https://bugs.kde.org/show_bug.cgi?id=527691
--- Comment #3 from iOsa <[email protected]> --- Full backtrace with debug symbols attached ("thread apply all bt full", taken from the original core dump of the crash with libQt6Quick6/libQt6Core6/qt6-declarative/libQt6QuickTemplates2-6 debuginfo 6.12.0-1.1 and kscreenlocker6-debuginfo 6.8.0-2.1). ROOT CAUSE: this is the Qt regression QTBUG-150769, already fixed upstream https://bugreports.qt.io/browse/QTBUG-150769 ("[REG 6.11.2] Sporadic crashes on QQuickItemView destruction") Fix: "QQuickItemView: don't leave dangling entries in unrequestedItems" dev: https://code.qt.io/cgit/qt/qtdeclarative.git/commit/?id=83d091dcb160d3f0c4a8bc9df8b8a9a934ac82a1 6.12: https://code.qt.io/cgit/qt/qtdeclarative.git/commit/?id=d6f5246394d8fee96a1fc91cf2fb79c21173f658 Change-Id: Ide32473f3fea373749197c969eaff6d13869c32d, fix version 6.12.1 (not released yet). The crash site is identical to the one in QTBUG-150769: the loop at the end of ~QQuickItemView (qquickitemview.cpp:142-143) that walks d->unrequestedItems and calls removeItemChangeListener() on every stored item. The upstream analysis: releaseItem() called during clear(true) removes the Destroyed listener but leaves the entry in unrequestedItems, so itemDestroyed() never drops it; once the delegate is freed the destructor loop dereferences a dangling pointer. The fix is a one-line change in QQuickItemViewPrivate::releaseItem(): unrequestedItems.remove(quickItem) next to removeItemChangeListener(). The core dump matches this exactly: - frame #9 (~QQuickItemView of the lock screen's user ListView, ownModel = true) is iterating d->unrequestedItems (hash iterator at bucket 52); - the QQuickItemPrivate it dereferences (0x562798222930) is freed heap memory: its first words are 0x30, 0xf1 (malloc chunk header) and the 4th word points to main_arena+232 in libc.so.6, so q_ptr reads as 0xf1 and the QList remove index is garbage (i=452054); - the listener types being removed are 16 = QQuickItemPrivate::Destroyed (itemChangeListenerTypes). Versions: according to QTBUG-150769 the regression came in with Qt 6.11.2 (commit b0b1c1de68a1 "QQuickItemView: register Destroyed listener when storing an item"). In my case it only started after the combined upgrade to Plasma 6.8.0 + Qt 6.12.0; I did not see it with Plasma 6.7.5 + Qt 6.11.2, so presumably something in the 6.8 lock screen QML makes the user ListView go through releaseItem() during clear(true) on teardown. It reproduces on every unlock here, which makes it much more visible than "sporadic": every unlock looks like a rejected password and after 4 greeter restarts KWin goes into emergency mode. Suggestions: 1. Distributions shipping Qt 6.12.0 should backport d6f5246394d8 into qt6-declarative (openSUSE Tumbleweed's qt6-declarative 6.12.0-1.1 does not have it yet; it applies to src/quick/items/qquickitemview.cpp only). I can report it to openSUSE as well if that helps. 2. Optionally, the lock screen could detach the user list model before Qt.quit() (the workaround in the description), which avoids the crash even on unpatched Qt 6.11.2/6.12.0. Users stuck in this state have no way to unlock their session without a VT. Crashing thread (source paths shortened): Thread 1 (Thread 0x7f73de098640 (LWP 57003)): #0 0x00007f73e589608c in QArrayDataPointer<QQuickItemPrivate::ChangeListener>::needsDetach (this=0x5627982229c8) at <qt6>/QtCore/qarraydatapointer.h:356 #1 QArrayDataPointer<QQuickItemPrivate::ChangeListener>::detach (old=0x0, this=0x5627982229c8) at <qt6>/QtCore/qarraydatapointer.h:136 #2 QList<QQuickItemPrivate::ChangeListener>::remove (this=0x5627982229c8, i=452054, n=1) at <qt6>/QtCore/qlist.h:893 #3 QList<QQuickItemPrivate::ChangeListener>::remove (this=0x5627982229c8, i=452054, n=1) at <qt6>/QtCore/qlist.h:885 #4 QList<QQuickItemPrivate::ChangeListener>::erase (this=<optimized out>, abegin=..., aend=...) at <qt6>/QtCore/qlist.h:988 #5 QList<QQuickItemPrivate::ChangeListener>::erase (this=<optimized out>, pos=...) at <qt6>/QtCore/qlist.h:729 #6 QtPrivate::sequential_erase_one<QList<QQuickItemPrivate::ChangeListener>, QQuickItemPrivate::ChangeListener>(QList<QQuickItemPrivate::ChangeListener>&, QQuickItemPrivate::ChangeListener const&) [clone .isra.0] (c=..., t=...) at <qt6>/QtCore/qcontainertools_impl.h:407 #7 0x00007f73e5870d03 in