https://bugs.kde.org/show_bug.cgi?id=524929
Bug ID: 524929
Summary: Plasmashell crashes in Plasma::Applet::status() during
System Tray update triggered while Weather IonControl
is being destroyed
Classification: I don't know
Product: kde
Version First unspecified
Reported In:
Platform: Fedora RPMs
OS: Linux
Status: REPORTED
Keywords: drkonqi
Severity: crash
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Application: plasmashell (6.7.4)
ApplicationNotResponding [ANR]: false
Qt Version: 6.11.1
Frameworks Version: 6.29.0
Operating System: Linux 7.1.10-200.fc44.x86_64 x86_64
Windowing System: Wayland
Distribution: "Fedora release 44 (Forty Four)"
DrKonqi: 6.7.4 [CoredumpBackend]
-- Information about the crash:
The crash occurs during startup of my Plasma user session. In most cases when
this issue occurs, `plasmashell` crashes almost immediately after I log in to
my Plasma session. However, the problem is not fully deterministic: it does not
happen after every login, and some sessions start normally.
The crash has occurred repeatedly in this same general situation, i.e. during
the first moments after logging in, when Plasma is initializing the desktop,
panel, System Tray and its applets.
I obtained a core dump from one of these crashes and generated a fully
symbolized backtrace using Fedora's debuginfod service. The crash itself occurs
in:
`Plasma::Applet::status()`
`libplasma/src/plasma/applet.cpp:547`
called from:
`PlasmoidModel::data()`
`plasma-workspace/applets/systemtray/systemtraymodel.cpp:141`
while `SortedSystemTrayModel` is re-evaluating/sorting System Tray entries:
`SortedSystemTrayModel::lessThanSystemTray()`
`sortedsystemtraymodel.cpp:54`
`SortedSystemTrayModel::lessThan()`
`sortedsystemtraymodel.cpp:35`
The full stack is particularly interesting because the System Tray update
appears to be triggered by an applet status change while another part of Plasma
is already being destroyed.
The relevant sequence visible in the backtrace is approximately:
`QDBusServiceWatcher::serviceUnregistered()`
→ `PowerProfilesControl::onServiceUnregistered()`
(`powerprofilescontrol.cpp:277`)
→ `PowerProfilesControl::updatePowerProfileCurrentProfile()`
(`powerprofilescontrol.cpp:393`)
→ Qt property/QML binding notifications
→ `Plasma::Applet::statusChanged()`
→ `PlasmoidModel` emits `dataChanged()`
→ `SortedSystemTrayModel` starts re-evaluating the System Tray ordering
→ `PlasmoidModel::data()` requests another applet's status
→ `Plasma::Applet::status()`
→ SIGSEGV
At the same time, further down the same call stack, the Weather applet is in
its destruction path. In particular, the backtrace contains:
`QEventDispatcherGlib::processEvents()`
→ `IonControl::~IonControl()` (`weather/ioncontrol_p.cpp:68` / `:71`)
→ `WeatherDataMonitor::~WeatherDataMonitor()` (`weatherdatamonitor_p.cpp:53`)
→ `ForecastControl::~ForecastControl()` (`forecastcontrol.cpp:72`)
→ QML/Plasmoid object destruction
This suggests that `IonControl::~IonControl()` is processing pending Qt events
while the Weather applet object hierarchy is being torn down. During this
nested event processing, a D-Bus `serviceUnregistered` notification is
delivered to `PowerProfilesControl`, which causes a QML/property update and
subsequently a System Tray model update.
The System Tray then performs sorting and calls `Plasma::Applet::status()` on
an applet while destruction of Plasma/QML objects is already in progress.
Another potentially relevant detail is that the applet object whose
`statusChanged()` signal initiates the System Tray update is not the same
object on which the final crashing `Plasma::Applet::status()` call is made.
This may indicate that a model-wide re-sort triggered by one applet causes the
System Tray model to access another applet whose lifetime/state is no longer
valid.
I therefore suspect a reentrancy/object-lifetime issue involving System Tray
model updates during applet destruction. However, I cannot determine from the
backtrace alone whether the actual defect is in the System Tray model, Weather
applet teardown, PowerProfiles handling, or the interaction between these
components.
