crash during manipulatin inside DMS settings

[glempi]

What caused the crash

Environment:

OS: Manjaro Linux
GPU: Intel Arc Pro
Qt version: Qt: 6.10.2 (built against 6.10.2)
Quickshell: 0.2.1 (revision https://github.com/quickshell-mirror/quickshell/commit/d4c92973b53d9fa34cc110d3b974eb6bde5b3027, AUR package: quickshell-git)
Config: Dunk Material shell (/usr/share/quickshell/dms/shell.qml)
Render loop: QSG_RENDER_LOOP=threaded (set in environment)

What happened:
Quickshell crashes with a segmentation fault During manipulation inside DMS settings around lock screen & fingerprint auth. The fingerprint auth has configured and tested with locking/unlocking before.

#0 0x00007f353844d2cf at /usr/bin/../lib/libc.so.6
#1 0x00007f35395c1f53 in QV4::Object::insertMember(QV4::StringOrSymbol*, QV4::Property const*, QV4::PropertyAttributes) at /usr/bin/../lib/libQt6Qml.so.6
#2 0x00007f353953f907 at /usr/bin/../lib/libQt6Qml.so.6
#3 0x00007f35395c4c60 in QV4::Object::internalPut(QV4::PropertyKey, QV4::Value const&, QV4::Value*) at /usr/bin/../lib/libQt6Qml.so.6
#4 0x00007f35395c4a9f in QV4::Object::internalPut(QV4::PropertyKey, QV4::Value const&, QV4::Value*) at /usr/bin/../lib/libQt6Qml.so.6
#5 0x00007f353960b397 at /usr/bin/../lib/libQt6Qml.so.6
#6 0x00007f353960b4a0 in QV4::Runtime::StoreElement::call(QV4::ExecutionEngine*, QV4::Value const&, QV4::Value const&, QV4::Value const&) at /usr/bin/../lib/libQt6Qml.so.6
#7 0x00007f34f35815df
#8 0x00007f353964e265 at /usr/bin/../lib/libQt6Qml.so.6
#9 0x00007f35395a3eb5 at /usr/bin/../lib/libQt6Qml.so.6
#10 0x00007f353960ea1c in QV4::Runtime::CallPropertyLookup::call(QV4::ExecutionEngine*, QV4::Value const&, unsigned int, QV4::Value*, int) at /usr/bin/../lib/libQt6Qml.so.6
#11 0x00007f34f62eda1e
#12 0x00007f353964e265 at /usr/bin/../lib/libQt6Qml.so.6
#13 0x00007f35395962ff at /usr/bin/../lib/libQt6Qml.so.6
#14 0x00007f353959c908 in QV4::Function::call(QObject*, void**, QMetaType const*, int, QV4::ExecutionContext*) at /usr/bin/../lib/libQt6Qml.so.6
#15 0x00007f35396f32af in QQmlJavaScriptExpression::evaluate(void**, QMetaType const*, int) at /usr/bin/../lib/libQt6Qml.so.6
#16 0x00007f353968a2ca in QQmlBoundSignalExpression::evaluate(void**) at /usr/bin/../lib/libQt6Qml.so.6
#17 0x00007f353968f80c at /usr/bin/../lib/libQt6Qml.so.6
#18 0x00007f353971cf57 in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#19 0x00007f3538bd8b81 at /usr/bin/../lib/libQt6Core.so.6
#20 0x00007f353972c428 in QQmlObjectCreator::finalize(QQmlInstantiationInterrupt&) at /usr/bin/../lib/libQt6Qml.so.6
#21 0x00007f35396f17ee in QQmlIncubatorPrivate::incubate(QQmlInstantiationInterrupt&) at /usr/bin/../lib/libQt6Qml.so.6
#22 0x00007f35396f22d7 in QQmlEnginePrivate::incubate(QQmlIncubator&, QQmlRefPointer const&) at /usr/bin/../lib/libQt6Qml.so.6
#23 0x00007f35396a8910 in QQmlComponent::create(QQmlIncubator&, QQmlContext*, QQmlContext*) at /usr/bin/../lib/libQt6Qml.so.6
#24 0x00007f353a5a513f at /usr/bin/../lib/libQt6Quick.so.6
#25 0x00007f353a5aa02c in QQuickLoader::setActive(bool) at /usr/bin/../lib/libQt6Quick.so.6
#26 0x00007f353966a4b4 at /usr/bin/../lib/libQt6Qml.so.6
#27 0x00007f35396887de at /usr/bin/../lib/libQt6Qml.so.6
#28 0x00007f3539684db4 in QQmlBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlagsQQmlPropertyData::WriteFlag, QV4::Scope&) at /usr/bin/../lib/libQt6Qml.so.6
#29 0x00007f3539683b9c in QQmlBinding::update(QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#30 0x00007f353971cf57 in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#31 0x00007f3538bd8b81 at /usr/bin/../lib/libQt6Core.so.6
