SIGSEGV in `ScriptModel::updateValuesUnique` → `QObjectWrapper::wrap` on display hotplug (delegate incubation, Qt 6.11.1)

[xmarcosx]

SIGSEGV in ScriptModel::updateValuesUnique → QObjectWrapper::wrap during delegate incubation

Summary

quickshell crashes with SIGSEGV when a ScriptModel is updated with a list whose
elements are maps/objects. The endInsertRows() inside
ScriptModel::updateValuesUnique() synchronously drives a Repeater/QQmlDelegateModel
to incubate a delegate, and evaluating one of the delegate's bindings crashes inside
Qt's QML engine while wrapping a QVariantMap-of-objects
(VariantAssociationObject → Sequence::createElementWrappers → QObjectWrapper::wrap).

The full symbolicated stack (see the attached report.txt) shows the trigger is a
Wayland screen change: QGuiApplication::screenAdded → QuickshellTracked::updateScreens()
→ Variants::updateVariants() → ScriptModel::updateValuesUnique(). In practice this is
reproducible on demand by unplugging an external display (see Reproduction). The
dms.service unit respawns quickshell automatically after each crash, so it self-recovers.

Environment

quickshell	0.3.0-1.fc44 (COPR avengemedia/danklinux), build-id 4b6aa2750d87405501fe4fc2868fab345bf41d3d
config	DankMaterialShell (dms) 1.4.6
Qt	6.11.1 (qt6-qtbase 6.11.1-1, qt6-qtdeclarative 6.11.1-2)
OS	Fedora Linux 44 (Workstation)
Compositor	niri (Wayland)
Signal	SIGSEGV (11)

Backtrace (faulting thread, key frames)

#2  qs::crash::signalHandler                                          (quickshell)
#4  QV4::QObjectWrapper::wrap                                         (libQt6Qml)   ← crash
#6  QV4::Heap::Sequence::createElementWrappers                        (libQt6Qml)
#7  QV4::SequencePrototype::fromData                                  (libQt6Qml)
#10 QV4::Heap::VariantAssociationObject::init(QMap<QString,QVariant>) (libQt6Qml)
#11 QV4::VariantAssociationPrototype::fromQVariantMap                 (libQt6Qml)
#15 QQmlVMEMetaObject::writeVarProperty                               (libQt6Qml)
#16 QQmlBinding::slowWrite                                            (libQt6Qml)
...  (delegate binding evaluation)
#39 QQuickItem::setParentItem                                         (libQt6Quick)
#40 QQuickRepeater::initItem                                          (libQt6Quick)
#43 QQmlIncubatorPrivate::incubate                                    (libQt6Qml)
#45 QQmlDelegateModelPrivate::object                                  (libQt6QmlModels)
#46 QQuickRepeater::modelUpdated                                      (libQt6Quick)
#51 QQmlDelegateModel::_q_itemsInserted                              (libQt6QmlModels)
#54 QAbstractItemModel::endInsertRows                                 (libQt6Core)
#55 ScriptModel::updateValuesUnique(const QList<QVariant>&)           (quickshell)  ← model mutation
#56 ScriptModel::qt_static_metacall                                   (quickshell)
...  (property write into the ScriptModel)
#84 Variants::updateVariants                                          (quickshell)
#95 QuickshellTracked::updateScreens                                  (quickshell)
#97 QGuiApplication::screenAdded(QScreen*)                            (libQt6Gui)   ← trigger
#98 QtWaylandClient::QWaylandDisplay::handleScreenInitialized         (libQt6WaylandClient)

Full symbolicated trace attached as report.txt (quickshell's own crash report; frames
above #56 come from it — the raw coredump unwind stopped earlier).

What seems to be going on

A Wayland screen event (screenAdded) makes quickshell run QuickshellTracked::updateScreens(),
which drives Variants::updateVariants() and ultimately a ScriptModel update.
ScriptModel::updateValuesUnique emits endInsertRows() synchronously, so a bound
Repeater incubates a new delegate inside the model mutation. A binding on that
delegate reads a model value that is a QVariantMap containing QObject* (or a sequence
of them). Qt 6.11's newer VariantAssociationObject / Sequence reference-wrapper path
(fromQVariantMap → createElementWrappers → QObjectWrapper::wrap) then dereferences
something invalid — plausibly an object being torn down / re-created as part of the same
screen-driven update, i.e. a reentrancy/lifetime issue between the synchronous
endInsertRows and delegate incubation. (I have not yet pinned the exact invalid object;
I plan to confirm with an AddressSanitizer build.)

