Bug 1733712 - Segmentation faults in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4 when closing falkon involving not saving history and showing the menu bar
Summary: Segmentation faults in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: falkon
Version: 31
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kevin Kofler
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-27 20:19 UTC by Matt Fagnani
Modified: 2019-08-13 18:53 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)
drkonqi gdb trace of segmentation fault when closing falkon (35.65 KB, text/plain)
2019-07-27 20:19 UTC, Matt Fagnani
no flags Details
valgrind log when run on falkon showing invalid reads and writes (18.34 KB, text/plain)
2019-07-27 20:20 UTC, Matt Fagnani
no flags Details


Links
System ID Priority Status Summary Last Updated
KDE Software Compilation 410290 None None None 2019-07-27 20:19:39 UTC

Description Matt Fagnani 2019-07-27 20:19:39 UTC
Created attachment 1593892 [details]
drkonqi gdb trace of segmentation fault when closing falkon

Description of problem:

I booted into Fedora 30 and rawhide/31 KDE Plasma spin and start Plasma on Wayland. I started falkon 3.1.0-1, and in Preferences>Browsing>Local storage I set Allow storing network cache on disk, Allowing saving history, Allow local storage of HTML5 web content to off. I selected OK. I set View>Toolbars>Menu bar to on. I closed falkon. drkonqi showed that a segmentation fault had occurred in  in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4 with the following trace in the crashing thread 1 which occurred in rawhide. falkon might have been clearing the history which I set to not be saved given the History::clearHistory function (this=0x0) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/history/history.cpp:255 in #9 of the crashing thread.

Thread 1 (Thread 0x7fe2cb117800 (LWP 17899)):
[KCrash Handler]
#6  qGetPtrHelper<QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> > > (ptr=...) at ../../include/QtCore/../../src/corelib/global/qglobal.h:1038
#7  QObject::d_func (this=0x0) at kernel/qobject.h:121
#8  QMetaObject::activate (sender=0x0, signalOffset=3, local_signal_index=3, argv=0x0) at kernel/qobject.cpp:3664
#9  0x00007fe2cc74f962 in History::clearHistory (this=0x0) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/history/history.cpp:255
#10 0x00007fe2cc6f5ef9 in MainApplication::saveSettings (this=0x7ffc6ea63680) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/lib/app/mainapplication.cpp:803
#11 0x00007fe2cbc60ea0 in QtPrivate::QSlotObjectBase::call (a=0x7ffc6ea63550, r=0x7ffc6ea63680, this=0x55edf42d6320) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:394
#12 QMetaObject::activate (sender=0x7ffc6ea63680, signalOffset=<optimized out>, local_signal_index=<optimized out>, argv=<optimized out>) at kernel/qobject.cpp:3781
#13 0x00007fe2cbc35edb in QCoreApplication::aboutToQuit (this=<optimized out>, _t1=...) at .moc/moc_qcoreapplication.cpp:253
#14 0x00007fe2cbc39ed1 in QCoreApplicationPrivate::execCleanup (this=0x55edf05ff2b0) at kernel/qcoreapplication_p.h:78
#15 0x00007fe2cbc3d71f in QCoreApplication::exec () at kernel/qcoreapplication.h:86
#16 0x000055edeec36ef9 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/falkon-3.1.0-1.fc31.x86_64/src/main/main.cpp:155
[Inferior 1 (process 17899) detached]

I ran valgrind --log-file=/mnt/root/programs/kde/falkon/valgrind-falkon-f31-4.txt falkon & then I closed falkon. An invalid read and write were found in
wl_proxy_unref at wayland-client.c:229-230 after closing falkon which appear to be use-after-free errors.

