-
Bug
-
Resolution: Unresolved
-
Not Evaluated
-
None
-
6.7.2, 6.8.1, 6.8.2, 6.9.0, 6.9.1, 6.9.2, 6.10.0
-
None
-
KDE Plasma Version: 6.1.4; 6.2.5; 6.3.2; 6.3.4; 6.3.5; 6.4.1; 6.4.3; 6.4.4; 6.4.5
KDE Frameworks Version: 6.4.0; 6.10.0; 6.11.0; 6.12.0; 6.13.0; 6.14.0; 6.15.0; 6.16.0; 6.17.0; 6.18.0
Kernel Version: 6.8.0-51-generic (64-bit)
Kernel Version: 6.10.3-arch1-2 (64-bit)
Kernel Version: 6.12.30-1-lts (64-bit)
Kernel Version: 6.14.2-1-default (64-bit)
Kernel Version: 6.14.3-300.fc42 (64-bit)
Kernel Version: 6.14.4-arch1-1 (64-bit)
Kernel Version: 6.14.6-2-cachyos (64-bit)
Kernel Version: 6.15.0-1-default (64-bit)
Kernel Version: 6.15.4-200.fc42.x86_64 (64-bit)
Kernel Version: 6.15.7-3-cachyos (64-bit)
Kernel Version: 6.15.7-200.fc42.x86_64 (64-bit)
Graphics Platform: WaylandKDE Plasma Version: 6.1.4; 6.2.5; 6.3.2; 6.3.4; 6.3.5; 6.4.1; 6.4.3; 6.4.4; 6.4.5 KDE Frameworks Version: 6.4.0; 6.10.0; 6.11.0; 6.12.0; 6.13.0; 6.14.0; 6.15.0; 6.16.0; 6.17.0; 6.18.0 Kernel Version: 6.8.0-51-generic (64-bit) Kernel Version: 6.10.3-arch1-2 (64-bit) Kernel Version: 6.12.30-1-lts (64-bit) Kernel Version: 6.14.2-1-default (64-bit) Kernel Version: 6.14.3-300.fc42 (64-bit) Kernel Version: 6.14.4-arch1-1 (64-bit) Kernel Version: 6.14.6-2-cachyos (64-bit) Kernel Version: 6.15.0-1-default (64-bit) Kernel Version: 6.15.4-200.fc42.x86_64 (64-bit) Kernel Version: 6.15.7-3-cachyos (64-bit) Kernel Version: 6.15.7-200.fc42.x86_64 (64-bit) Graphics Platform: Wayland
Users on KDE Plasma 6.1 through 6.4 are experiencing random crashes during tooltip delegate teardown.
The issue was first reported in August 2024, but only later have more crashes occurred. The crash has been hard to reproduce so far.
Inspecting the coredump shows the `QObject` instance and associated `QQmlData` / d-pointer are in an inconsistent state when `QQmlData::get` attempts to access `QObjectData`. Possible use-after-free, lifecycle issues.
Code history suggests there have already been various problems with the property cache. However, I am not read up on those.
(gdb) f 10
#10 QQmlDelegateModelItem::destroyObject (this=0x5b3fb77273f0)
at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldelegatemodel.cpp:2512
2512 QQmlData *data = QQmlData::get(object);
(gdb) l - 2507 void QQmlDelegateModelItem::destroyObject() 2508 { 2509 Q_ASSERT(object); 2510 Q_ASSERT(contextData); 2511 2512 => QQmlData *data = QQmlData::get(object); 2513 Q_ASSERT(data); 2514 if (data->ownContext) { 2515 data->ownContext->clearContext(); 2516 data->ownContext->deepClearContextObject(object); 2517 data->ownContext.reset(); 2518 data->context = nullptr; 2519 } 2520 /* QTBUG-87228: when destroying object at the application exit, the deferred 2521 * parent by setting it to QCoreApplication instance if it's nullptr, so 2522 * deletion won't work. Not to leak memory, make sure our object has a that 2523 * the parent claims the object at the end of the lifetime. When not at the 2524 * application exit, normal event loop will handle the deferred deletion 2525 * earlier. 2526 */ 2527 if (Q_UNLIKELY(static_cast<QCoreApplicationPrivate *>(QCoreApplicationPrivate::get(QCoreApplication::instance()))->aboutToQuitEmitted)) { 2528 if (object->parent() == nullptr) 2529 object->setParent(QCoreApplication::instance()); 2530 } 2531 object->deleteLater(); 2532 2533 if (QQmlDelegateModelAttached *attachedObject = attached()) 2534 attachedObject->m_cacheItem = nullptr; 2535 2536 contextData.reset();
(gdb) p object # cacheItem->object
$1 = {wp = {d = 0x0, value = 0x0}}
See the original KDE Plasma bug report(s) here:
https://bugs.kde.org/show_bug.cgi?id=491699
I am attaching the full kcrash backtrace. Please let me know what further information to provide!