This is ultimately a Qt QML-engine fault, but it is reachable from unprivileged QML via
ScriptModel, so quickshell may be able to avoid it (e.g. deferring row-insert
notifications, or not exposing raw QObject-bearing maps to the sequence wrapper).

Possibly related

• crash during manipulatin inside DMS settings #722 "crash during manipulation inside DMS settings" — same family (Qt QML engine
  crash triggered from DMS) but a different signature (QV4::Object::insertMember from a
  mouse-release, Qt 6.10.2 / qs 0.2.1). Likely distinct.

Reproduction

Reproducible on demand:

1. Run DMS under quickshell on niri/Wayland with an external display connected alongside
   the laptop's internal panel (here: an Apple Studio Display on a Framework laptop).
2. Unplug the external display.
3. quickshell crashes with the SIGSEGV above as the output set changes.

Journal correlation for one crash (decisive — crash coincides with the output count change):

12:41:33 niri:       putting output eDP-1 at x=0 y=0   # external removed, internal now sole output
12:41:37 dms:        NiriService: Loaded 1 outputs     # output count 3 -> 1
12:41:38 quickshell: SIGSEGV in ScriptModel::updateValuesUnique

Multiple coredumps today with identical signatures (PIDs 36367 and 41818). Coredumps
available on request.

Full backtrace (66 frames)

