Bug 1733712

Summary: Segmentation faults in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4 when closing falkon involving not saving history and showing the menu bar
Product: [Fedora] Fedora Reporter: Matt Fagnani <matt.fagnani>
Component: falkonAssignee: Kevin Kofler <kevin>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 31CC: kevin
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-24 17:29:01 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
drkonqi gdb trace of segmentation fault when closing falkon
none
valgrind log when run on falkon showing invalid reads and writes none

Description Matt Fagnani 2019-07-27 20:19:39 UTC 
Created attachment 1593892 [details]
drkonqi gdb trace of segmentation fault when closing falkon

Description of problem:

I booted into Fedora 30 and rawhide/31 KDE Plasma spin and start Plasma on Wayland. I started falkon 3.1.0-1, and in Preferences>Browsing>Local storage I set Allow storing network cache on disk, Allowing saving history, Allow local storage of HTML5 web content to off. I selected OK. I set View>Toolbars>Menu bar to on. I closed falkon. drkonqi showed that a segmentation fault had occurred in  in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4 with the following trace in the crashing thread 1 which occurred in rawhide. falkon might have been clearing the history which I set to not be saved given the History::clearHistory function (this=0x0) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/history/history.cpp:255 in #9 of the crashing thread.

Thread 1 (Thread 0x7fe2cb117800 (LWP 17899)):
[KCrash Handler]
#6  qGetPtrHelper<QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> > > (ptr=...) at ../../include/QtCore/../../src/corelib/global/qglobal.h:1038
#7  QObject::d_func (this=0x0) at kernel/qobject.h:121
#8  QMetaObject::activate (sender=0x0, signalOffset=3, local_signal_index=3, argv=0x0) at kernel/qobject.cpp:3664
#9  0x00007fe2cc74f962 in History::clearHistory (this=0x0) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/history/history.cpp:255
#10 0x00007fe2cc6f5ef9 in MainApplication::saveSettings (this=0x7ffc6ea63680) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/app/mainapplication.cpp:803
#11 0x00007fe2cbc60ea0 in QtPrivate::QSlotObjectBase::call (a=0x7ffc6ea63550, r=0x7ffc6ea63680, this=0x55edf42d6320) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:394
#12 QMetaObject::activate (sender=0x7ffc6ea63680, signalOffset=<optimized out>, local_signal_index=<optimized out>, argv=<optimized out>) at kernel/qobject.cpp:3781
#13 0x00007fe2cbc35edb in QCoreApplication::aboutToQuit (this=<optimized out>, _t1=...) at .moc/moc_qcoreapplication.cpp:253
#14 0x00007fe2cbc39ed1 in QCoreApplicationPrivate::execCleanup (this=0x55edf05ff2b0) at kernel/qcoreapplication_p.h:78
#15 0x00007fe2cbc3d71f in QCoreApplication::exec () at kernel/qcoreapplication.h:86
#16 0x000055edeec36ef9 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/main/main.cpp:155
[Inferior 1 (process 17899) detached]

I ran valgrind --log-file=/mnt/root/programs/kde/falkon/valgrind-falkon-f31-4.txt falkon & then I closed falkon. An invalid read and write were found in
wl_proxy_unref at wayland-client.c:229-230 after closing falkon which appear to be use-after-free errors.

