https://bugs.kde.org/show_bug.cgi?id=526561
Bug ID: 526561
Summary: plasmashell crashes in
AppMenuModel::removeSearchActionsFromMenu after the
app rebuilds a submenu while Global Menu search has
results
Classification: Plasma
Product: plasmashell
Version First 6.7.5
Reported In:
Platform: Fedora RPMs
OS: Linux
Status: REPORTED
Severity: crash
Priority: NOR
Component: Global Menu widget
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected], [email protected]
Target Milestone: 1.0
SUMMARY
plasmashell crashes when I type in the Global Menu's Search after the active
app has rebuilt one of its submenus. I first hit it with Google Chrome, whose
History > Recently Closed menu changes when a tab is closed.
STEPS TO REPRODUCE
Wayland session, Global Menu widget on a panel in its full view (so "Search" is
shown). Reproduced on Fedora's default panel with only the Global Menu widget
added.
1. Run this PySide6 script; its "Dynamic" menu is rebuilt every 5 seconds:
import sys
from PySide6.QtCore import QTimer
from PySide6.QtWidgets import QApplication, QMainWindow, QPlainTextEdit
app = QApplication(sys.argv)
win = QMainWindow(); win.setCentralWidget(QPlainTextEdit())
dyn = win.menuBar().addMenu("&Dynamic")
gen = 0
def rebuild():
global gen
gen += 1
dyn.clear()
for i in range(8):
dyn.addAction(f"Apple {gen}-{i}")
rebuild()
t = QTimer(); t.timeout.connect(rebuild); t.start(5000)
win.show()
sys.exit(app.exec())
2. With its window active, click "Search" in the Global Menu, click into the
search field and type "app". The results appear.
3. Wait until the results disappear (the menu has been rebuilt).
4. Type another letter.
OBSERVED RESULT
plasmashell crashes, every time. Switching to another window after step 3
instead of typing (with the popup still open, or after closing it with Esc)
crashes the same way.
EXPECTED RESULT
No crash; the results update.
SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Fedora 44 (Wayland)
KDE Plasma Version: 6.7.5
KDE Frameworks Version: 6.30.0
Qt Version: 6.11.2
ADDITIONAL INFORMATION
It looks like m_currentSearchActions keeps raw QAction pointers to menu items
that DBusMenuImporter deletes when the app updates its menu, and the next text
change passes them to QWidget::removeAction() (appmenumodel.cpp:184). Holding
them as QPointer and skipping deleted ones fixes it in my local build. The same
code is in master.
Backtrace of the original crash (with Chrome; gdb, crashing thread, symbols
from debuginfod):
#0 __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=11, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1 0x00007fa456c7bdd3 in __pthread_kill_internal (threadid=<optimized out>,
signo=11) at pthread_kill.c:89
#2 0x00007fa456c20e8e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#3 0x00007fa45a4c10d4 in KCrash::defaultCrashHandler (sig=11) at
/usr/src/debug/kf6-kcrash-6.30.0-1.fc44.x86_64/src/kcrash.cpp:653
#4 <signal handler called>
#5 0x00007fa459a9b4cf in QArrayDataPointer<QObject*>::data (this=0x140) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/tools/qarraydatapointer.h:111
#6 QArrayDataPointer<QObject*>::constBegin (this=0x140) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/tools/qarraydatapointer.h:117
#7 QList<QObject*>::cbegin (this=0x140) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/tools/qlist.h:700
#8 QtPrivate::sequential_erase_if<QList<QObject*>,
QtPrivate::sequential_erase<QList<QObject*>, QWidget*>(QList<QObject*>&,
QWidget* const&)::{lambda(auto:1 const&)#1}>(QList<QObject*>&,
QtPrivate::sequential_erase<QList<QObject*>, QWidget*>(QList<QObject*>&,
QWidget* const&)::{lambda(auto:1 const&)#1}&) (c=..., pred=...) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/tools/qcontainertools_impl.h:349
#9 0x00007fa459aa3f2a in QtPrivate::sequential_erase<QList<QObject*>,
QWidget*> (c=..., t=@0x7ffe297f9ad0: 0x55add9a94960) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/tools/qcontainertools_impl.h:383
#10 QtPrivate::sequential_erase_with_copy<QList<QObject*>, QWidget*> (c=...,