Stack trace of thread 36367:
#0  0x00007f3d9d27bdcc __pthread_kill_implementation (libc.so.6 + 0x74dcc)
#1  0x00007f3d9d220f8e raise (libc.so.6 + 0x19f8e)
#2  0x000055f08944e405 _ZN2qs5crash12_GLOBAL__N_1L13signalHandlerEiP9siginfo_tPv (quickshell + 0xca405)
#3  0x00007f3d9d2210b0 __restore_rt (libc.so.6 + 0x1a0b0)
#4  0x00007f3d9e545682 _ZN3QV414QObjectWrapper4wrapEPNS_15ExecutionEngineEP7QObject (libQt6Qml.so.6 + 0x145682)
#5  0x00007f3d9e5405a8 _ZN3QV415ExecutionEngine8fromDataE9QMetaTypePKvPNS_4Heap6ObjectEij (libQt6Qml.so.6 + 0x1405a8)
#6  0x00007f3d9e5fff1c _ZN3QV44Heap8Sequence21createElementWrappersEPKv (libQt6Qml.so.6 + 0x1fff1c)
#7  0x00007f3d9e601c03 _ZN3QV417SequencePrototype8fromDataEPNS_15ExecutionEngineE9QMetaType13QMetaSequencePKv (libQt6Qml.so.6 + 0x201c03)
#8  0x00007f3d9e52524f _ZZN3QV415ExecutionEngine8fromDataE9QMetaTypePKvPNS_4Heap6ObjectEijENKUl13QMetaSequenceE_clES7_.isra.0 (libQt6Qml.so.6 + 0x12524f)
#9  0x00007f3d9e540bda _ZN3QV415ExecutionEngine8fromDataE9QMetaTypePKvPNS_4Heap6ObjectEij (libQt6Qml.so.6 + 0x140bda)
#10 0x00007f3d9e638b59 _ZN3QV44Heap24VariantAssociationObject4initERK4QMapI7QString8QVariantEPNS0_6ObjectEi6QFlagsINS0_15ReferenceObject4FlagEE (libQt6Qml.so.6 + 0x238b59)
#11 0x00007f3d9e638cd9 _ZN3QV427VariantAssociationPrototype15fromQVariantMapEPNS_15ExecutionEngineERK4QMapI7QString8QVariantEPNS_4Heap6ObjectEi6QFlagsINS9_15ReferenceObject4FlagEE (libQt6Qml.so.6 + 0x238cd9)
#12 0x00007f3d9e53fe1c _ZN3QV415ExecutionEngine8fromDataE9QMetaTypePKvPNS_4Heap6ObjectEij (libQt6Qml.so.6 + 0x13fe1c)
#13 0x00007f3d9e638b59 _ZN3QV44Heap24VariantAssociationObject4initERK4QMapI7QString8QVariantEPNS0_6ObjectEi6QFlagsINS0_15ReferenceObject4FlagEE (libQt6Qml.so.6 + 0x238b59)
#14 0x00007f3d9e638e08 _ZN3QV44Heap14createDetachedI4QMapI7QString8QVariantEEEPNS0_24VariantAssociationObjectEPNS_15ExecutionEngineERKT_.isra.0 (libQt6Qml.so.6 + 0x238e08)
#15 0x00007f3d9e837c21 _ZN17QQmlVMEMetaObject16writeVarPropertyEiRKN3QV45ValueE (libQt6Qml.so.6 + 0x437c21)
#16 0x00007f3d9e68f968 _ZN11QQmlBinding9slowWriteERK16QQmlPropertyDataS2_RKN3QV45ValueEb6QFlagsINS0_9WriteFlagEE (libQt6Qml.so.6 + 0x28f968)
#17 0x00007f3d9e693c36 _ZN14GenericBindingILi0EE5writeERKN3QV45ValueEb6QFlagsIN16QQmlPropertyData9WriteFlagEE (libQt6Qml.so.6 + 0x293c36)
#18 0x00007f3d9e690d81 _ZN11QQmlBinding8doUpdateERKN24QQmlJavaScriptExpression13DeleteWatcherE6QFlagsIN16QQmlPropertyData9WriteFlagEERN3QV45ScopeE (libQt6Qml.so.6 + 0x290d81)
#19 0x00007f3d9e691569 _ZN11QQmlBinding6updateE6QFlagsIN16QQmlPropertyData9WriteFlagEE (libQt6Qml.so.6 + 0x291569)
#20 0x00007f3d9e5ce26e _ZN3QV414QObjectWrapper11getPropertyEPNS_15ExecutionEngineEPNS_4Heap6ObjectEP7QObjectPK16QQmlPropertyData6QFlagsINS0_4FlagEE (libQt6Qml.so.6 + 0x1ce26e)
#21 0x00007f3d9e5b5bca _ZN3QV418QQmlContextWrapper25lookupScopeObjectPropertyEPNS_6LookupEPNS_15ExecutionEngineEPNS_5ValueE (libQt6Qml.so.6 + 0x1b5bca)
#22 0x00007f3d4077d6c1 n/a (n/a + 0x0)
#23 0x00007f3d9e6499d6 _ZN3QV44Moth3VME4execEPNS_17JSTypesStackFrameEPNS_15ExecutionEngineE (libQt6Qml.so.6 + 0x2499d6)
#24 0x00007f3d9e562010 _ZN3QV4L6doCallEPNS_8FunctionEPKNS_5ValueES4_iPNS_16ExecutionContextE (libQt6Qml.so.6 + 0x162010)
#25 0x00007f3d9e70ef16 _ZN24QQmlJavaScriptExpression8evaluateEPN3QV48CallDataEPb (libQt6Qml.so.6 + 0x30ef16)
#26 0x00007f3d9e68cf19 _ZN11QQmlBinding8evaluateEPb (libQt6Qml.so.6 + 0x28cf19)
#27 0x00007f3d9e690c4a _ZN11QQmlBinding8doUpdateERKN24QQmlJavaScriptExpression13DeleteWatcherE6QFlagsIN16QQmlPropertyData9WriteFlagEERN3QV45ScopeE (libQt6Qml.so.6 + 0x290c4a)
#28 0x00007f3d9e691569 _ZN11QQmlBinding6updateE6QFlagsIN16QQmlPropertyData9WriteFlagEE (libQt6Qml.so.6 + 0x291569)
#29 0x00007f3d9e5ce26e _ZN3QV414QObjectWrapper11getPropertyEPNS_15ExecutionEngineEPNS_4Heap6ObjectEP7QObjectPK16QQmlPropertyData6QFlagsINS0_4FlagEE (libQt6Qml.so.6 + 0x1ce26e)
#30 0x00007f3d40786bdb n/a (n/a + 0x0)
