https://bugs.kde.org/show_bug.cgi?id=528092
Bug ID: 528092
Summary: plasmashell crashes on quit in breeze6.so
(qqc2-desktop-style) while a ListView creates a
delegate during window teardown
Classification: Plasma
Product: plasmashell
Version First 6.6.6
Reported In:
Platform: Ubuntu
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: generic-crash
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: 1.0
Created attachment 197875
--> https://bugs.kde.org/attachment.cgi?id=197875&action=edit
plasmashell SIGSEGV on stop
Split out of bug 525886 as requested in comment 2 there.
SUMMARY
When plasmashell is stopped (systemctl --user stop/restart plasma-plasmashell,
or session logout), it sometimes segfaults during teardown instead of exiting.
DrKonqi then shows a crash dialog.
The crash is always the same. An item is being removed from its window
(QQuickItemPrivate::derefWindow). The resulting
QQuickWindowAttached::windowChange notification re-evaluates a Plasma
core-bindings binding. That changes a padding, which resizes a ListView, which
incubates a NEW delegate. The delegate's qqc2-desktop-style / Breeze style item
then calls into a QQuickItem that is already gone. So the scene is creating new
styled items while it is being destroyed.
Crashing thread (Ubuntu build ids, no dbgsym for breeze; full trace attached):
#4 QQuickItem::setAcceptedMouseButtons(...) (libQt6Quick.so.6 +
0x214fd4)
#5 breeze6.so + 0x6ecc8
#6 breeze6.so + 0x50b99
#7 libqqc2desktopstyleplugin.so + 0x11ae7
#8 libqqc2desktopstyleplugin.so + 0x16623
#9 libqqc2desktopstyleplugin.so + 0x1ae50
#10 QQuickItem::setWidth(double)
#12 QQuickItem::setImplicitHeight(double)
#15 QQmlBinding::doUpdate(...)
#17 QQmlObjectCreator::finalize(...)
#18 QQmlIncubatorPrivate::incubate(...)
#21 QQuickItemViewPrivate::createItem(int, QQmlIncubator::IncubationMode)
#22 QQuickListViewPrivate::applyInsertionChange(...)
#24 QQuickItemViewPrivate::applyPendingChanges()
#25 QQuickItemViewPrivate::itemGeometryChanged(...)
#28 QQuickControl::geometryChange(...)
#29 QQuickItem::setWidth(double)
#35 QQuickFlickable::geometryChange(...)
#37 QQuickControlPrivate::resizeContent()
#40 QQuickAnchorsPrivate::setItemSize(...)
#45 QQuickControlPrivate::setLeftPadding(double, bool)
#48 QQmlBinding::doUpdate(...)
#52 libcorebindingsplugin.so + 0x12ef4
#53 libcorebindingsplugin.so + 0x13988
#56 QQmlBinding::doUpdate(...)
#60 QQuickWindowAttached::windowChange(QQuickWindow*)
#63 QQuickItemPrivate::derefWindow()
(systemd-coredump truncates at 64 frames; cores have since been rotated, so I
cannot produce a deeper trace for these instances)
STEPS TO REPRODUCE
1. Plasma 6.6.6 Wayland session.
2. systemctl --user restart plasma-plasmashell.service
3. Sometimes plasmashell segfaults on the way down instead of exiting.
FREQUENCY AND CONDITIONS (being precise, because it is not deterministic)
* 7 crashes with this exact stack between 2026-09-19 and 2026-09-30, out of 35
plasmashell stops in that period.
* 5 of the 7 came about 2 s after a GL context loss from bug 525886, when my
resume hook restarted the shell.
* 2 of the 7 (2026-09-30 09:36 and 12:37) were plain restarts with NO context
loss logged by that process, so a lost context is not required.
* 0 crashes in 27 stops since 2026-10-02. Since 2026-10-06 plasmashell renders
on the AMD iGPU instead of the NVIDIA dGPU, and 525886 no longer occurs either.
I cannot tell whether that change, or simply less churn, is why this crash
stopped.
OTHER SHUTDOWN CRASHES SEEN IN THE SAME PERIOD (different stacks, not part of
this report)
* 5x SIGSEGV in QRhi::makeThreadLocalNativeContextCurrent() <-
QSGRenderLoop::postJob() <- QQuickWindow::scheduleRenderJob() <-
QQuickItemPrivate::derefWindow() <- ~QQuickItem() <-
ContainmentItem::deleteWallpaperItem(). All 5 came after a context loss. This
is a Qt use-after-free, already fixed upstream by qtdeclarative 6a2e413a5a
"Scenegraph: Nullify QQuickWindowPrivate::rhi on RHI destruction" (Qt 6.11;
6.10 branch 6cb7ca6b3d, not in any 6.10 release). Nothing for KDE to do there.
* 2x SIGSEGV inside org.kde.plasma.weather.so while the weather applet is
destroyed (QObjectPrivate::deleteChildren <-
PlasmaQuick::SharedQmlEngine::~SharedQmlEngine <- Plasma::Applet::~Applet). I
can file this separately if useful.
SOFTWARE/OS VERSIONS
Operating System: Ubuntu 26.04.1 LTS, kernel 7.0.0-34-generic
KDE Plasma Version: 6.6.6 (plasma-workspace 4:6.6.6-0ubuntu0.1, breeze
4:6.6.5-0ubuntu0.1)
KDE Frameworks Version: 6.24.0
Qt Version: 6.10.2 (libqt6quick6 6.10.2+dfsg-3)
Graphics Platform: Wayland
ADDITIONAL INFORMATION
Lenovo Legion 5 (AMD Cezanne iGPU + NVIDIA RTX 3060 Mobile, driver 580.178.04).
At the time of all 7 crashes, KWin and plasmashell rendered on the NVIDIA GPU.
--
You are receiving this mail because:
You are watching all bug changes.