#32 0x00007f35397e0572 in QQmlVMEMetaObject::metaCall(QObject*, QMetaObject::Call, int, void**) at /usr/bin/../lib/libQt6Qml.so.6
#33 0x00007f353966a4e5 at /usr/bin/../lib/libQt6Qml.so.6
#34 0x00007f3539689a36 at /usr/bin/../lib/libQt6Qml.so.6
#35 0x00007f3539684db4 in QQmlBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlagsQQmlPropertyData::WriteFlag, QV4::Scope&) at /usr/bin/../lib/libQt6Qml.so.6
#36 0x00007f3539683b9c in QQmlBinding::update(QFlagsQQmlPropertyData::WriteFlag) at /usr/bin/../lib/libQt6Qml.so.6
#37 0x00007f353971cf57 in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#38 0x00007f3538bd8b81 at /usr/bin/../lib/libQt6Core.so.6
#39 0x00007f35397e0572 in QQmlVMEMetaObject::metaCall(QObject*, QMetaObject::Call, int, void**) at /usr/bin/../lib/libQt6Qml.so.6
#40 0x00007f35395e28a5 in QV4::QObjectWrapper::setProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData const*, QV4::Value const&) at /usr/bin/../lib/libQt6Qml.so.6
#41 0x00007f35395e3f70 in QV4::QObjectWrapper::setQmlProperty(QV4::ExecutionEngine*, QQmlRefPointer const&, QObject*, QV4::String*, QFlagsQV4::QObjectWrapper::Flag, QV4::Value const&) at /usr/bin/../lib/libQt6Qml.so.6
#42 0x00007f35395e4117 in QV4::QObjectWrapper::virtualPut(QV4::Managed*, QV4::PropertyKey, QV4::Value const&, QV4::Value*) at /usr/bin/../lib/libQt6Qml.so.6
#43 0x00007f35395b841c in QV4::Lookup::setterFallback(QV4::Lookup*, QV4::ExecutionEngine*, QV4::Value&, QV4::Value const&) at /usr/bin/../lib/libQt6Qml.so.6
#44 0x00007f351e354c82
#45 0x00007f353964e265 at /usr/bin/../lib/libQt6Qml.so.6
#46 0x00007f35395962ff at /usr/bin/../lib/libQt6Qml.so.6
#47 0x00007f353959c908 in QV4::Function::call(QObject*, void**, QMetaType const*, int, QV4::ExecutionContext*) at /usr/bin/../lib/libQt6Qml.so.6
#48 0x00007f35396f32af in QQmlJavaScriptExpression::evaluate(void**, QMetaType const*, int) at /usr/bin/../lib/libQt6Qml.so.6
#49 0x00007f353968a149 in QQmlBoundSignalExpression::evaluate(void**) at /usr/bin/../lib/libQt6Qml.so.6
#50 0x00007f353968f80c at /usr/bin/../lib/libQt6Qml.so.6
#51 0x00007f353971cf57 in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#52 0x00007f3538bd8b81 at /usr/bin/../lib/libQt6Core.so.6
#53 0x00007f35397e2161 in QQmlVMEMetaObject::metaCall(QObject*, QMetaObject::Call, int, void**) at /usr/bin/../lib/libQt6Qml.so.6
#54 0x00007f3539736d02 at /usr/bin/../lib/libQt6Qml.so.6
#55 0x00007f35395e6d50 in QV4::QObjectMethod::callPrecise(QQmlObjectOrGadget const&, QQmlPropertyData const&, QV4::ExecutionEngine*, QV4::CallData*, QMetaObject::Call) at /usr/bin/../lib/libQt6Qml.so.6
#56 0x00007f35395f0b94 in QV4::QObjectMethod::callInternal(QV4::Value const*, QV4::Value const*, int) const at /usr/bin/../lib/libQt6Qml.so.6
#57 0x00007f353960ea1c in QV4::Runtime::CallPropertyLookup::call(QV4::ExecutionEngine*, QV4::Value const&, unsigned int, QV4::Value*, int) at /usr/bin/../lib/libQt6Qml.so.6
#58 0x00007f351e354ae9
#59 0x00007f353964e265 at /usr/bin/../lib/libQt6Qml.so.6
#60 0x00007f35395962ff at /usr/bin/../lib/libQt6Qml.so.6
#61 0x00007f353959c908 in QV4::Function::call(QObject*, void**, QMetaType const*, int, QV4::ExecutionContext*) at /usr/bin/../lib/libQt6Qml.so.6
#62 0x00007f35396f32af in QQmlJavaScriptExpression::evaluate(void**, QMetaType const*, int) at /usr/bin/../lib/libQt6Qml.so.6
#63 0x00007f353968a149 in QQmlBoundSignalExpression::evaluate(void**) at /usr/bin/../lib/libQt6Qml.so.6
#64 0x00007f353968f80c at /usr/bin/../lib/libQt6Qml.so.6