==17976== Invalid read of size 4
==17976==    at 0x11C6FBB4: wl_proxy_unref (wayland-client.c:229)
==17976==    by 0x11C6FCB3: destroy_queued_closure (wayland-client.c:291)
==17976==    by 0x11C6FEC7: dispatch_event.isra.0 (wayland-client.c:1436)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==  Address 0x116ac0bc is 44 bytes inside a block of size 72 free'd
==17976==    at 0x4839A0C: free (vg_replace_malloc.c:540)
==17976==    by 0x120B1C14: destroy (wayland_pointer_p.h:63)
==17976==    by 0x120B1C14: KWayland::Client::Registry::Private::globalSync(void*, wl_callback*, unsigned int) (registry.cpp:539)
==17976==    by 0x11CC4AA7: ffi_call_unix64 (unix64.S:76)
==17976==    by 0x11CC42A3: ffi_call (ffi64.c:525)
==17976==    by 0x11C73606: wl_closure_invoke (connection.c:1014)
==17976==    by 0x11C6FF17: dispatch_event.isra.0 (wayland-client.c:1430)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==  Block was alloc'd at
==17976==    at 0x483AB1A: calloc (vg_replace_malloc.c:762)
==17976==    by 0x11C6FD42: UnknownInlinedFun (wayland-private.h:236)
==17976==    by 0x11C6FD42: proxy_create.isra.0 (wayland-client.c:421)
==17976==    by 0x11C7042B: create_outgoing_proxy (wayland-client.c:650)
==17976==    by 0x11C7042B: wl_proxy_marshal_array_constructor_versioned (wayland-client.c:735)
==17976==    by 0x11C70782: wl_proxy_marshal_constructor (wayland-client.c:824)
==17976==    by 0x120B20BD: wl_display_sync (wayland-client-protocol.h:958)
==17976==    by 0x120B20BD: KWayland::Client::Registry::create(wl_display*) (registry.cpp:470)
==17976==    by 0x120B213A: KWayland::Client::Registry::create(KWayland::Client::ConnectionThread*) (registry.cpp:479)
==17976==    by 0x11D06E6D: KWaylandIntegration::init() (kwaylandintegration.cpp:55)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976== 
==17976== Invalid write of size 4
==17976==    at 0x11C6FBBE: wl_proxy_unref (wayland-client.c:230)
==17976==    by 0x11C6FCB3: destroy_queued_closure (wayland-client.c:291)
==17976==    by 0x11C6FEC7: dispatch_event.isra.0 (wayland-client.c:1436)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==  Address 0x116ac0bc is 44 bytes inside a block of size 72 free'd
==17976==    at 0x4839A0C: free (vg_replace_malloc.c:540)
==17976==    by 0x120B1C14: destroy (wayland_pointer_p.h:63)
==17976==    by 0x120B1C14: KWayland::Client::Registry::Private::globalSync(void*, wl_callback*, unsigned int) (registry.cpp:539)
==17976==    by 0x11CC4AA7: ffi_call_unix64 (unix64.S:76)
==17976==    by 0x11CC42A3: ffi_call (ffi64.c:525)
==17976==    by 0x11C73606: wl_closure_invoke (connection.c:1014)
==17976==    by 0x11C6FF17: dispatch_event.isra.0 (wayland-client.c:1430)
==17976==    by 0x11C7146B: dispatch_queue (wayland-client.c:1576)
==17976==    by 0x11C7146B: wl_display_dispatch_queue_pending (wayland-client.c:1818)
==17976==    by 0x11C718AA: wl_display_roundtrip_queue (wayland-client.c:1241)
==17976==    by 0x1209AB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290)
==17976==    by 0x11D06EE9: KWaylandIntegration::init() (kwaylandintegration.cpp:67)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==  Block was alloc'd at
==17976==    at 0x483AB1A: calloc (vg_replace_malloc.c:762)
==17976==    by 0x11C6FD42: UnknownInlinedFun (wayland-private.h:236)
==17976==    by 0x11C6FD42: proxy_create.isra.0 (wayland-client.c:421)
==17976==    by 0x11C7042B: create_outgoing_proxy (wayland-client.c:650)
==17976==    by 0x11C7042B: wl_proxy_marshal_array_constructor_versioned (wayland-client.c:735)
==17976==    by 0x11C70782: wl_proxy_marshal_constructor (wayland-client.c:824)
==17976==    by 0x120B20BD: wl_display_sync (wayland-client-protocol.h:958)
==17976==    by 0x120B20BD: KWayland::Client::Registry::create(wl_display*) (registry.cpp:470)
==17976==    by 0x120B213A: KWayland::Client::Registry::create(KWayland::Client::ConnectionThread*) (registry.cpp:479)
==17976==    by 0x11D06E6D: KWaylandIntegration::init() (kwaylandintegration.cpp:55)
==17976==    by 0x11CECFA0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84)
==17976==    by 0x11D0965A: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37)
==17976==    by 0xD684418: ??? (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD683DB5: QPlatformThemeFactory::create(QString const&, QString const&) (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976==    by 0xD68C847: QGuiApplicationPrivate::createPlatformIntegration() (in /usr/lib64/libQt5Gui.so.5.12.4)
==17976== 

