Skip to content

quickshell segfault in RunningApps/DockApps ScriptModel during rapid window-title updates #889

Description

@ArdenDiago

What caused the crash

Quickshell 0.3.0 segfaults inside Qt's QML model internals (QQmlDelegateModel::_q_itemsMoved → QAbstractItemModel::endMoveRows()), called from quickshell's own ScriptModel implementation. The crash happened while running DankMaterialShell (dms-shell 1.5.0), which feeds a Repeater's model: ScriptModel { values: sortedToplevels; objectProp: "address" } (in RunningApps.qml/DockApps.qml) from CompositorService.qml's debounced, recomputed toplevel list. Right before the crash, the same Wayland toplevel handle received several back-to-back title-change events for different Firefox windows in quick succession (visible in the log tail). That rapid churn appears to make ScriptModel's array diff (keyed on objectProp) compute a row-move operation that Qt's QAbstractItemModel::endMoveRows() can't handle safely, crashing natively instead of raising a QML-level error.

Report file

quickshell_crash_log_excerpt_redacted.txt

Configuration

Build Type: RelWithDebInfo
Compiler: GNU (16.1.1)
Compile Flags: -march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -Wp,-D_GLIBCXX_ASSERTIONS -g -ffile-prefix-map=/build/quickshell/src=/usr/src/debug/quickshell -flto=auto
Configuration:
Distributor: Arch Linux
Disable precompild headers (dev): OFF
Build tests (dev): OFF
ASAN (dev): OFF
Keep Frame Pointers (dev): OFF
Use jemalloc: ON
Crash Handling: ON
Unix Sockets: ON
Wayland: ON
Wlroots Layer-Shell: ON
Session Lock: ON
Foreign Toplevel Management: ON
Hyprland: ON
Hyprland IPC: ON
Hyprland Global Shortcuts: ON
Hyprland Focus Grabbing: ON
Hyprland Surface Extensions: ON
Screencopy: ON
Image Copy Capture: ON
Wlroots Screencopy: ON
Hyprland Toplevel Export: ON
X11: ON
I3/Sway: ON
I3/Sway IPC: ON
System Tray: ON
PipeWire: ON
Mpris: ON
Pam: ON
Polkit: ON
Greetd: ON
UPower: ON
Notifications: ON
Bluetooth: ON
Network: ON

Backtrace

Signal: Segmentation fault (11)
Crashed process ID: 4783
Run ID: af10jyxht
Shell ID: 85ecfc916fcda75f6106502e8dabb0ab
Config Path: /usr/share/quickshell/dms/shell.qml