#65 0x00007f353971cf57 in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**) at /usr/bin/../lib/libQt6Qml.so.6
#66 0x00007f3538bd8b81 at /usr/bin/../lib/libQt6Core.so.6
#67 0x00007f353a5ae2bb in QQuickMouseArea::setPressed(Qt::MouseButton, bool, Qt::MouseEventSource) at /usr/bin/../lib/libQt6Quick.so.6
#68 0x00007f353a5ae5e0 in QQuickMouseArea::mouseReleaseEvent(QMouseEvent*) at /usr/bin/../lib/libQt6Quick.so.6
#69 0x00007f353a57e5b6 in QQuickItemPrivate::deliverPointerEvent(QEvent*) at /usr/bin/../lib/libQt6Quick.so.6
#70 0x00007f353a587622 in QQuickItem::event(QEvent*) at /usr/bin/../lib/libQt6Quick.so.6
#71 0x00007f353ad0337f in QApplicationPrivate::notify_helper(QObject*, QEvent*) at /usr/bin/../lib/libQt6Widgets.so.6
#72 0x00007f3538b6bf47 in QCoreApplication::notifyInternal2(QObject*, QEvent*) at /usr/bin/../lib/libQt6Core.so.6
#73 0x00007f353a78368f in QQuickDeliveryAgentPrivate::deliverMatchingPointsToItem(QQuickItem*, bool, QPointerEvent*, bool) at /usr/bin/../lib/libQt6Quick.so.6
#74 0x00007f353a783d89 in QQuickDeliveryAgentPrivate::deliverUpdatedPoints(QPointerEvent*) at /usr/bin/../lib/libQt6Quick.so.6
#75 0x00007f353a785bb5 in QQuickDeliveryAgentPrivate::deliverPointerEvent(QPointerEvent*) at /usr/bin/../lib/libQt6Quick.so.6
#76 0x00007f353a786553 in QQuickDeliveryAgentPrivate::handleMouseEvent(QMouseEvent*) at /usr/bin/../lib/libQt6Quick.so.6
#77 0x00007f353a77b6b2 in QQuickDeliveryAgent::event(QEvent*) at /usr/bin/../lib/libQt6Quick.so.6
#78 0x00007f353a64e1db in QQuickWindow::event(QEvent*) at /usr/bin/../lib/libQt6Quick.so.6
#79 0x00007f353ad0337f in QApplicationPrivate::notify_helper(QObject*, QEvent*) at /usr/bin/../lib/libQt6Widgets.so.6
#80 0x00007f3538b6bf47 in QCoreApplication::notifyInternal2(QObject*, QEvent*) at /usr/bin/../lib/libQt6Core.so.6
#81 0x00007f3539ba7fa7 in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) at /usr/bin/../lib/libQt6Gui.so.6
#82 0x00007f3539c2c3ab in QWindowSystemInterface::sendWindowSystemEvents(QFlagsQEventLoop::ProcessEventsFlag) at /usr/bin/../lib/libQt6Gui.so.6
#83 0x00007f353a133cd3 at /usr/bin/../lib/libQt6Gui.so.6
#84 0x00007f353b4e7f4c at /usr/bin/../lib/libglib-2.0.so.0
#85 0x00007f353b4e9616 at /usr/bin/../lib/libglib-2.0.so.0
#86 0x00007f353b4e9824 in g_main_context_iteration at /usr/bin/../lib/libglib-2.0.so.0
#87 0x00007f3538e4fcb1 in QEventDispatcherGlib::processEvents(QFlagsQEventLoop::ProcessEventsFlag) at /usr/bin/../lib/libQt6Core.so.6
#88 0x00007f3538b76cf5 in QEventLoop::exec(QFlagsQEventLoop::ProcessEventsFlag) at /usr/bin/../lib/libQt6Core.so.6
#89 0x00007f3538b709f0 in QCoreApplication::exec() at /usr/bin/../lib/libQt6Core.so.6
#90 0x000055638aea3be7 in qs::launch::launch(qs::launch::LaunchArgs const&, char**, QCoreApplication*) at /home/magum/.cache/yay/quickshell-git/src/quickshell/src/launch/launch.cpp:310:35
#91 0x000055638ae974cc in launchFromCommand at /home/magum/.cache/yay/quickshell-git/src/quickshell/src/launch/command.cpp:445:15
#92 0x000055638ae9aaab in qs::launch::runCommand(int, char**, QCoreApplication*) at /home/magum/.cache/yay/quickshell-git/src/quickshell/src/launch/command.cpp:543:27
#93 (inlined) in qs::launch::main(int, char**) at /home/magum/.cache/yay/quickshell-git/src/quickshell/src/launch/main.cpp:123:24
#94 0x000055638ae85a96 in main at /home/magum/.cache/yay/quickshell-git/src/quickshell/src/main.cpp:3:58
#95 0x00007f35384366c0 at /usr/bin/../lib/libc.so.6
#96 0x00007f35384367f8 in __libc_start_main at /usr/bin/../lib/libc.so.6
#97 0x000055638ae88574 in _start at /usr/bin/quickshell

