https://bugs.kde.org/show_bug.cgi?id=520640
usman <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #4 from usman <[email protected]> --- Yeah ive had a similar bug according to a debugging session with gpt 6 astra. Am attaching the generated report. Astra was able to exactly ,supposedly, point in the source where the issue is occuring. So please take a look at that as well below. On Fedora 44, the thumbnail kioworker segfaulted while stopping plasma-plasmashell.service. GDB places the actual fault in genericsig_handler at the inlined kill-flag write, during QApplication teardown. The fontconfig/libxml2 frames are below a signal boundary: they describe interrupted cleanup, not the faulting instruction. This occurred on 2026-09-07 at 12:31:10 UTC. A retained journal trace from 2026-08-25 at 16:51:23 UTC has the same genericsig_handler offset (libKF6KIOCore.so.6 + 0x55b97), thumbnail/QApplication teardown chain, and Plasma-stop timing. The older binary core has expired. ## Observed sequence (UTC, September 7) - 12:31:10.250003: systemd begins stopping plasma-plasmashell.service. - 12:31:10.502498: thumbnail kioworker PID 67254 reports a crash. - 12:31:10.603820: systemd-coredump records the SIGSEGV. - 12:31:10.607037: Plasma service is stopped. - 12:31:10.614555: service begins starting. - 12:31:10.740122: Plasma service has started; new PID 67276 remains active. Context: a local game launcher and its game files had been removed. The automation then ran `systemctl --user stop plasma-plasmashell.service`, installed a desktop-layout file with that launcher's position references removed, and started the service. The crash occurs during the stop, before installation of that edited configuration. No causal link to game content has been established. ## Reproduction status Two naturally occurring matching local crash records, both during a Plasma stop. No deliberate reproduction performed for this investigation; probability and minimum prerequisites remain unknown. A maintainer reproduction candidate is to stop Plasma while its thumbnail worker is exiting, so that a termination signal arrives after worker destruction but before QApplication destruction completes. This is a proposed timing scenario, not a verified deterministic reproducer. Expected: worker exits normally during the service stop. Actual: thumbnail worker crashes and a crash notification appears; Plasma subsequently starts successfully. ## Environment - Fedora Linux 44, Wayland; kernel 7.1.13-200.fc44.x86_64. - plasma-workspace 6.7.4-2.fc44. - kf6-kio-core 6.29.0-1.fc44. - kio-extras 26.08.0-1.fc44. - qt6-qtbase 6.11.2-2.fc44. - fontconfig 2.17.0-4.fc44 (x86_64). - libxml2 2.12.10-6.fc44 (x86_64). - Worker loads thumbnail.so and Qt's offscreen platform plugin. That plugin choice does not imply the desktop session is X11. - Service reports KillMode=control-group and KillSignal=15 (SIGTERM). ## Debugger evidence The relevant stack is: ```text KCrash::defaultCrashHandler(int) <signal handler called> genericsig_handler libKF6KIOCore.so.6 + 0x55b97 <signal handler called> xmlDictLookup / XML parsing FcConfigParseAndLoadFromMemoryInternal / FcConfigEnsure QFontconfigDatabase::~QFontconfigDatabase QOffscreenX11Integration::~QOffscreenX11Integration QGuiApplicationPrivate::~QGuiApplicationPrivate QApplicationPrivate::~QApplicationPrivate kdemain thumbnail.so ``` At handler +39, the faulting instruction is `xchg %al,0x71(%rdx)`. RDX is `0x666e6f632e66762d`, an invalid pointer containing text-like bytes, and AL is 1. Earlier instructions load the global worker pointer and then its member at +0x30 into RDX. This matches the inlined atomic assignment in SlaveBase::setKillFlag(). RDI is 15 in the handler frame, consistent with SIGTERM and the service stop, though the optimized argument and sender were not independently recovered. The libxml2 interrupted PC is a conditional branch (`je`) in xmlDictLookup, not the invalid memory write. Full function-level backtrace: backtrace-public.txt. No packages or debuginfo were installed. ## Source-level hypothesis KIO v6.29.0 src/core/slavebase.cpp assigns globalSlave=this, installs termination handlers, and uses globalSlave->setKillFlag() in genericsig_handler. SlaveBase::~SlaveBase does not clear that global pointer; setKillFlag writes d->wasKilled. The fetched master snapshot also retains this pattern. kio-extras v26.08.0 thumbnail/thumbnail.cpp constructs QApplication before ThumbnailProtocol. C++ destruction order therefore destroys the worker first and QApplication second. Qt v6.11.2 qfontconfigdatabase.cpp performs FcConfigDestroy(FcConfigGetCurrent()) in its font database destructor, consistent with the observed fontconfig cleanup frames. Together these strongly suggest a stale globalSlave/use-after-free window: a termination signal arriving during subsequent QApplication cleanup attempts to set the already-destroyed worker's kill flag. Allocation/free history is not available in this core, so this remains a strongly supported mechanism rather than an instrumented proof. Suggested maintainer review: make the signal-handler target lifetime safe before worker/private-data destruction, accounting for signal delivery during teardown. Add a focused teardown/signal regression test, ideally with AddressSanitizer. No patch has been applied or tested locally. Sources: - https://bugs.kde.org/show_bug.cgi?id=520640 (matching handler/atomic-write crash during fontconfig cleanup). - https://github.com/KDE/kio/blob/v6.29.0/src/core/slavebase.cpp#L225 - https://github.com/KDE/kio/blob/v6.29.0/src/core/slavebase.cpp#L292 - https://github.com/KDE/kio-extras/blob/v26.08.0/thumbnail/thumbnail.cpp#L200 - https://github.com/qt/qtbase/blob/v6.11.2/src/gui/text/unix/qfontconfigdatabase.cpp#L602 -- You are receiving this mail because: You are watching all bug changes.