===== Stacktrace =====
#0 0x00007f376fc3e26f at /usr/bin/../lib/libc.so.6
#1 0x00007f376f9fe072 at /usr/bin/../lib/libQt6QmlModels.so.6
#2 0x00007f376f9ff675 at /usr/bin/../lib/libQt6QmlModels.so.6
#3 0x00007f376fa0163a in QQmlDelegateModel::_q_itemsMoved(int, int, int) at /usr/bin/../lib/libQt6QmlModels.so.6
#4 0x00007f37705f081a at /usr/bin/../lib/libQt6Core.so.6
#5 0x00007f3770816d43 in QAbstractItemModel::endMoveRows() at /usr/bin/../lib/libQt6Core.so.6
#6 0x0000560679d40571 at /usr/bin/quickshell
#7 0x0000560679cef42e at /usr/bin/quickshell
#8 0x00007f377108a6ca at /usr/bin/../lib/libQt6Qml.so.6
#9 0x00007f3771174397 in QQmlPropertyPrivate::write(QObject*, QQmlPropertyData const&, QVariant const&, QQmlRefPointer const&, QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#10 0x00007f37710a3810 in QQmlBinding::slowWrite(QQmlPropertyData const&, QQmlPropertyData const&, QV4::Value const&, bool, QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#11 0x00007f37710aa2e8 at /usr/bin/../lib/libQt6Qml.so.6
#12 0x00007f37710a6fd4 in QQmlBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlagsQQmlPropertyData::WriteFlag, QV4::Scope&) at /usr/bin/../lib/libQt6Qml.so.6
#13 0x00007f37710a5d00 in QQmlBinding::update(QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#14 0x00007f377114db5f in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#15 0x00007f37705f077e at /usr/bin/../lib/libQt6Core.so.6
#16 0x00007f37710a309a in QQmlBinding::slowWrite(QQmlPropertyData const&, QQmlPropertyData const&, QV4::Value const&, bool, QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#17 0x00007f37710aa2e8 at /usr/bin/../lib/libQt6Qml.so.6
#18 0x00007f37710a6fd4 in QQmlBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlagsQQmlPropertyData::WriteFlag, QV4::Scope&) at /usr/bin/../lib/libQt6Qml.so.6
#19 0x00007f37710a5d00 in QQmlBinding::update(QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#20 0x00007f377114db5f in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#21 0x00007f37705f077e at /usr/bin/../lib/libQt6Core.so.6
#22 0x00007f37710a309a in QQmlBinding::slowWrite(QQmlPropertyData const&, QQmlPropertyData const&, QV4::Value const&, bool, QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#23 0x00007f37710aa2e8 at /usr/bin/../lib/libQt6Qml.so.6
#24 0x00007f37710a6fd4 in QQmlBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlagsQQmlPropertyData::WriteFlag, QV4::Scope&) at /usr/bin/../lib/libQt6Qml.so.6
#25 0x00007f37710a5d00 in QQmlBinding::update(QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#26 0x00007f377114db5f in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#27 0x00007f37705f077e at /usr/bin/../lib/libQt6Core.so.6
#28 0x00007f3770ff9cda in QV4::QObjectWrapper::setProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData const*, QV4::Value const&) at /usr/bin/../lib/libQt6Qml.so.6
#29 0x00007f3770fef668 in QV4::QObjectWrapper::setQmlProperty(QV4::ExecutionEngine*, QQmlRefPointer const&, QObject*, QV4::String*, QFlagsQV4::QObjectWrapper::Flag, QV4::Value const&) at /usr/bin/../lib/libQt6Qml.so.6
#30 0x00007f3770fef8fd in QV4::QQmlContextWrapper::virtualPut(QV4::Managed*, QV4::PropertyKey, QV4::Value const&, QV4::Value*) at /usr/bin/../lib/libQt6Qml.so.6
#31 0x00007f3770f6cad2 in QV4::ExecutionContext::setProperty(QV4::String*, QV4::Value const&) at /usr/bin/../lib/libQt6Qml.so.6
#32 0x00007f3771025e9a in QV4::Runtime::StoreNameSloppy::call(QV4::ExecutionEngine*, int, QV4::Value const&) at /usr/bin/../lib/libQt6Qml.so.6
#33 0x00007f37314783d3
#34 0x00007f377106a70c at /usr/bin/../lib/libQt6Qml.so.6
#35 0x00007f3770fb8776 at /usr/bin/../lib/libQt6Qml.so.6
#36 0x00007f3771024d01 in QV4::Runtime::CallQmlContextPropertyLookup::call(QV4::ExecutionEngine*, unsigned int, QV4::Value*, int) at /usr/bin/../lib/libQt6Qml.so.6
#37 0x00007f3731474b4a
#38 0x00007f377106a70c at /usr/bin/../lib/libQt6Qml.so.6
#39 0x00007f3770faa173 at /usr/bin/../lib/libQt6Qml.so.6
