Skip to content

KF5: Fix tracking of RunnerContext pointer

Dennis Marttinen requested to merge twelho/krunner:runnercontext-pointer into kf5

The RunnerContext may be invalidated while being held by a (slow/asynchronous) runner, which causes matchesChanged() to emit a signal to an invalid object, causing a SIGSEGV:

Thread 22 (Thread 0x7ef985e2a6c0 (LWP 26562) "GlobalQueue[02]"):
#0  doActivate<false> (sender=0x55836fc02468, signal_index=3, argv=0x0) at kernel/qobject.h:132
#1  0x00007f022aae33b7 in QMetaObject::activate (sender=<optimized out>, m=m@entry=0x7efdcae14f60 <Plasma::RunnerContext::staticMetaObject>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x0) at kernel/qobject.cpp:3985
#2  0x00007efdcadf8264 in Plasma::RunnerContext::matchesChanged (this=<optimized out>) at /usr/src/debug/kf5-krunner-5.110.0-1.fc38.twelho.x86_64/redhat-linux-build/src/KF5Runner_autogen/include/moc_runnercontext.cpp:132
#3  0x00007efdcadff0ba in Plasma::RunnerContext::addMatches (matches=..., this=0x558370206f70) at /usr/src/debug/kf5-krunner-5.110.0-1.fc38.twelho.x86_64/src/runnercontext.cpp:333
#4  Plasma::RunnerContext::addMatches (this=this@entry=0x558370206f70, matches=...) at /usr/src/debug/kf5-krunner-5.110.0-1.fc38.twelho.x86_64/src/runnercontext.cpp:313
#5  0x00007efdcadff3fb in Plasma::RunnerContext::addMatch (this=0x558370206f70, match=...) at /usr/include/c++/13/bits/stl_algobase.h:386
#6  0x00007efdcadf66ab in operator() (__closure=<optimized out>) at /usr/src/debug/kf5-krunner-5.110.0-1.fc38.twelho.x86_64/src/dbusrunner.cpp:277
#7  0x00007f022aae8491 in QtPrivate::QSlotObjectBase::call (a=0x7ef985e29740, r=<optimized out>, this=0x7f021001baa0) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#8  doActivate<false> (sender=0x7ef97c2f8c20, signal_index=3, argv=0x7ef985e29740) at kernel/qobject.cpp:3925
#9  0x00007f022aae33b7 in QMetaObject::activate (sender=<optimized out>, m=m@entry=0x7f022ca6b5e0 <QDBusPendingCallWatcher::staticMetaObject>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7ef985e29740) at kernel/qobject.cpp:3985
#10 0x00007f022ca50cc1 in QDBusPendingCallWatcher::finished (this=<optimized out>, _t1=<optimized out>) at .moc/moc_qdbuspendingcall.cpp:158
#11 0x00007f022aaded3b in QObject::event (this=0x7ef97c2f8c20, e=0x7ef968377f80) at kernel/qobject.cpp:1347
#12 0x00007f022a1aeb75 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x7ef97c2f8c20, e=0x7ef968377f80) at kernel/qapplication.cpp:3640
#13 0x00007f022aab41b8 in QCoreApplication::notifyInternal2 (receiver=0x7ef97c2f8c20, event=0x7ef968377f80) at kernel/qcoreapplication.cpp:1064
#14 0x00007f022aab43d2 in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462
#15 0x00007f022aab7665 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x7ef97c2f8c20, event_type=43, data=0x7f021000dcf0) at kernel/qcoreapplication.cpp:1821
#16 0x00007f022aab791d in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>) at kernel/qcoreapplication.cpp:1680
#17 0x00007f022ca52032 in QDBusPendingCallWatcher::waitForFinished (this=<optimized out>) at qdbuspendingcall.cpp:544
#18 0x00007efdcadf579d in DBusRunner::match (this=<optimized out>, context=...) at /usr/src/debug/kf5-krunner-5.110.0-1.fc38.twelho.x86_64/src/dbusrunner.cpp:284
#19 0x00007efdcadf9543 in Plasma::FindMatchesJob::run (this=0x558370206f50, self=...) at /usr/src/debug/kf5-krunner-5.110.0-1.fc38.twelho.x86_64/src/runnerjobs.cpp:140
#20 0x00007efdcadc3031 in ThreadWeaver::Executor::run (this=<optimized out>, job=..., thread=<optimized out>) at /usr/src/debug/kf5-threadweaver-5.110.0-1.fc38.x86_64/src/executor.cpp:33
#21 0x00007efdcadc3f7e in ThreadWeaver::Job::execute (this=<optimized out>, self=..., th=0x558370bb9db0) at /usr/src/debug/kf5-threadweaver-5.110.0-1.fc38.x86_64/src/job.cpp:64
#22 0x00007efdcadc7aa9 in ThreadWeaver::Thread::run (this=0x558370bb9db0) at /usr/src/debug/kf5-threadweaver-5.110.0-1.fc38.x86_64/src/thread.cpp:98
#23 0x00007f022a8f59dd in operator() (__closure=<optimized out>) at thread/qthread_unix.cpp:350
#24 (anonymous namespace)::terminate_on_exception<QThreadPrivate::start(void*)::<lambda()> > (t=...) at thread/qthread_unix.cpp:287
#25 QThreadPrivate::start (arg=0x558370bb9db0) at thread/qthread_unix.cpp:310
#26 0x00007f02299cd947 in start_thread (arg=<optimized out>) at pthread_create.c:444
#27 0x00007f0229a53860 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

To mitigate this, use a QPointer to track the RunnerContext and check for its validity before calling matchesChanged(). This is similar to the guard implemented for KF6 in !139 (merged).

Merge request reports