#31 0x00007f3d9e6499d6 _ZN3QV44Moth3VME4execEPNS_17JSTypesStackFrameEPNS_15ExecutionEngineE (libQt6Qml.so.6 + 0x2499d6)
#32 0x00007f3d9e562010 _ZN3QV4L6doCallEPNS_8FunctionEPKNS_5ValueES4_iPNS_16ExecutionContextE (libQt6Qml.so.6 + 0x162010)
#33 0x00007f3d9e70ef16 _ZN24QQmlJavaScriptExpression8evaluateEPN3QV48CallDataEPb (libQt6Qml.so.6 + 0x30ef16)
#34 0x00007f3d9e68cf19 _ZN11QQmlBinding8evaluateEPb (libQt6Qml.so.6 + 0x28cf19)
#35 0x00007f3d9e690c4a _ZN11QQmlBinding8doUpdateERKN24QQmlJavaScriptExpression13DeleteWatcherE6QFlagsIN16QQmlPropertyData9WriteFlagEERN3QV45ScopeE (libQt6Qml.so.6 + 0x290c4a)
#36 0x00007f3d9e691569 _ZN11QQmlBinding6updateE6QFlagsIN16QQmlPropertyData9WriteFlagEE (libQt6Qml.so.6 + 0x291569)
#37 0x00007f3d9e746be0 _ZN12QQmlNotifier10emitNotifyEP20QQmlNotifierEndpointPPv (libQt6Qml.so.6 + 0x346be0)
#38 0x00007f3d9d984baa _Z10doActivateILb0EEvP7QObjectiPPv (libQt6Core.so.6 + 0x184baa)
#39 0x00007f3d9f8b8327 _ZN10QQuickItem13setParentItemEPS_ (libQt6Quick.so.6 + 0xb8327)
#40 0x00007f3d9fc9e8d3 _ZN14QQuickRepeater8initItemEiP7QObject (libQt6Quick.so.6 + 0x49e8d3)
#41 0x00007f3d9d984eb7 _Z10doActivateILb0EEvP7QObjectiPPv (libQt6Core.so.6 + 0x184eb7)
#42 0x00007f3d9d0ef315 _ZN17QQmlInstanceModel8initItemEiP7QObject (libQt6QmlModels.so.6 + 0x23315)
#43 0x00007f3d9e70a6b8 _ZN20QQmlIncubatorPrivate8incubateER26QQmlInstantiationInterrupt (libQt6Qml.so.6 + 0x30a6b8)
#44 0x00007f3d9e70a9e2 _ZN17QQmlEnginePrivate8incubateER13QQmlIncubatorRK14QQmlRefPointerI15QQmlContextDataE (libQt6Qml.so.6 + 0x30a9e2)
#45 0x00007f3d9d1400d3 _ZN24QQmlDelegateModelPrivate6objectEN18QQmlListCompositor5GroupEiN13QQmlIncubator14IncubationModeE (libQt6QmlModels.so.6 + 0x740d3)
#46 0x00007f3d9fca022a _ZN14QQuickRepeater12modelUpdatedERK13QQmlChangeSetb (libQt6Quick.so.6 + 0x4a022a)
#47 0x00007f3d9d984eb7 _Z10doActivateILb0EEvP7QObjectiPPv (libQt6Core.so.6 + 0x184eb7)
#48 0x00007f3d9d0ef237 _ZN17QQmlInstanceModel12modelUpdatedERK13QQmlChangeSetb (libQt6QmlModels.so.6 + 0x23237)
#49 0x00007f3d9d140a48 _ZN29QQmlDelegateModelGroupPrivate16emitModelUpdatedEb (libQt6QmlModels.so.6 + 0x74a48)
#50 0x00007f3d9d140e88 _ZN24QQmlDelegateModelPrivate11emitChangesEv (libQt6QmlModels.so.6 + 0x74e88)
#51 0x00007f3d9d1442ab _ZN17QQmlDelegateModel16_q_itemsInsertedEii (libQt6QmlModels.so.6 + 0x782ab)
#52 0x00007f3d9d984eb7 _Z10doActivateILb0EEvP7QObjectiPPv (libQt6Core.so.6 + 0x184eb7)
#53 0x00007f3d9dbcbefa _ZN18QAbstractItemModel12rowsInsertedERK11QModelIndexiiNS_14QPrivateSignalE (libQt6Core.so.6 + 0x3cbefa)
#54 0x00007f3d9dbdbaaa _ZN18QAbstractItemModel13endInsertRowsEv (libQt6Core.so.6 + 0x3dbaaa)
#55 0x000055f089666c64 _ZN11ScriptModel18updateValuesUniqueERK5QListI8QVariantE (quickshell + 0x2e2c64)
#56 0x000055f08961742f _ZN11ScriptModel18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv (quickshell + 0x29342f)
#57 0x00007f3d9e770501 _ZNK16QQmlPropertyData13writePropertyEP7QObjectPv6QFlagsINS_9WriteFlagEE.isra.0 (libQt6Qml.so.6 + 0x370501)
#58 0x00007f3d9e7789d9 _ZN19QQmlPropertyPrivate5writeEP7QObjectRK16QQmlPropertyDataRK8QVariantRK14QQmlRefPointerI15QQmlContextDataE6QFlagsINS2_9WriteFlagEE (libQt6Qml.so.6 + 0x3789d9)
#59 0x00007f3d9e68f57f _ZN11QQmlBinding9slowWriteERK16QQmlPropertyDataS2_RKN3QV45ValueEb6QFlagsINS0_9WriteFlagEE (libQt6Qml.so.6 + 0x28f57f)
#60 0x00007f3d9e693c36 _ZN14GenericBindingILi0EE5writeERKN3QV45ValueEb6QFlagsIN16QQmlPropertyData9WriteFlagEE (libQt6Qml.so.6 + 0x293c36)
#61 0x00007f3d9e690d81 _ZN11QQmlBinding8doUpdateERKN24QQmlJavaScriptExpression13DeleteWatcherE6QFlagsIN16QQmlPropertyData9WriteFlagEERN3QV45ScopeE (libQt6Qml.so.6 + 0x290d81)
#62 0x00007f3d9e691569 _ZN11QQmlBinding6updateE6QFlagsIN16QQmlPropertyData9WriteFlagEE (libQt6Qml.so.6 + 0x291569)
#63 0x00007f3d9e746be0 _ZN12QQmlNotifier10emitNotifyEP20QQmlNotifierEndpointPPv (libQt6Qml.so.6 + 0x346be0)
ELF object binary architecture: AMD x86-64

