Bug 2216067

Summary:	plasmashell on Wayland crashed occasionally when playing Instagram story videos in Firefox
Product:	[Fedora] Fedora	Reporter:	Matt Fagnani <matt.fagnani>
Component:	plasma-workspace	Assignee:	KDE SIG <kde-sig>
Status:	CLOSED EOL	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	38	CC:	extras-qa, jgrulich, kde-sig, rdieter, than
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-05-22 14:09:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Matt Fagnani 2023-06-20 01:40:19 UTC

plasmashell crashed occasionally when playing Instagram story videos in Firefox Nightly on Wayland 116.0a1 and earlier in Plasma 5.27.5 on Wayland in Fedora 38. plasmashell crashed several times over the last few weeks when Firefox was finished showing one Instagram story and then started playing the next story which was a video. The panel disappeared from the bottom of the screen, and then it reappeared automatically. The last crash was with Firefox Nightly 116.0a1 (2023-06-19) on Wayland in Plasma 5.27.5. KCrash appeared to try to start drkonqi when the crashes happened according to the journal, but drkonqi never appeared.

Jun 19 18:16:05 plasmashell[1456]: file:///usr/share/plasma/plasmoids/org.kde.plasma.private.systemtray/contents/ui/items/PlasmoidItem.qml:125: TypeError: Cannot read property 'compactRepresentationItem' of null
Jun 19 18:16:05 plasmashell[1456]: KCrash: Application 'plasmashell' crashing...
Jun 19 18:16:05 plasmashell[1456]: KCrash: Attempting to start /usr/libexec/drkonqi
Jun 19 18:16:05 drkonqi[4122]: kf5idletime_wayland: This plugin does not support polling idle time
Jun 19 18:16:06 systemd[1251]: plasma-plasmashell.service: Main process exited, code=exited, status=253/n/a
Jun 19 18:16:06 systemd[1251]: plasma-plasmashell.service: Failed with result 'exit-code'.
Jun 19 18:16:06 systemd[1251]: plasma-plasmashell.service: Consumed 16.190s CPU time.
Jun 19 18:16:07 systemd[1251]: plasma-plasmashell.service: Scheduled restart job, restart counter is at 1.
Jun 19 18:16:07 systemd[1251]: Stopped plasma-plasmashell.service - KDE Plasma Workspace.
Jun 19 18:16:07 systemd[1251]: plasma-plasmashell.service: Consumed 16.190s CPU time.
Jun 19 18:16:07 systemd[1251]: Starting plasma-plasmashell.service - KDE Plasma Workspace...
Jun 19 18:16:07 systemd[1251]: Started plasma-plasmashell.service - KDE Plasma Workspace.
Jun 19 18:16:07 plasmashell[4140]: kf.plasma.quick: Applet preload policy set to 1

The error messages of the crashes weren't really informative, but they were the same each time. Such crashes probably happened about 1% or less of the Instagram story videos I've played in this way in the last few weeks.

These crashes happened with mesa-va-drivers-23.1.2-1.fc38.x86_64 installed which doesn't have h264 video hardware decoding support and with mesa-va-drivers-freeworld from RPM Fusion which has h264 hardware decoding support for AMD GPUs. When mesa-va-drivers-freeworld was installed, the journal showed the radeonsi video decoding library being loaded right before the crashes.

Reproducible: Sometimes

Steps to Reproduce:
1. Boot a Fedora 38 KDE Plasma installation updated to 2023-6-19 with updates-testing repo enabled
2. Log in to Plasma 5.27.5 on Wayland
3. Download Firefox Nightly from https://www.mozilla.org/en-US/firefox/channel/desktop/#nightly
4. Decompress the Firefox Nightly download
5. Run Firefox Nightly on Wayland
6. Log in to your Instagram account
7. Play stories from the top of the main feed of your Instagram account page until the crash happens. Playing hundreds of videos in stories might be needed to reproduce the crash.

Actual Results:
plasmashell on Wayland crashed occasionally when playing Instagram story videos in Firefox

Expected Results:
plasmashell wouldn't have crashed.

I reported this problem at https://bugs.kde.org/show_bug.cgi?id=471248 I could try to attach gdb to plasmashell and then try to reproduce the crash. I haven't tried that yet.

plasma-workspace-5.27.5-1.fc38.x86_64
kf5-plasma-5.107.0-1.fc38.x86_64
qt5-qtbase-5.15.10-1.fc38.x86_64

Comment 1 Tarry Brad 2023-10-19 07:12:28 UTC Comment hidden (spam)

This comment was flagged a spam, view the edit history to see the original text if required.