t=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/tools/qcontainertools_impl.h:390
#11 QList<QObject*>::removeAll<QWidget*> (t=<optimized out>, this=<optimized
out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/tools/qlist.h:664
#12 QWidget::removeAction (this=0x55add9a94960,
action=action@entry=0x55add9a388e0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/kernel/qwidget.cpp:3241
#13 0x00007fa441738fca in AppMenuModel::removeSearchActionsFromMenu
(this=0x55add68e9400) at
/usr/src/debug/plasma-workspace-6.7.5-1.fc44.x86_64/applets/appmenu/appmenumodel.cpp:184
#14 0x00007fa44173d15d in AppMenuModel::insertSearchActionsIntoMenu
(this=0x55add68e9400, filter=...) at
/usr/src/debug/plasma-workspace-6.7.5-1.fc44.x86_64/applets/appmenu/appmenumodel.cpp:191
#15 operator() (__closure=<optimized out>) at
/usr/src/debug/plasma-workspace-6.7.5-1.fc44.x86_64/applets/appmenu/appmenumodel.cpp:99
#16 operator() (__closure=<optimized out>) at
/usr/include/qt6/QtCore/qobjectdefs_impl.h:117
#17 QtPrivate::FunctorCallBase::call_internal<void,
QtPrivate::FunctorCall<std::integer_sequence<long unsigned int>,
QtPrivate::List<>, void, AppMenuModel::AppMenuModel(QObject*)::<lambda()>
>::call(AppMenuModel::AppMenuModel(QObject*)::<lambda()>&, void**)::<lambda()>
> (args=<optimized out>, fn=...) at
/usr/include/qt6/QtCore/qobjectdefs_impl.h:66
#18 QtPrivate::FunctorCall<std::integer_sequence<long unsigned int>,
QtPrivate::List<>, void, AppMenuModel::AppMenuModel(QObject*)::<lambda()>
>::call (f=..., arg=<optimized out>) at
/usr/include/qt6/QtCore/qobjectdefs_impl.h:116
#19 QtPrivate::FunctorCallable<AppMenuModel::AppMenuModel(QObject*)::<lambda()>
>::call<QtPrivate::List<>, void> (f=..., arg=<optimized out>) at
/usr/include/qt6/QtCore/qobjectdefs_impl.h:338
#20
QtPrivate::QCallableObject<AppMenuModel::AppMenuModel(QObject*)::<lambda()>,
QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *,
void **, bool *) (which=<optimized out>, this_=<optimized out>, r=<optimized
out>, a=<optimized out>, ret=<optimized out>) at
/usr/include/qt6/QtCore/qobjectdefs_impl.h:548
#21 0x00007fa457381db7 in QtPrivate::QSlotObjectBase::call (this=<optimized
out>, r=0x55add68e9400, a=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qobjectdefs_impl.h:462
#22 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>,
argv=argv@entry=0x7ffe297f9c80) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qobject.cpp:4393
#23 0x00007fa457378337 in QMetaObject::activate (sender=<optimized out>,
m=m@entry=0x7fa45a204500 <QLineEdit::staticMetaObject>,
local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7ffe297f9c80)
at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qobject.cpp:4453
#24 0x00007fa459c16679 in QMetaObject::activate<void, QString>
(sender=<optimized out>, mo=0x7fa45a204500 <QLineEdit::staticMetaObject>,
local_signal_index=0, ret=0x0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qobjectdefs.h:320
#25 QLineEdit::textChanged (this=<optimized out>, _t1=...) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/redhat-linux-build/src/widgets/Widgets_autogen/include/moc_qlineedit.cpp:333
#26 0x00007fa457381db7 in QtPrivate::QSlotObjectBase::call (this=<optimized
out>, r=0x55add69c7fb0, a=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qobjectdefs_impl.h:462
#27 doActivate<false> (sender=<optimized out>, signal_index=<optimized out>,
argv=argv@entry=0x7ffe297f9d90) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qobject.cpp:4393
#28 0x00007fa457378337 in QMetaObject::activate
(sender=sender@entry=0x55add6918d60, m=m@entry=0x7fa45a2049e0
<QWidgetLineControl::staticMetaObject>,
local_signal_index=local_signal_index@entry=3, argv=argv@entry=0x7ffe297f9d90)
at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qobject.cpp:4453
#29 0x00007fa459c2400c in QMetaObject::activate<void, QString>
(sender=0x55add6918d60, mo=0x7fa45a2049e0
<QWidgetLineControl::staticMetaObject>, local_signal_index=3, ret=0x0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qobjectdefs.h:320
#30 QWidgetLineControl::textChanged (this=this@entry=0x55add6918d60, _t1=...)