I am attaching/pasting the complete symbolized backtrace because it contains
source file and line information for Plasma, plasma-workspace, PowerDevil,
kdeplasma-addons and Qt.
System information visible in the backtrace:
* Fedora 44
* Plasma 6.7.4
* plasma-workspace 6.7.4
* libplasma 6.7.4
* PowerDevil 6.7.4
* kdeplasma-addons 6.7.4
* Qt 6.11.1
The crash is intermittent, but when it happens it usually happens directly
after logging in to the Plasma user session.
The crash can be reproduced sometimes.
-- Backtrace (Reduced):
#5 0x00007f246599fce8 in Plasma::Applet::status
(this=this@entry=0x55df23653060) at
/usr/src/debug/libplasma-6.7.4-1.fc44.x86_64/src/plasma/applet.cpp:547
#6 0x00007f24455bbfa4 in PlasmoidModel::data (this=0x55df2abad430,
index=<optimized out>, role=258) at
/usr/src/debug/plasma-workspace-6.7.4-1.fc44.x86_64/applets/systemtray/systemtraymodel.cpp:141
#7 0x00007f2462c19acd in QModelIndex::data (this=0x7ffdfab2e8c0, arole=258) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qabstractitemmodel.h:519
#8 QConcatenateTablesProxyModel::data (this=<optimized out>, index=<optimized
out>, role=258) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qconcatenatetablesproxymodel.cpp:215
#9 0x00007f24455c6a0b in QModelIndex::data (this=0x7ffdfab2eae0, arole=258) at
/usr/include/qt6/QtCore/qabstractitemmodel.h:519
#10 SortedSystemTrayModel::lessThanSystemTray (this=0x55df2abb3300,
left=<optimized out>, right=...) at
/usr/src/debug/plasma-workspace-6.7.4-1.fc44.x86_64/applets/systemtray/sortedsystemtraymodel.cpp:54
#11 SortedSystemTrayModel::lessThan (this=0x55df2abb3300, left=..., right=...)
at
/usr/src/debug/plasma-workspace-6.7.4-1.fc44.x86_64/applets/systemtray/sortedsystemtraymodel.cpp:35
#12 0x00007f2462c31828 in operator() (__closure=0x7ffdfab2eb30,
sourceRow=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:1387
#17 QSortFilterProxyModelPrivate::needsReorder (this=this@entry=0x55df2ab96050,
source_rows=..., source_parent=...) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:1379
#18 0x00007f2462c3d9b2 in QSortFilterProxyModelPrivate::_q_sourceDataChanged
(this=0x55df2ab96050, source_top_left=<optimized out>,
source_bottom_right=<optimized out>, roles=...) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qsortfilterproxymodel.cpp:1489
#19 0x00007f2462984eb7 in QtPrivate::QSlotObjectBase::call (this=<optimized
out>, r=0x55df2abb3300, a=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/kernel/qobjectdefs_impl.h:462
#20 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>,
argv=argv@entry=0x7ffdfab2ef00) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/kernel/qobject.cpp:4372
[...]
#23 QAbstractItemModel::dataChanged (this=this@entry=0x55df2784eb00, _t1=...,
_t2=..., _t3=...) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/redhat-linux-build/src/corelib/Core_autogen/include/moc_qabstractitemmodel.cpp:658
#24 0x00007f2462c18a0f in QConcatenateTablesProxyModelPrivate::slotDataChanged
(this=<optimized out>, from=<optimized out>, to=<optimized out>, roles=...) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/itemmodels/qconcatenatetablesproxymodel.cpp:769
#25 0x00007f2462984eb7 in QtPrivate::QSlotObjectBase::call (this=<optimized
out>, r=0x55df2784eb00, a=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/kernel/qobjectdefs_impl.h:462
#26 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>,
argv=argv@entry=0x7ffdfab2f0e0) at
/usr/src/debug/qt6-qtbase-6.11.1-1.fc44.x86_64/src/corelib/kernel/qobject.cpp:4372
Reported using DrKonqi
This report was filed against 'kde' because the product 'plasmashell' could not
be located in Bugzilla. Add it to drkonqi's mappings file!
--
You are receiving this mail because:
You are watching all bug changes.