An ioctl system call pointed to the uninaccessible address 0x3d at syscall-template.S:78. The address might've been due to memory corruption.

==17976== Syscall param ioctl(generic) points to unaddressable byte(s)
==17976==    at 0x5B4B07B: ioctl (syscall-template.S:78)
==17976==    by 0x554EE42: QFileSystemEngine::cloneFile(int, int, QFileSystemMetaData const&) (qfilesystemengine_unix.cpp:1097)
==17976==    by 0x54F0C50: QFile::copy(QString const&) (qfile.cpp:813)
==17976==    by 0x54F1366: QFile::copy(QString const&, QString const&) (qfile.cpp:881)
==17976==    by 0x4AF31E6: SessionManager::backupSavedSessions() (sessionmanager.cpp:355)
==17976==    by 0x49C7DCB: MainApplication::MainApplication(int&, char**) (mainapplication.cpp:342)
==17976==    by 0x10BEC7: main (main.cpp:148)
==17976==  Address 0x3d is not stack'd, malloc'd or (recently) free'd


An invalid read was shown in qGetPtrHelper at qglobal.h:1038 at the inaccessible address 0x8 which looked like that of the crashing thread.
==17976== Invalid read of size 8
==17976==    at 0x55CB6EE: qGetPtrHelper<QScopedPointer<QObjectData> > (qglobal.h:1038)
==17976==    by 0x55CB6EE: d_func (qobject.h:121)
==17976==    by 0x55CB6EE: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3664)
==17976==    by 0x4A1A961: History::clearHistory() (history.cpp:255)
==17976==    by 0x49C0EF8: MainApplication::saveSettings() [clone .part.0] (mainapplication.cpp:803)
==17976==    by 0x55CBE9F: call (qobjectdefs_impl.h:394)
==17976==    by 0x55CBE9F: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3781)
==17976==    by 0x55A0EDA: QCoreApplication::aboutToQuit(QCoreApplication::QPrivateSignal) (moc_qcoreapplication.cpp:253)
==17976==    by 0x55A4ED0: QCoreApplicationPrivate::execCleanup() (qcoreapplication.cpp:1405)
==17976==    by 0x55A871E: QCoreApplication::exec() (qcoreapplication.cpp:1389)
==17976==    by 0x10BEF8: main (main.cpp:155)
==17976==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

Two invalid reads in socketNotifierSourceCheck at qeventdispatcher_glib.cpp:88 which looked like use-after-free errors occurred afterwards. The addresses were freed by QSocketNotifier::setEnabled at qsocketnotifier.cpp:246.