==17976== Invalid read of size 4
==17976==    at 0x11C6FBB4: wl_proxy_unref (wayland-client.c:229)
==17976==    by 0x11C6FCB3: destroy_queued_closure (wayland-client.c:291)
==17976==    by 0x11C6FEC7: dispatch_event.isra.0 (wayland-client.c:1436)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==  Address 0x116ac0bc is 44 bytes inside a block of size 72 free'd
==17976==    at 0x4839A0C: free (vg_replace_malloc.c:540)
==17976==    by 0x120B1C14: destroy (wayland_pointer_p.h:63)
==17976==    by 0x120B1C14: KWayland::Client::Registry::Private::globalSync(void*, wl_callback*, unsigned int) (registry.cpp:539)
==17976==    by 0x11CC4AA7: ffi_call_unix64 (unix64.S:76)
==17976==    by 0x11CC42A3: ffi_call (ffi64.c:525)
==17976==    by 0x11C73606: wl_closure_invoke (connection.c:1014)
==17976==    by 0x11C6FF17: dispatch_event.isra.0 (wayland-client.c:1430)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==  Block was alloc'd at
==17976==    at 0x483AB1A: calloc (vg_replace_malloc.c:762)
==17976==    by 0x11C6FD42: UnknownInlinedFun (wayland-private.h:236)
==17976==    by 0x11C6FD42: proxy_create.isra.0 (wayland-client.c:421)
==17976==    by 0x11C7042B: create_outgoing_proxy (wayland-client.c:650)
==17976==    by 0x11C7042B: wl_proxy_marshal_array_constructor_versioned (wayland-client.c:735)
==17976==    by 0x11C70782: wl_proxy_marshal_constructor (wayland-client.c:824)
==17976==    by 0x120B20BD: wl_display_sync (wayland-client-protocol.h:958)
==17976==    by 0x120B20BD: KWayland::Client::Registry::create(wl_display*) (registry.cpp:470)
==17976==    by 0x120B213A: KWayland::Client::Registry::create(KWayland::Client::ConnectionThread*) (registry.cpp:479)
==17976==    by 0x11D06E6D: KWaylandIntegration::init() (kwaylandintegration.cpp:55)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976== 
==17976== Invalid write of size 4
==17976==    at 0x11C6FBBE: wl_proxy_unref (wayland-client.c:230)
==17976==    by 0x11C6FCB3: destroy_queued_closure (wayland-client.c:291)
==17976==    by 0x11C6FEC7: dispatch_event.isra.0 (wayland-client.c:1436)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==  Address 0x116ac0bc is 44 bytes inside a block of size 72 free'd
==17976==    at 0x4839A0C: free (vg_replace_malloc.c:540)
==17976==    by 0x120B1C14: destroy (wayland_pointer_p.h:63)
==17976==    by 0x120B1C14: KWayland::Client::Registry::Private::globalSync(void*, wl_callback*, unsigned int) (registry.cpp:539)
==17976==    by 0x11CC4AA7: ffi_call_unix64 (unix64.S:76)
==17976==    by 0x11CC42A3: ffi_call (ffi64.c:525)
==17976==    by 0x11C73606: wl_closure_invoke (connection.c:1014)
==17976==    by 0x11C6FF17: dispatch_event.isra.0 (wayland-client.c:1430)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==  Block was alloc'd at
==17976==    at 0x483AB1A: calloc (vg_replace_malloc.c:762)
==17976==    by 0x11C6FD42: UnknownInlinedFun (wayland-private.h:236)
==17976==    by 0x11C6FD42: proxy_create.isra.0 (wayland-client.c:421)
==17976==    by 0x11C7042B: create_outgoing_proxy (wayland-client.c:650)
==17976==    by 0x11C7042B: wl_proxy_marshal_array_constructor_versioned (wayland-client.c:735)
==17976==    by 0x11C70782: wl_proxy_marshal_constructor (wayland-client.c:824)
==17976==    by 0x120B20BD: wl_display_sync (wayland-client-protocol.h:958)
==17976==    by 0x120B20BD: KWayland::Client::Registry::create(wl_display*) (registry.cpp:470)
==17976==    by 0x120B213A: KWayland::Client::Registry::create(KWayland::Client::ConnectionThread*) (registry.cpp:479)
==17976==    by 0x11D06E6D: KWaylandIntegration::init() (kwaylandintegration.cpp:55)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976== 

An ioctl system call pointed to the uninaccessible address 0x3d at syscall-template.S:78. The address might've been due to memory corruption.

==17976== Syscall param ioctl(generic) points to unaddressable byte(s)
==17976==    at 0x5B4B07B: ioctl (syscall-template.S:78)
==17976==    by 0x554EE42: QFileSystemEngine::cloneFile(int, int, QFileSystemMetaData const&) (qfilesystemengine_unix.cpp:1097)
==17976==    by 0x54F0C50: QFile::copy(QString const&) (qfile.cpp:813)
==17976==    by 0x54F1366: QFile::copy(QString const&, QString const&) (qfile.cpp:881)
==17976==    by 0x4AF31E6: SessionManager::backupSavedSessions() (sessionmanager.cpp:355)
==17976==    by 0x49C7DCB: MainApplication::MainApplication(int&, char**) (mainapplication.cpp:342)
==17976==    by 0x10BEC7: main (main.cpp:148)
==17976==  Address 0x3d is not stack'd, malloc'd or (recently) free'd