Comment 2 Matt Fagnani 2024-01-08 19:37:53 UTC

plasmashell crashed in this way at least twice with 5.27.9 and three times with 5.27.10. On the last such crash with 5.27.10, drkonqi appeared and showed a segmentation fault in plasmashell on its first page. drkonqi, gdb, kioslave, plasmashell were aborted by systemd while I was generating the trace after 40 s because /usr/lib/systemd/user/plasma-plasmashell.service had TimeoutSec=40sec due to the problem I reported at https://bugzilla.redhat.com/show_bug.cgi?id=2253725 https://bugs.kde.org/show_bug.cgi?id=478287 Those processes were aborted because Fedora services use the drop-in configuration file /usr/lib/systemd/user/service.d/10-timeout-abort.conf which had TimeoutStopFailureMode=abort. The default timeout of 40 s for plasma-plasmashell.service wasn't long enough for drkonqi and gdb to trace plasmashell when qt5 debuginfo packages were installed and report the crash. The crashes' core dumps weren't saved for viewing with coredumpctl so the crashes' information was lost.

Comment 3 Matt Fagnani 2024-01-10 04:18:48 UTC

I set TimeoutSec=1000sec in /usr/lib/systemd/user/plasma-plasmashell.service to work around the problem I reported in comment 2 and https://bugs.kde.org/show_bug.cgi?id=478287 Using Plasma 5.27.10 on Wayland with KF 5.113.0 and Qt 5.15.12, I attached gdb to plasmashell with gdb -p $(pidof plasmashell) I played Instagram story videos in Firefox 123.0a1 on Wayland. plasmashell crashed. I ran bt in gdb which then crashed. I reported the gdb crash at https://bugzilla.redhat.com/show_bug.cgi?id=2257562

Thread 1 "plasmashell" received signal SIGSEGV, Segmentation fault.
0x00007fe9f08b3a72 in __dynamic_cast () from /lib64/libstdc++.so.6
(gdb) bt
#0  0x00007fe9f08b3a72 in __dynamic_cast () at /lib64/libstdc++.so.6
#1  0x00007fe9f32b7200 in Plasma::DataContainer::getDataEngine() () at /lib64/libKF5Plasma.so.5