QList<QQuickItemPrivate::ChangeListener>::removeOne<QQuickItemPrivate::ChangeListener> (this=<optimized out>, t=...) at <qt6>/QtCore/qlist.h:679 #8 QQuickItemPrivate::removeItemChangeListener (this=0x562798222930, listener=0x5627981917c8, types=...) at src/quick/items/qquickitem.cpp:4134 #9 0x00007f73e5bd0005 in QQuickItemView::~QQuickItemView (this=0x562797f5df20, this=<optimized out>) at src/quick/items/qquickitem.h:510 #10 0x00007f73e5b453e9 in QQmlPrivate::QQmlElement<QQuickListView>::~QQmlElement (this=0x562797f5df20, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #11 QQmlPrivate::QQmlElement<QQuickListView>::~QQmlElement (this=0x562797f5df20, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #12 0x00007f73e384ff8a in QObjectPrivate::deleteChildren (this=this@entry=0x562797f65f80) at src/corelib/kernel/qobject.cpp:2292 #13 0x00007f73e38588ad in QObject::~QObject (this=<optimized out>, this=<optimized out>) at src/corelib/kernel/qobject.cpp:1190 #14 0x00007f73e5b42c71 in QQuickFocusScope::~QQuickFocusScope (this=0x562797f65e90, this=<optimized out>) at src/quick/items/qquickfocusscope_p.h:25 #15 QQmlPrivate::QQmlElement<QQuickFocusScope>::~QQmlElement (this=0x562797f65e90, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #16 QQmlPrivate::QQmlElement<QQuickFocusScope>::~QQmlElement (this=0x562797f65e90, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #17 0x00007f73e384ff8a in QObjectPrivate::deleteChildren (this=this@entry=0x562797feb280) at src/corelib/kernel/qobject.cpp:2292 #18 0x00007f73e38588ad in QObject::~QObject (this=<optimized out>, this=<optimized out>) at src/corelib/kernel/qobject.cpp:1190 #19 0x00007f73dd3f5019 in QQmlPrivate::QQmlElement<QQuickStackView>::~QQmlElement (this=0x562797fe75e0, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #20 QQmlPrivate::QQmlElement<QQuickStackView>::~QQmlElement (this=0x562797fe75e0, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #21 0x00007f73e384ff8a in QObjectPrivate::deleteChildren (this=this@entry=0x562797f4dd10) at src/corelib/kernel/qobject.cpp:2292 #22 0x00007f73e38588ad in QObject::~QObject (this=<optimized out>, this=<optimized out>) at src/corelib/kernel/qobject.cpp:1190 #23 0x00007f73e5b45209 in QQmlPrivate::QQmlElement<QQuickMouseArea>::~QQmlElement (this=0x562797f4dc20, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #24 QQmlPrivate::QQmlElement<QQuickMouseArea>::~QQmlElement (this=0x562797f4dc20, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #25 0x00007f73e384ff8a in QObjectPrivate::deleteChildren (this=this@entry=0x562797eb8f60) at src/corelib/kernel/qobject.cpp:2292 #26 0x00007f73e38588ad in QObject::~QObject (this=<optimized out>, this=<optimized out>) at src/corelib/kernel/qobject.cpp:1190 #27 0x00007f73e5b42b59 in QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement (this=0x562797f217e0, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #28 QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement (this=0x562797f217e0, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #29 0x00007f73e384ff8a in QObjectPrivate::deleteChildren (this=this@entry=0x562797ea6230) at src/corelib/kernel/qobject.cpp:2292 #30 0x00007f73e38588ad in QObject::~QObject (this=<optimized out>, this=<optimized out>) at src/corelib/kernel/qobject.cpp:1190 #31 0x00007f73e5b42b59 in QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement (this=0x562797f84470, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #32 QQmlPrivate::QQmlElement<QQuickItem>::~QQmlElement (this=0x562797f84470, this=<optimized out>) at src/qml/qml/qqmlprivate.h:114 #33 0x00007f73e5942909 in QQuickView::~QQuickView (this=0x562797f11560, this=<optimized out>) at src/quick/items/qquickview.cpp:213 #34 0x00007f73e5942932 in QQuickView::~QQuickView (this=0x562797f11560, this=<optimized out>) at src/quick/items/qquickview.cpp:214 #35 0x0000562781211b81 in qDeleteAll<QList<QQuickView*>::const_iterator> (begin=..., end=...) at <qt6>/QtCore/qalgorithms.h:25 #36 qDeleteAll<QList<QQuickView*> > (c=...) at <qt6>/QtCore/qalgorithms.h:33 #37 ScreenLocker::UnlockApp::~UnlockApp (this=0x7ffe78d85950, this=<optimized out>) at greeter/greeterapp.cpp:187 #38 0x00005627811fd2c1 in main (argc=<optimized out>, argv=<optimized out>) at greeter/main.cpp:161 -- You are receiving this mail because: You are watching all bug changes.