An invalid read was shown in qGetPtrHelper at qglobal.h:1038 at the inaccessible address 0x8 which looked like that of the crashing thread.
==17976== Invalid read of size 8
==17976==    at 0x55CB6EE: qGetPtrHelper<QScopedPointer<QObjectData> > (qglobal.h:1038)
==17976==    by 0x55CB6EE: d_func (qobject.h:121)
==17976==    by 0x55CB6EE: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3664)
==17976==    by 0x4A1A961: History::clearHistory() (history.cpp:255)
==17976==    by 0x49C0EF8: MainApplication::saveSettings() [clone .part.0] (mainapplication.cpp:803)
==17976==    by 0x55CBE9F: call (qobjectdefs_impl.h:394)
==17976==    by 0x55CBE9F: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3781)
==17976==    by 0x55A0EDA: QCoreApplication::aboutToQuit(QCoreApplication::QPrivateSignal) (moc_qcoreapplication.cpp:253)
==17976==    by 0x55A4ED0: QCoreApplicationPrivate::execCleanup() (qcoreapplication.cpp:1405)
==17976==    by 0x55A871E: QCoreApplication::exec() (qcoreapplication.cpp:1389)
==17976==    by 0x10BEF8: main (main.cpp:155)
==17976==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

Two invalid reads in socketNotifierSourceCheck at qeventdispatcher_glib.cpp:88 which looked like use-after-free errors occurred afterwards. The addresses were freed by QSocketNotifier::setEnabled at qsocketnotifier.cpp:246.

==17976== Thread 10 QDBusConnectionM:
==17976== Invalid read of size 2
==17976==    at 0x55F6A4A: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==    by 0x5B54332: clone (clone.S:95)
==17976==  Address 0x1e2c0446 is 6 bytes inside a block of size 16 free'd
==17976==    at 0x483A0D6: operator delete(void*, unsigned long) (vg_replace_malloc.c:595)
==17976==    by 0x55D8172: QSocketNotifier::setEnabled(bool) (qsocketnotifier.cpp:246)
==17976==    by 0x55F6A49: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==  Block was alloc'd at
==17976==    at 0x4838E86: operator new(unsigned long) (vg_replace_malloc.c:344)
==17976==    by 0x55F7166: QEventDispatcherGlib::registerSocketNotifier(QSocketNotifier*) (qeventdispatcher_glib.cpp:459)
==17976==    by 0x55D8074: QSocketNotifier::QSocketNotifier(long long, QSocketNotifier::Type, QObject*) (qsocketnotifier.cpp:155)
==17976==    by 0x6076A50: qDBusAddWatch (qdbusintegrator.cpp:213)
==17976==    by 0xE992829: _dbus_watch_list_set_functions (dbus-watch.c:321)
==17976==    by 0xE977A60: dbus_connection_set_watch_functions (dbus-connection.c:4966)
==17976==    by 0x60798D5: q_dbus_connection_set_watch_functions (qdbus_symbols_p.h:242)
==17976==    by 0x60798D5: QDBusConnectionPrivate::setConnection(DBusConnection*, QDBusErrorInternal const&) (qdbusintegrator.cpp:1795)
==17976==    by 0x606D38F: QDBusConnectionManager::executeConnectionRequest(QDBusConnectionManager::ConnectionRequestData*) (qdbusconnection.cpp:289)
==17976==    by 0x55CCBD9: QObject::event(QEvent*) (qobject.cpp:1260)
==17976==    by 0x55A1A44: doNotify(QObject*, QEvent*) (qcoreapplication.cpp:1174)
==17976==    by 0x55A1B50: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1083)
==17976==    by 0x55A4A7A: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1821)
==17976== 
==17976== Invalid read of size 2
==17976==    at 0x55F69C6: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:79)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==    by 0x5B54332: clone (clone.S:95)
==17976==  Address 0x1e2c0444 is 4 bytes inside a block of size 16 free'd
==17976==    at 0x483A0D6: operator delete(void*, unsigned long) (vg_replace_malloc.c:595)
==17976==    by 0x55D8172: QSocketNotifier::setEnabled(bool) (qsocketnotifier.cpp:246)
==17976==    by 0x55F6A49: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==  Block was alloc'd at
==17976==    at 0x4838E86: operator new(unsigned long) (vg_replace_malloc.c:344)
==17976==    by 0x55F7166: QEventDispatcherGlib::registerSocketNotifier(QSocketNotifier*) (qeventdispatcher_glib.cpp:459)
==17976==    by 0x55D8074: QSocketNotifier::QSocketNotifier(long long, QSocketNotifier::Type, QObject*) (qsocketnotifier.cpp:155)
==17976==    by 0x6076A50: qDBusAddWatch (qdbusintegrator.cpp:213)
==17976==    by 0xE992829: _dbus_watch_list_set_functions (dbus-watch.c:321)
==17976==    by 0xE977A60: dbus_connection_set_watch_functions (dbus-connection.c:4966)
==17976==    by 0x60798D5: q_dbus_connection_set_watch_functions (qdbus_symbols_p.h:242)
==17976==    by 0x60798D5: QDBusConnectionPrivate::setConnection(DBusConnection*, QDBusErrorInternal const&) (qdbusintegrator.cpp:1795)
==17976==    by 0x606D38F: QDBusConnectionManager::executeConnectionRequest(QDBusConnectionManager::ConnectionRequestData*) (qdbusconnection.cpp:289)
==17976==    by 0x55CCBD9: QObject::event(QEvent*) (qobject.cpp:1260)
==17976==    by 0x55A1A44: doNotify(QObject*, QEvent*) (qcoreapplication.cpp:1174)
==17976==    by 0x55A1B50: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1083)
==17976==    by 0x55A4A7A: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1821)
==17976== 