at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/redhat-linux-build/src/widgets/Widgets_autogen/include/moc_qwidgetlinecontrol_p.cpp:211
#31 0x00007fa459c2861f in QWidgetLineControl::finishChange
(this=0x55add6918d60, validateFromState=<optimized out>,
update=update@entry=false, edited=edited@entry=true) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/widgets/qwidgetlinecontrol.cpp:716
#32 0x00007fa459c297e8 in QWidgetLineControl::insert (this=<optimized out>,
newText=...) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/widgets/qwidgetlinecontrol.cpp:235
#33 0x00007fa459c2b0e0 in QWidgetLineControl::processKeyEvent
(this=0x55add6918d60, event=event@entry=0x7ffe297fa3f0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/tools/qarraydata.h:73
#34 0x00007fa459c1656f in QLineEdit::keyPressEvent (this=<optimized out>,
event=0x7ffe297fa3f0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/widgets/qlineedit.cpp:1762
#35 0x00007fa459ab172a in QWidget::event (this=0x55add69c7fb0,
event=0x7ffe297fa3f0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/kernel/qwidget.cpp:9062
#36 0x00007fa459a3f9be in QApplicationPrivate::notify_helper
(this=this@entry=0x55add572f450, receiver=receiver@entry=0x55add69c7fb0,
e=e@entry=0x7ffe297fa3f0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/kernel/qapplication.cpp:3273
#37 0x00007fa459a4a802 in QApplication::notify (this=<optimized out>,
receiver=<optimized out>, e=0x7ffe297fa3f0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/kernel/qapplication.cpp:2694
#38 0x00007fa45730c838 in QCoreApplication::notifyInternal2
(receiver=0x55add69c7fb0, event=0x7ffe297fa3f0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qcoreapplication.cpp:1126
#39 0x00007fa45730c86a in QCoreApplication::forwardEvent (receiver=<optimized
out>, event=<optimized out>, originatingEvent=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qcoreapplication.cpp:1141
#40 0x00007fa459ac52d8 in QWidgetWindow::handleKeyEvent (this=<optimized out>,
event=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/kernel/qwidgetwindow.cpp:731
#41 0x00007fa459ac8f48 in QWidgetWindow::event (this=<optimized out>,
event=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/kernel/qwidgetwindow.cpp:286
#42 0x00007fa459a3f9be in QApplicationPrivate::notify_helper (this=<optimized
out>, receiver=0x55add9db0cf0, e=0x7ffe297fa3f0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/widgets/kernel/qapplication.cpp:3273
#43 0x00007fa45730c838 in QCoreApplication::notifyInternal2
(receiver=0x55add9db0cf0, event=0x7ffe297fa3f0) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qcoreapplication.cpp:1126
#44 0x00007fa45730c88d in QCoreApplication::sendSpontaneousEvent
(receiver=<optimized out>, event=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/corelib/kernel/qcoreapplication.cpp:1585
#45 0x00007fa457afea5c in QGuiApplicationPrivate::processKeyEvent
(e=0x7fa43c0ab520) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/gui/kernel/qguiapplication.cpp:2639
#46 0x00007fa457b75c4c in QWindowSystemInterface::sendWindowSystemEvents
(flags=...) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/gui/kernel/qwindowsysteminterface.cpp:1117
#47 0x00007fa45814bc44 in userEventSourceDispatch (source=<optimized out>) at
/usr/src/debug/qt6-qtbase-6.11.2-2.fc44.x86_64/src/gui/platform/unix/qeventdispatcher_glib.cpp:39
#48 0x00007fa455bf2f24 in ?? () from /lib64/libglib-2.0.so.0
#49 0x000055add574b210 in ?? ()
#50 0x00000092dbfeb474 in ?? ()
#51 0x0000000000000000 in ?? ()
--
You are receiving this mail because:
You are watching all bug changes.