#40 0x00007f3770fb0a34 in QV4::Function::call(QObject*, void**, QMetaType const*, int, QV4::ExecutionContext*) at /usr/bin/../lib/libQt6Qml.so.6
#41 0x00007f377111ff67 in QQmlJavaScriptExpression::evaluate(void**, QMetaType const*, int) at /usr/bin/../lib/libQt6Qml.so.6
#42 0x00007f37710ac2f7 in QQmlBoundSignalExpression::evaluate(void**) at /usr/bin/../lib/libQt6Qml.so.6
#43 0x00007f37710b2000 at /usr/bin/../lib/libQt6Qml.so.6
#44 0x00007f377114db5f in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#45 0x00007f37705f077e at /usr/bin/../lib/libQt6Core.so.6
#46 0x00007f377121c31f in QQmlVMEMetaObject::metaCall(QObject*, QMetaObject::Call, int, void**) at /usr/bin/../lib/libQt6Qml.so.6
#47 0x00007f3771167362 at /usr/bin/../lib/libQt6Qml.so.6
#48 0x00007f3770ffc8da at /usr/bin/../lib/libQt6Qml.so.6
#49 0x00007f3770ffe707 in QV4::QObjectMethod::callPrecise(QQmlObjectOrGadget const&, QQmlPropertyData const&, QV4::ExecutionEngine*, QV4::CallData*, QMetaObject::Call) at /usr/bin/../lib/libQt6Qml.so.6
#50 0x00007f3771007dc4 in QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const at /usr/bin/../lib/libQt6Qml.so.6
#51 0x00007f3771024d01 in QV4::Runtime::CallQmlContextPropertyLookup::call(QV4::ExecutionEngine*, unsigned int, QV4::Value*, int) at /usr/bin/../lib/libQt6Qml.so.6
#52 0x00007f3730822321
#53 0x00007f377106a70c at /usr/bin/../lib/libQt6Qml.so.6
#54 0x00007f3770fb8776 at /usr/bin/../lib/libQt6Qml.so.6
#55 0x00007f3771024d01 in QV4::Runtime::CallQmlContextPropertyLookup::call(QV4::ExecutionEngine*, unsigned int, QV4::Value*, int) at /usr/bin/../lib/libQt6Qml.so.6
#56 0x00007f37308259dd
#57 0x00007f377106a70c at /usr/bin/../lib/libQt6Qml.so.6
#58 0x00007f3770faa173 at /usr/bin/../lib/libQt6Qml.so.6
#59 0x00007f3770fb0a34 in QV4::Function::call(QObject*, void**, QMetaType const*, int, QV4::ExecutionContext*) at /usr/bin/../lib/libQt6Qml.so.6
#60 0x00007f377111ff67 in QQmlJavaScriptExpression::evaluate(void**, QMetaType const*, int) at /usr/bin/../lib/libQt6Qml.so.6
#61 0x00007f37710ac2f7 in QQmlBoundSignalExpression::evaluate(void**) at /usr/bin/../lib/libQt6Qml.so.6
#62 0x00007f37710b2000 at /usr/bin/../lib/libQt6Qml.so.6
#63 0x00007f377114db5f in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#64 0x00007f37705f077e at /usr/bin/../lib/libQt6Core.so.6
#65 0x0000560679b81322 at /usr/bin/quickshell
#66 0x0000560679b80ed8 at /usr/bin/quickshell
#67 0x00007f37705f081a at /usr/bin/../lib/libQt6Core.so.6
#68 0x00007f37705f0a58 at /usr/bin/../lib/libQt6Core.so.6
#69 0x00007f3770cc87af in QAbstractSocketPrivate::canReadNotification() at /usr/bin/../lib/libQt6Network.so.6
#70 0x00007f3770cd4831 at /usr/bin/../lib/libQt6Network.so.6
#71 0x00007f377270411e in QApplicationPrivate::notify_helper(QObject*, QEvent*) at /usr/bin/../lib/libQt6Widgets.so.6
#72 0x00007f3770583657 in QCoreApplication::notifyInternal2(QObject*, QEvent*) at /usr/bin/../lib/libQt6Core.so.6
#73 0x00007f377089f9af at /usr/bin/../lib/libQt6Core.so.6
#74 0x00007f3772e78bfc at /usr/bin/../lib/libglib-2.0.so.0
#75 0x00007f3772e7ae56 at /usr/bin/../lib/libglib-2.0.so.0
#76 0x00007f3772e7afe4 in g_main_context_iteration at /usr/bin/../lib/libglib-2.0.so.0
#77 0x00007f377089d0b1 in QEventDispatcherGlib::processEvents(QFlagsQEventLoop::ProcessEventsFlag) at /usr/bin/../lib/libQt6Core.so.6
#78 0x00007f3770591982 in QEventLoop::exec(QFlagsQEventLoop::ProcessEventsFlag) at /usr/bin/../lib/libQt6Core.so.6
#79 0x00007f3770586ea9 in QCoreApplication::exec() at /usr/bin/../lib/libQt6Core.so.6
#80 0x0000560679adec71 at /usr/bin/quickshell
#81 0x0000560679ad01dd at /usr/bin/quickshell
#82 0x0000560679ad6693 at /usr/bin/quickshell
#83 0x0000560679abe270 at /usr/bin/quickshell
#84 0x00007f376fc27740 at /usr/bin/../lib/libc.so.6
#85 0x00007f376fc27878 in __libc_start_main at /usr/bin/../lib/libc.so.6
#86 0x0000560679ac0e74 at /usr/bin/quickshell

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingcrash

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions