https://bugs.kde.org/show_bug.cgi?id=527846
Bug ID: 527846
Summary: plasmashell 6.6.6: deterministic SIGSEGV on shutdown
(reproducible 2/2)
Classification: Plasma
Product: plasmashell
Version First 6.6.6
Reported In:
Platform: Ubuntu
OS: Linux
Status: REPORTED
Severity: crash
Priority: NOR
Component: Containment
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: 1.0
# plasmashell 6.6.6: deterministic SIGSEGV on shutdown (reproducible 2/2)
**Product:** plasmashell
**Component:** Containment
**Version:** 6.6.6
**Severity:** crash
**Platform:** Ubuntu (Wayland)
> Duplicate check done: no open plasmashell/Containment bug matches this trace.
> Closest relatives are 449981 (RESOLVED UPSTREAM, "Version Fixed In: 6.0"),
> 400835 (RESOLVED DUPLICATE) and 417552 (RESOLVED FIXED, systray teardown).
> This reproduces on 6.6.6, so it is either a regression of 449981 or a distinct
> sibling of the same destruction-order family.
---
## Summary
`plasmashell` crashes with SIGSEGV on **every** clean shutdown/restart.
2 out of 2 attempts, byte-identical stack (same offsets in every frame).
The shell is restarted by systemd and the session works normally afterwards,
so this is a **teardown-only** crash — but plasmashell never exits cleanly,
meaning the normal config-flush path is skipped.
## Steps to reproduce
1. Log into a Plasma 6.6.6 Wayland session.
2. Open the system tray popup at least once.
3. `systemctl --user restart plasma-plasmashell.service`
## Observed
```
plasma-plasmashell.service: Main process exited, code=dumped, status=11/SEGV
plasma-plasmashell.service: Failed with result 'core-dump'.
```
`coredumpctl` shows `SIGSEGV`, corefile size ~56 MB, `/usr/bin/plasmashell
--no-respawn`.
## Expected
plasmashell exits cleanly with status 0 on SIGTERM.
## Backtrace (thread 1, KCrash, Plasma 6.6.6 / Qt 6.10.2)
```
#0 __pthread_kill_implementation libc.so.6
#1 __GI_raise
#2 KCrash::defaultCrashHandler(int) libKF6Crash.so.6 + 0x8d8d
#3 __restore_rt
#4 QQuickWindow::maybeUpdate() libQt6Quick.so.6 + 0x2e06e4
#5 QQuickItemPrivate::derefWindow() libQt6Quick.so.6 + 0x20f7ee
#6 QQuickItem::setParentItem(QQuickItem*) libQt6Quick.so.6 + 0x211e4f
#7 QQuickItem::~QQuickItem() libQt6Quick.so.6 + 0x20683f
#8 (anonymous) libQt6QuickLayouts.so.6 +
0x376ec
#9 QObjectPrivate::deleteChildren() libQt6Core.so.6 + 0x1d9cec
#10 QObject::~QObject() libQt6Core.so.6 + 0x1e07f5
#11 (anonymous) libQt6Quick.so.6 + 0x4ae769
#12 QObjectPrivate::deleteChildren() libQt6Core.so.6 + 0x1d9cec
#13 QObject::~QObject() libQt6Core.so.6 + 0x1e07f5
#14 (anonymous) libQt6QuickLayouts.so.6 +
0x3797c
#15 QObjectPrivate::deleteChildren() libQt6Core.so.6 + 0x1d9cec
#16 QObject::~QObject() libQt6Core.so.6 + 0x1e07f5
#17 (anonymous) libQt6Quick.so.6 + 0x4b7da1
#18 QObjectPrivate::deleteChildren() libQt6Core.so.6 + 0x1d9cec
#19 QObject::~QObject() libQt6Core.so.6 + 0x1e07f5
#20 (anonymous) libQt6Quick.so.6 + 0x4b8171
#21 PlasmaQuick::AppletQuickItem::~AppletQuickItem() libPlasmaQuick.so.7 +
0x3aba4
#22 (anonymous) libplasmoidplugin.so +
0x8f21
#23 PlasmaQuick::SharedQmlEngine::~SharedQmlEngine() libPlasmaQuick.so.7 +
0x5bb98
#24 (anonymous) libPlasmaQuick.so.7 +
0x34094
#25 (anonymous) libQt6Core.so.6 + 0x1ea525
#26 Plasma::Applet::appletDeleted(Plasma::Applet*) libPlasma.so.7 + 0x236aa
#27 Plasma::Applet::~Applet() libPlasma.so.7 + 0x1b61a
#28 Plasma::Applet::~Applet() libPlasma.so.7 + 0x1b715
#29 QObjectPrivate::deleteChildren() libQt6Core.so.6 + 0x1d9cec
#30 QObject::~QObject() libQt6Core.so.6 + 0x1e07f5
#31 Plasma::Containment::~Containment() libPlasma.so.7 + 0x28fc5
#32 (anonymous) /usr/bin/plasmashell +
0x7fbe3
#33 (anonymous) /usr/bin/plasmashell +
0x3762b
#34 __libc_start_call_main
#35 __libc_start_main_impl
#36 (anonymous) /usr/bin/plasmashell +
0x37875
```
## Analysis
`QQuickItem::~QQuickItem()` calls `setParentItem(nullptr)`, which calls
`QQuickItemPrivate::derefWindow()`, which calls `QQuickWindow::maybeUpdate()`
on a
`QQuickWindow` that has **already been destroyed**. The applet's `QQuickWindow`
is freed
before the item tree that still holds a pointer to it.
The repeated `QObject::~QObject → deleteChildren → libQt6Quick →
QQuickItem::~QQuickItem`
blocks (frames 9–20) show a deep QML item tree being torn down inside
`PlasmaQuick::AppletQuickItem::~AppletQuickItem()`, which then reaches
`Plasma::Applet::appletDeleted()` / `Plasma::Containment::~Containment()`.
This is the *destructor* variant (`derefWindow` from `~QQuickItem`), while
449981's
canonical trace is the `QQuickItemPrivate::setEffectiveVisibleRecur` variant.
Given
449981 is marked "Version Fixed In: 6.0" and this reproduces on 6.6.6, treating
this as a
regression report rather than a duplicate seems right.
Note: this only reproduces when the system tray has been opened in the session,
which is
consistent with 417552's historical "crashes on teardown when system tray was
expanded".
## Reproduce-ability
100%. Confirmed twice back-to-back; both coredumps have identical frame
offsets.
## Environment
```
KDE Plasma: 6.6.6
plasma-workspace: 4:6.6.6-0ubuntu0.1
plasma-nm: 4:6.6.6-0ubuntu0.1
KDE Frameworks: 6.24.0
Qt: 6.10.2
libplasma: 6.6.6-0ubuntu0.1
OS: Ubuntu 26.04.1 LTS (Resolute Raccoon)
Kernel: 7.0.0-38-generic
Session: Wayland / KDE
GPU: AMD Radeon Vega (Cezanne), amdgpu
Mesa: 26.0.8-1ubuntu0.3
RAM: 15 GiB
```
--
You are receiving this mail because:
You are watching all bug changes.