I've reproduced crashes with this trace twice in Fedora 30 and 10 times in rawhide. The output above and attached were on rawhide with the following rpms.
The steps to reproduce are for F30 since it took a few more steps to install and start plasma on wayland in rawhide.

Version-Release number of selected component (if applicable):
falkon-0:3.1.0-1.fc31.x86_64
dbus-1:1.12.16-1.fc31.x86_64
glib2-0:2.61.1-2.fc31.x86_64
glibc-0:2.29.9000-34.fc31.x86_64
kernel-0:5.3.0-0.rc1.git1.1.fc31.x86_64
kf5-kwayland-0:5.59.0-2.fc31.x86_64
mesa-dri-drivers-0:19.1.3-1.fc31.x86_64
plasma-desktop-0:5.16.2-1.fc31.x86_64
qt5-qtbase-0:5.12.4-5.fc31.x86_64
qt5-qtwebengine-0:5.12.4-5.fc31.x86_64

How reproducible:
The crashes occurred 2 times on F30 and 10 times on rawhide which were most of the time I closed falkon with the history and menu bar setting I mentioned.

Steps to Reproduce:
1. boot into the Fedora 30 KDE Plasma spin installation fully updated with updates-testing enabled
2. start Plasma on Wayland from sddm
3. started falkon 3.1.0-1
4. in Preferences>Browsing>Local storage, set Allow storing network cache on disk, Allowing saving history, Allow local storage of HTML5 web content to off. 5. selected OK. 
6. set View>Toolbars>Menu bar to on. 
7. close falkon

Actual results:
Segmentation faults in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4 when closing falkon involving not saving history and showing the menu bar 


Expected results:
No crashes would happen.

Additional info:

After starting falkon again after the crashes, in Preferences>Browsing>Local storage Delete locally stored HTML5 web content on close was set to on even though Allow local storage of HTML5 web content was set to off. This combination of settings didn't appear to be allowed before that point.

I've reported invalid reads and writes in wl_proxy_unref when closing the following KDE programs in Plasma on Wayland 
powerdevil https://bugs.kde.org/show_bug.cgi?id=408553
konsole https://bugs.kde.org/show_bug.cgi?id=408971
kwin_wayland https://bugs.kde.org/show_bug.cgi?id=409688
plasmashell https://bugs.kde.org/show_bug.cgi?id=409021

I reported this problem at https://bugs.kde.org/show_bug.cgi?id=410290
Comment 1 Matt Fagnani 2019-07-27 20:20:23 UTC 
Created attachment 1593893 [details]
valgrind log when run on falkon showing invalid reads and writes
Comment 2 Ben Cotton 2019-08-13 17:04:17 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to '31'.
Comment 3 Ben Cotton 2019-08-13 18:53:48 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to 31.
Comment 4 Ben Cotton 2020-11-03 15:21:22 UTC 
This message is a reminder that Fedora 31 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 31 on 2020-11-24.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '31'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 31 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 5 Ben Cotton 2020-11-24 17:29:01 UTC 
Fedora 31 changed to end-of-life (EOL) status on 2020-11-24. Fedora 31 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.