==17976== Thread 10 QDBusConnectionM:
==17976== Invalid read of size 2
==17976==    at 0x55F6A4A: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==    by 0x5B54332: clone (clone.S:95)
==17976==  Address 0x1e2c0446 is 6 bytes inside a block of size 16 free'd
==17976==    at 0x483A0D6: operator delete(void*, unsigned long) (vg_replace_malloc.c:595)
==17976==    by 0x55D8172: QSocketNotifier::setEnabled(bool) (qsocketnotifier.cpp:246)
==17976==    by 0x55F6A49: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==  Block was alloc'd at
==17976==    at 0x4838E86: operator new(unsigned long) (vg_replace_malloc.c:344)
==17976==    by 0x55F7166: QEventDispatcherGlib::registerSocketNotifier(QSocketNotifier*) (qeventdispatcher_glib.cpp:459)
==17976==    by 0x55D8074: QSocketNotifier::QSocketNotifier(long long, QSocketNotifier::Type, QObject*) (qsocketnotifier.cpp:155)
==17976==    by 0x6076A50: qDBusAddWatch (qdbusintegrator.cpp:213)
==17976==    by 0xE992829: _dbus_watch_list_set_functions (dbus-watch.c:321)
==17976==    by 0xE977A60: dbus_connection_set_watch_functions (dbus-connection.c:4966)
==17976==    by 0x60798D5: q_dbus_connection_set_watch_functions (qdbus_symbols_p.h:242)
==17976==    by 0x60798D5: QDBusConnectionPrivate::setConnection(DBusConnection*, QDBusErrorInternal const&) (qdbusintegrator.cpp:1795)
==17976==    by 0x606D38F: QDBusConnectionManager::executeConnectionRequest(QDBusConnectionManager::ConnectionRequestData*) (qdbusconnection.cpp:289)
==17976==    by 0x55CCBD9: QObject::event(QEvent*) (qobject.cpp:1260)
==17976==    by 0x55A1A44: doNotify(QObject*, QEvent*) (qcoreapplication.cpp:1174)
==17976==    by 0x55A1B50: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1083)
==17976==    by 0x55A4A7A: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1821)
==17976== 
==17976== Invalid read of size 2
==17976==    at 0x55F69C6: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:79)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==    by 0x5B54332: clone (clone.S:95)
==17976==  Address 0x1e2c0444 is 4 bytes inside a block of size 16 free'd
==17976==    at 0x483A0D6: operator delete(void*, unsigned long) (vg_replace_malloc.c:595)
==17976==    by 0x55D8172: QSocketNotifier::setEnabled(bool) (qsocketnotifier.cpp:246)
==17976==    by 0x55F6A49: socketNotifierSourceCheck(_GSource*) (qeventdispatcher_glib.cpp:88)
==17976==    by 0xE278D40: g_main_context_check (gmain.c:3764)
==17976==    by 0xE279291: g_main_context_iterate.isra.0 (gmain.c:3928)
==17976==    by 0xE279422: g_main_context_iteration (gmain.c:3992)
==17976==    by 0x55F6BB4: QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (qeventdispatcher_glib.cpp:422)
==17976==    by 0x55A09DA: QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (qeventloop.cpp:225)
==17976==    by 0x53F9624: QThread::exec() (qthread.cpp:531)
==17976==    by 0x606AF49: QDBusConnectionManager::run() (qdbusconnection.cpp:178)
==17976==    by 0x53FA775: QThreadPrivate::start(void*) (qthread_unix.cpp:361)
==17976==    by 0xDABD4E1: start_thread (pthread_create.c:479)
==17976==  Block was alloc'd at
==17976==    at 0x4838E86: operator new(unsigned long) (vg_replace_malloc.c:344)
==17976==    by 0x55F7166: QEventDispatcherGlib::registerSocketNotifier(QSocketNotifier*) (qeventdispatcher_glib.cpp:459)
==17976==    by 0x55D8074: QSocketNotifier::QSocketNotifier(long long, QSocketNotifier::Type, QObject*) (qsocketnotifier.cpp:155)
==17976==    by 0x6076A50: qDBusAddWatch (qdbusintegrator.cpp:213)
==17976==    by 0xE992829: _dbus_watch_list_set_functions (dbus-watch.c:321)
==17976==    by 0xE977A60: dbus_connection_set_watch_functions (dbus-connection.c:4966)
==17976==    by 0x60798D5: q_dbus_connection_set_watch_functions (qdbus_symbols_p.h:242)
==17976==    by 0x60798D5: QDBusConnectionPrivate::setConnection(DBusConnection*, QDBusErrorInternal const&) (qdbusintegrator.cpp:1795)
==17976==    by 0x606D38F: QDBusConnectionManager::executeConnectionRequest(QDBusConnectionManager::ConnectionRequestData*) (qdbusconnection.cpp:289)
==17976==    by 0x55CCBD9: QObject::event(QEvent*) (qobject.cpp:1260)
==17976==    by 0x55A1A44: doNotify(QObject*, QEvent*) (qcoreapplication.cpp:1174)
==17976==    by 0x55A1B50: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1083)
==17976==    by 0x55A4A7A: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1821)
==17976== 