[xmarcosx]

Update: this is a monitor-hotplug use-after-free, and it reproduces on demand

I can now trigger this reliably by unplugging an external display (an Apple Studio Display from a laptop, niri compositor). Both of my crashes correlated exactly with a screen-count change.

Journal around one crash (external display unplugged):

niri: putting output eDP-1 at x=0 y=0        # external removed, internal becomes sole output
NiriService: Loaded 1 outputs                # output count dropped 3 -> 1
<~5s later> quickshell SIGSEGV in ScriptModel::updateValuesUnique

Likely mechanism

A ScriptModel whose values contain live Wayland QObjects (e.g. toplevel/window objects). When the output is unplugged those objects are destroyed, but a delegate binding re-reads the model and the QML engine tries to wrap a now-dangling QObject*. The faulting path is the Qt 6.9+ reference-wrapper machinery:

ScriptModel::updateValuesUnique
  -> endInsertRows()                                  # synchronous, drives delegate incubation
  -> QQuickRepeater / QQmlDelegateModel (incubate)
  -> delegate binding evaluates, reads modelData (a QVariantMap containing a list of QObjects)
  -> VariantAssociationObject::init -> Sequence::createElementWrappers
  -> QV4::QObjectWrapper::wrap                         # <-- SIGSEGV on dangling QObject*

(Full backtrace in the original report above.) The map-containing-a-sequence-of-objects shape in the trace matches a model value like { ..., items: [obj, obj, ...] } where the objs are compositor objects that die on hotplug.

Environment

• quickshell 0.3.0, Qt 6.11.1, Fedora 44, niri (Wayland)
• config: DankMaterialShell (dms) 1.4.6

Probably the same family as

• Quickshell 0.3.0 crash on "Display connected" #796 "Quickshell 0.3.0 crash on 'Display connected'"
• Crash when third monitor detected after wake from system suspend #581 "Crash when third monitor detected after wake from system suspend"

Next step

I'm going to build with AddressSanitizer and reproduce via unplug to confirm which object is freed and which model holds it — will follow up with the ASan report. If the root cause is ScriptModel retaining raw QObject*s past their lifetime, a QPointer-based guard (drop/skip destroyed objects instead of wrapping them) seems like the natural fix; happy to prep a PR once ASan confirms.

[xmarcosx]

report.txt

[outfoxxed]

#879