

The crash is intermittent, but when it happens it usually happens directly after logging in to the Plasma user session.

The crash can be reproduced sometimes.

-- Backtrace (Reduced):
#5  0x00007f246599fce8 in Plasma::Applet::status (this=this@entry=0x55df23653060) at /usr/src/debug/libplasma-6.7.4-1.fc44.x86_64/src/plasma/applet.cpp:547
#6  0x00007f24455bbfa4 in PlasmoidModel::data (this=0x55df2abad430, index=<optimized out>, role=258) at /usr/src/debug/plasma-workspace-6.7.4-1.fc44.x86_64/applets/systemtray/systemtraymodel.cpp:141
#7  0x00007f2462c19acd in QModelIndex::data (this=0x7ffdfab2e8c0, arole=258) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qabstractitemmodel.h:519
#8  QConcatenateTablesProxyModel::data (this=<optimized out>, index=<optimized out>, role=258) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qconcatenatetablesproxymodel.cpp:215
#9  0x00007f24455c6a0b in QModelIndex::data (this=0x7ffdfab2eae0, arole=258) at /usr/include/qt6/QtCore/qabstractitemmodel.h:519
#10 SortedSystemTrayModel::lessThanSystemTray (this=0x55df2abb3300, left=<optimized out>, right=...) at /usr/src/debug/plasma-workspace-6.7.4-1.fc44.x86_64/applets/systemtray/sortedsystemtraymodel.cpp:54
#11 SortedSystemTrayModel::lessThan (this=0x55df2abb3300, left=..., right=...) at /usr/src/debug/plasma-workspace-6.7.4-1.fc44.x86_64/applets/systemtray/sortedsystemtraymodel.cpp:35
#12 0x00007f2462c31828 in operator() (__closure=0x7ffdfab2eb30, sourceRow=<optimized out>) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:1387
#17 QSortFilterProxyModelPrivate::needsReorder (this=this@entry=0x55df2ab96050, source_rows=..., source_parent=...) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:1379
#18 0x00007f2462c3d9b2 in QSortFilterProxyModelPrivate::_q_sourceDataChanged (this=0x55df2ab96050, source_top_left=<optimized out>, source_bottom_right=<optimized out>, roles=...) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:1489
#19 0x00007f2462984eb7 in QtPrivate::QSlotObjectBase::call (this=<optimized out>, r=0x55df2abb3300, a=<optimized out>) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/kernel/qobjectdefs_impl.h:462
#20 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=argv@entry=0x7ffdfab2ef00) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/kernel/qobject.cpp:4372
[...]
#23 QAbstractItemModel::dataChanged (this=this@entry=0x55df2784eb00, _t1=..., _t2=..., _t3=...) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/redhat-linux-build/src/corelib/Core_autogen/include/moc_qabstractitemmodel.cpp:658
#24 0x00007f2462c18a0f in QConcatenateTablesProxyModelPrivate::slotDataChanged (this=<optimized out>, from=<optimized out>, to=<optimized out>, roles=...) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qconcatenatetablesproxymodel.cpp:769
#25 0x00007f2462984eb7 in QtPrivate::QSlotObjectBase::call (this=<optimized out>, r=0x55df2784eb00, a=<optimized out>) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/kernel/qobjectdefs_impl.h:462
#26 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>, argv=argv@entry=0x7ffdfab2f0e0) at /usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/kernel/qobject.cpp:4372


Reported using DrKonqi
This report was filed against 'kde' because the product 'plasmashell' could not be located in Bugzilla. Add it to drkonqi's mappings file!