I've reproduced crashes with this trace twice in Fedora 30 and 10 times in rawhide. The output above and attached were on rawhide with the following rpms.
The steps to reproduce are for F30 since it took a few more steps to install and start plasma on wayland in rawhide.

Version-Release number of selected component (if applicable):
falkon-0:3.1.0-1.fc31.x86_64
dbus-1:1.12.16-1.fc31.x86_64
glib2-0:2.61.1-2.fc31.x86_64
glibc-0:2.29.9000-34.fc31.x86_64
kernel-0:5.3.0-0.rc1.git1.1.fc31.x86_64
kf5-kwayland-0:5.59.0-2.fc31.x86_64
mesa-dri-drivers-0:19.1.3-1.fc31.x86_64
plasma-desktop-0:5.16.2-1.fc31.x86_64
qt5-qtbase-0:5.12.4-5.fc31.x86_64
qt5-qtwebengine-0:5.12.4-5.fc31.x86_64

How reproducible:
The crashes occurred 2 times on F30 and 10 times on rawhide which were most of the time I closed falkon with the history and menu bar setting I mentioned.

Steps to Reproduce:
1. boot into the Fedora 30 KDE Plasma spin installation fully updated with updates-testing enabled
2. start Plasma on Wayland from sddm
3. started falkon 3.1.0-1
4. in Preferences>Browsing>Local storage, set Allow storing network cache on disk, Allowing saving history, Allow local storage of HTML5 web content to off. 5. selected OK. 
6. set View>Toolbars>Menu bar to on. 
7. close falkon

Actual results:
Segmentation faults in qGetPtrHelper in at qobject.h:121 in qt5-qtbase-5.12.4 when closing falkon involving not saving history and showing the menu bar 


Expected results:
No crashes would happen.

Additional info:

After starting falkon again after the crashes, in Preferences>Browsing>Local storage Delete locally stored HTML5 web content on close was set to on even though Allow local storage of HTML5 web content was set to off. This combination of settings didn't appear to be allowed before that point.

I've reported invalid reads and writes in wl_proxy_unref when closing the following KDE programs in Plasma on Wayland 
powerdevil https://bugs.kde.org/show_bug.cgi?id=408553
konsole https://bugs.kde.org/show_bug.cgi?id=408971
kwin_wayland https://bugs.kde.org/show_bug.cgi?id=409688
plasmashell https://bugs.kde.org/show_bug.cgi?id=409021

I reported this problem at https://bugs.kde.org/show_bug.cgi?id=410290

Comment 1 Matt Fagnani 2019-07-27 20:20:23 UTC
Created attachment 1593893 [details]
valgrind log when run on falkon showing invalid reads and writes

Comment 2 Ben Cotton 2019-08-13 17:04:17 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to '31'.

Comment 3 Ben Cotton 2019-08-13 18:53:48 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to 31.


Note You need to log in before you can comment on or make changes to this bug.