Fatal signal: Segmentation fault
----- Backtrace -----
0x559983a27140 gdb_internal_backtrace_1
        ../../gdb/bt-utils.c:122
0x559983a27140 _Z22gdb_internal_backtracev
        ../../gdb/bt-utils.c:168
0x559983b64252 handle_fatal_signal
        ../../gdb/event-top.c:895
0x559983b64429 handle_sigsegv
        ../../gdb/event-top.c:968
0x7f0426f6e99f ???
        /usr/src/debug/glibc-2.38-14.fc39.x86_64/signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x5599839f43e8 _ZNK5block5scopeEv
        ../../gdb/block.c:293
0x559983aab066 _Z26cp_lookup_transparent_typePKc
        ../../gdb/cp-namespace.c:1029
0x559983ba009c _Z13check_typedefP4type
        ../../gdb/gdbtypes.c:3052
0x559983d2601c _Z19type_to_type_objectP4type
        ../../gdb/python/py-type.c:1468
0x559983d274f3 convert_field
        ../../gdb/python/py-type.c:221
0x559983d27afe make_fielditem
        ../../gdb/python/py-type.c:275
0x559983d27afe typy_iterator_iternext
        ../../gdb/python/py-type.c:1440
0x7f04278339fb ???
        /usr/src/debug/python3.12-3.12.1-2.fc39.x86_64/Objects/listobject.c:944
0x7f04278470e0 ???
        /usr/src/debug/python3.12-3.12.1-2.fc39.x86_64/Objects/listobject.c:982
0x559983d26f0b typy_fields_items
        ../../gdb/python/py-type.c:311
0x7f042781ab19 ???
        /usr/src/debug/python3.12-3.12.1-2.fc39.x86_64/Objects/descrobject.c:454
0x7f042780abfb ???
        /usr/src/debug/python3.12-3.12.1-2.fc39.x86_64/Include/internal/pycore_call.h:92
0x7f042770f759 ???
        Python/bytecodes.c:2706
0x7f0427812cda ???
        /usr/src/debug/python3.12-3.12.1-2.fc39.x86_64/Include/internal/pycore_call.h:92
0x7f042788d08f ???
        /usr/src/debug/python3.12-3.12.1-2.fc39.x86_64/Objects/call.c:957
0x559983d19ca7 search_pp_list
        ../../gdb/python/py-prettyprint.c:83
0x559983d1a182 find_pretty_printer_from_objfiles
        ../../gdb/python/py-prettyprint.c:113
0x559983d1a182 find_pretty_printer
        ../../gdb/python/py-prettyprint.c:173
0x559983d1a647 _Z30gdbpy_apply_val_pretty_printerPK23extension_language_defnP5valueP7ui_fileiPK19value_print_optionsPK13language_defn
        ../../gdb/python/py-prettyprint.c:603
0x559983b6b748 _Z33apply_ext_lang_val_pretty_printerP5valueP7ui_fileiPK19value_print_optionsPK13language_defn
        ../../gdb/extension.c:489
0x559983f038e6 _Z16common_val_printP5valueP7ui_fileiPK19value_print_optionsPK13language_defn
        ../../gdb/valprint.c:1072
0x559983d0519e py_print_value
        ../../gdb/python/py-framefilter.c:251
0x559983d057cb py_print_single_arg
        ../../gdb/python/py-framefilter.c:397
0x559983d05dee enumerate_args
        ../../gdb/python/py-framefilter.c:488
0x559983d070dd py_print_args
        ../../gdb/python/py-framefilter.c:721
0x559983d070dd py_print_frame
        ../../gdb/python/py-framefilter.c:952
0x559983d087d2 _Z24gdbpy_apply_frame_filterPK23extension_language_defn14frame_info_ptr10enum_flagsI17frame_filter_flagE19ext_lang_frame_argsP6ui_outii
        ../../gdb/python/py-framefilter.c:1228
0x559983b6bf89 _Z27apply_ext_lang_frame_filter14frame_info_ptr10enum_flagsI17frame_filter_flagE19ext_lang_frame_argsP6ui_outii
        ../../gdb/extension.c:541
0x559983e0a166 backtrace_command_1
        ../../gdb/stack.c:2029
0x559983e0a166 backtrace_command
        ../../gdb/stack.c:2168
0x559983a63794 _Z8cmd_funcP16cmd_list_elementPKci
        ../../gdb/cli/cli-decode.c:2735
0x559983e73b24 _Z15execute_commandPKci
        ../../gdb/top.c:575
0x559983b64ab1 _Z15command_handlerPKc
        ../../gdb/event-top.c:555
0x559983b665a8 _Z20command_line_handlerOSt10unique_ptrIcN3gdb13xfree_deleterIcEEE
        ../../gdb/event-top.c:791
0x559983b65170 gdb_rl_callback_handler
        ../../gdb/event-top.c:260
0x7f0427eaf0dc ???
0x559983b652d5 gdb_rl_callback_read_char_wrapper_noexcept
        ../../gdb/event-top.c:196
0x559983b65487 gdb_rl_callback_read_char_wrapper
        ../../gdb/event-top.c:235
0x559983eb501f stdin_event_handler
        ../../gdb/ui.c:155
0x5599840e573d gdb_wait_for_event
        ../../gdbsupport/event-loop.cc:716
0x5599840e62f1 _Z16gdb_do_one_eventi
        ../../gdbsupport/event-loop.cc:264
0x559983c51b11 start_event_loop
        ../../gdb/main.c:407
0x559983c51b11 captured_command_loop
        ../../gdb/main.c:471
0x559983c54874 captured_main
        ../../gdb/main.c:1324
0x559983c54874 _Z8gdb_mainP18captured_main_args
        ../../gdb/main.c:1343
0x559983924baf main
        ../../gdb/gdb.c:47
---------------------
A fatal error internal to GDB has been detected, further
debugging is not possible.  GDB will now terminate.

This is a bug, please report it.  For instructions, see:
<https://www.gnu.org/software/gdb/bugs/>.

Segmentation fault (core dumped)

drkonqi appeared. I got the following trace of the plasmashell crash in  __cxxabiv1::__dynamic_cast. The functions below that looked like those in the plasmashell crash I reported at https://bugzilla.redhat.com/show_bug.cgi?id=2250389 https://bugs.kde.org/show_bug.cgi?id=477168 The trace seemed to involve the media player applet.

