https://bugs.kde.org/show_bug.cgi?id=525243
Bug ID: 525243
Summary: Plugin API calls abort the application:
window.warning(), get_value(), find_by_uuid()
Classification: Applications
Product: glaxnimate
Version First 0.6.0
Reported In:
Platform: Mint (Ubuntu based)
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: scripting
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
**Summary:** Glaxnimate aborts when a Python plugin calls `window.warning()`,
`dialog.get_value()` or `composition.find_by_uuid()`
**Version:** 0.6.0, Flatpak `org.kde.glaxnimate` from Flathub
**Platform:** Linux Mint, X11, Qt 6.10.3, Python 3.13
**Related:** bug 510273 ("Glaxnimate crashes when document.find_by_uuid() is
used from the script console", RESOLVED WORKSFORME). That report covers one
of the three calls below. It was closed by the bug janitor after the reporter
did not respond to a request to retest; the maintainer could not reproduce on
0.5.80-git-915723e2. This is reproducible on the 0.6.0 Flathub build, and the
`window.warning` case reproduces using only a bundled plugin.
## Steps to reproduce
1. Enable the bundled **Hello** plugin (it ships with Glaxnimate).
2. Run it from the plugins menu.
`hello_world.py` does nothing but call `window.warning(...)`.
## Result
The application terminates immediately with SIGABRT. No error dialog is
shown; the window simply disappears. Started from a terminal, stderr carries:
```
/usr/include/c++/15.2.0/array:219: constexpr const std::array<_Tp,
_Nm>::value_type&
std::array<_Tp, _Nm>::operator[](size_type) const
[with _Tp = QGenericArgument; long unsigned int _Nm = 9; ...]:
Assertion '__n < this->size()' failed.
```
A coredump shows the abort reached through
`QAction` activation -> Glaxnimate -> libpython3.13 -> back into Glaxnimate's
binding layer -> `std::terminate`.
## Expected
The warning is displayed, or at worst a catchable Python exception is raised.
A plugin should not be able to kill the application.
## Analysis
The assertion is an out-of-bounds index on the fixed
`std::array<QGenericArgument, 9>` in `app::scripting::python::ArgumentBuffer`
(the type appears in the stripped binary's symbols as
`app::scripting::python::ArgumentBuffer::Destructor*, _Nm = 9`).
Three calls reproduce it:
| Call | Note |
| --- | --- |
| `window.warning(str)` | bundled *Hello* plugin |
| `dialog.get_value(str, str)` | bundled *Frame by Frame* / *Replace Color* use
this API |
| `composition.find_by_uuid(uuid)` | passing a Python `uuid.UUID` |
Not every call is affected — `window.create_dialog(str)`, `dialog.exec()`,
`document.macro(str)`, `to_path()` and property reads/writes all work, so it
is not simply argument count or string arguments.
Bug 510273 reports the same `find_by_uuid` crash from the **script console**
rather than from a plugin, and adds that it applies to the other `find_by_*`
functions, and that passing a `QUuid` produces a conversion error instead of
a crash. So this is not specific to the plugin loader. Because the failure is a
C++ assertion rather than an exception, plugins cannot defend against it.
This makes the Python plugin API largely unusable in 0.6.0: two of the
bundled plugins use `get_value`, and one crashes on launch.
Glaxnimate: 0.6.0+-git-
potrace: potracelib 1.16
libav: Lavu59.39.100, Lavf61.7.100, Lavc61.19.101, SwS8.3.100
libarchive: 3.8.7
zlib
Inkscape
pybind11: 2.13.6
CPython: 3.13.14
KDE Frameworks: 6.27.0
Qt: Using 6.10.3 and built against 6.10.3
Flatpak
KDE Flatpak runtime (Xcb)
Build ABI: x86_64-little_endian-lp64
Kernel: linux 6.8.0-138-generic
--
You are receiving this mail because:
You are watching all bug changes.