Application: Plasma (plasmashell), signal: Segmentation fault

[KCrash Handler]
#4  __cxxabiv1::__dynamic_cast (src_ptr=0x5600d9c83db0, src_type=0x7fe9f1168f70 <typeinfo for QObject>, dst_type=0x7fe9f3310ff0 <typeinfo for Plasma::DataEngine>, src2dst=0) at ../../../../libstdc++-v3/libsupc++/dyncast.cc:57
#5  0x00007fe9f32b7200 in Plasma::DataContainer::getDataEngine (this=this@entry=0x5600d9c83dc0) at /usr/src/debug/kf5-plasma-5.113.0-1.fc39.x86_64/src/plasma/datacontainer.cpp:206
#6  0x00007fe958025fed in MultiplexedService::activePlayerChanged (this=this@entry=0x5600d702e7c0, container=0x5600d9c83dc0) at /usr/src/debug/plasma-workspace-5.27.10-1.fc39.x86_64/dataengines/mpris2/multiplexedservice.cpp:58
#7  0x00007fe95802d1d8 in MultiplexedService::MultiplexedService (parent=<optimized out>, multiplexer=0x5600d968d760, this=0x5600d702e7c0) at /usr/src/debug/plasma-workspace-5.27.10-1.fc39.x86_64/dataengines/mpris2/multiplexedservice.cpp:25
#8  Mpris2Engine::serviceForSource (this=<optimized out>, source=<optimized out>) at /usr/src/debug/plasma-workspace-5.27.10-1.fc39.x86_64/dataengines/mpris2/mpris2engine.cpp:40
#9  0x00007fe9b421a130 in Plasma::DataSource::serviceForSource (source=..., this=0x5600d9c44420) at /usr/src/debug/kf5-plasma-5.113.0-1.fc39.x86_64/src/declarativeimports/core/datasource.cpp:208
#10 Plasma::DataSource::qt_static_metacall (_o=0x5600d9c44420, _c=QMetaObject::InvokeMetaMethod, _id=<optimized out>, _a=<optimized out>) at /usr/src/debug/kf5-plasma-5.113.0-1.fc39.x86_64/redhat-linux-build/src/declarativeimports/core/corebindingsplugin_autogen/include/moc_datasource.cpp:201
#11 0x00007fe9b421b922 in Plasma::DataSource::qt_metacall (this=0x5600d9c44420, _c=QMetaObject::InvokeMetaMethod, _id=16, _a=0x7ffdef4fb370) at /usr/src/debug/kf5-plasma-5.113.0-1.fc39.x86_64/redhat-linux-build/src/declarativeimports/core/corebindingsplugin_autogen/include/moc_datasource.cpp:370
#12 0x00007fe9f26f536a in QQmlObjectOrGadget::metacall (this=this@entry=0x7ffdef4fb610, type=type@entry=QMetaObject::InvokeMetaMethod, index=<optimized out>, index@entry=21, argv=<optimized out>) at qml/qqmlobjectorgadget.cpp:51
#13 0x00007fe9f25c7cd3 in CallMethod (callType=<optimized out>, callArgs=0x7ffdef4fb370, engine=<optimized out>, argTypes=<optimized out>, argCount=<optimized out>, returnType=<optimized out>, index=<optimized out>, object=...) at /usr/include/qt5/QtCore/qvarlengtharray.h:189
#14 CallPrecise (object=..., data=<optimized out>, engine=engine@entry=0x5600d6699500, callArgs=callArgs@entry=0x7fe9c4269588, callType=callType@entry=QMetaObject::InvokeMetaMethod) at jsruntime/qv4qobjectwrapper.cpp:1553
#15 0x00007fe9f25c9ad2 in CallOverloaded (callType=<optimized out>, propertyCache=<optimized out>, callArgs=<optimized out>, engine=<optimized out>, data=<optimized out>, object=<optimized out>) at jsruntime/qv4qobjectwrapper.cpp:1629
#16 QV4::QObjectMethod::callInternal (this=<optimized out>, thisObject=<optimized out>, argv=<optimized out>, argc=<optimized out>) at jsruntime/qv4qobjectwrapper.cpp:2117
#17 0x00007fe9f25fa581 in QV4::FunctionObject::call (argc=1, argv=0x7fe9c4269550, thisObject=0x7fe9c4269538, this=0x7ffdef4fb738) at jsruntime/qv4functionobject_p.h:202
#18 QV4::Runtime::CallPropertyLookup::call (engine=0x5600d6699500, base=..., index=<optimized out>, argv=0x7fe9c4269550, argc=1) at jsruntime/qv4runtime.cpp:1460
#19 0x00007fe9348c038f in ??? ()
#20 0x0000000000000000 in ??? ()
[Inferior 1 (process 46516) detached]

Comment 4 Aoife Moloney 2024-05-22 14:09:08 UTC

Fedora Linux 38 entered end-of-life (EOL) status on 2024-05-21.

Fedora Linux 38 is no longer maintained, which means that it
will not receive any further security or bug fix updates. As a result we
are closing this bug.

If you can reproduce this bug against a currently maintained version of Fedora Linux
please feel free to reopen this bug against that version. Note that the version
field may be hidden. Click the "Show advanced fields" button if you do not see
the version field.

If you are unable to reopen this bug, please file a new report against an
active release.

Thank you for reporting this bug and we are sorry it could not be fixed.