Report file

report.txt

Log file

log.qslog.log

Configuration

No response

Backtrace

No response

[glempi]

https://github.com/copilot/share/c0740220-0120-88b1-9802-ac4540ab282c

[glempi]

Analysis by Claude Opus 4.6:

Now let me look more closely at the DMS settings code that handles the fingerprint toggling and the scheduleAuthApply mechanism, since the crash happens during settings manipulation.Now let me look at the key areas related to the crash - the SettingsData.set() function and the Spec.set() implementation, since the crash happens when toggling settings:Now let me look at the LockScreenContent.qml to understand the interaction between the settings and the lock screen that's involved in the crash path.Now I have a comprehensive understanding of the crash. Let me look at the specific area where the crash happens — the LockScreenContent.qml around the settings manipulation and the SettingsToggleRow components, particularly focusing on the signal chain that leads to the crash.Now I have a comprehensive picture of the crash. Let me analyze the findings.

Research Summary: Crash Root Cause Analysis

What failed

Segmentation fault in QV4::Object::insertMember() — the Qt/QML JavaScript engine tried to insert a property into a V4 object that was in an invalid/corrupted state (null or already-freed memory).

The crash chain (reading the stack trace bottom-to-top)

1. User action (frames 67–69): A mouse click release on a QQuickMouseArea inside the DMS Settings UI (Lock Screen tab area).

2. Signal handler fires (frames 63–65): The onClicked/onToggled handler executes — most likely toggling enableFprint or another lock-screen auth setting.

3. Setting value written (frames 40–43): SettingsData.set("enableFprint", checked) writes a new value to a QML property via QV4::QObjectWrapper::setProperty.

4. Binding cascade (frames 28–39): The property change triggers a chain of QQmlBinding::update calls — reactive bindings re-evaluate. Specifically, enableFprint has onChange: "scheduleAuthApply" in SettingsSpec.js (line 363), and the Pam.qml component has a Connections handler onEnableFprintChanged that calls fprint.checkAvail().

5. Loader activates (frames 23–25): QQuickLoader::setActive(true) is called. This is the critical frame — a Loader component transitions to active during the binding cascade. Based on the code, this is most likely the lockScreenLoader in SettingsContent.qml (active when currentIndex === 11), or one of the Loaders inside LockScreenContent.qml whose active property is bound to reactive settings (e.g., the notification mode loader, the wallpaper backdrop loader, or the video screensaver loader).

6. Component incubation (frames 20–22): QQmlComponent::create → QQmlIncubatorPrivate::incubate — the Loader begins creating QML component instances.

7. Signal during creation (frames 15–18): During QQmlObjectCreator::finalize, a bound signal fires (QQmlBoundSignalExpression::evaluate → QQmlNotifier::emitNotify). This is the finalization phase where Component.onCompleted handlers and initial signal emissions run.

8. JavaScript puts property on invalid object (frames 1–6): QV4::Runtime::StoreElement::call → QV4::Object::internalPut → QV4::Object::insertMember — the code tries to store a value (likely array element assignment) into a V4 JavaScript object whose memory is corrupted/freed → SIGSEGV.

Root cause hypothesis

A race condition / re-entrancy problem during QML component lifecycle. Here's what happens:

1. The user toggles a setting in the Lock Screen tab (e.g., enableFprint).
2. The onChange: "scheduleAuthApply" hook fires synchronously via SettingsSpec.set() (line 559–567 of SettingsSpec.js).
3. scheduleAuthApply() calls Processes.scheduleAuthApply() which triggers detectAuthCapabilities() and recomputeAuthCapabilities().
4. These capability recomputation functions update properties like lockFingerprintReady, lockFingerprintReason, etc., which are all bound to UI elements in the Lock Screen settings tab.
5. Some of these property changes cause Loader components to change their active state (e.g., Loaders whose active is bound to computed visibility conditions).
6. During the Loader's component creation/finalization phase, Component.onCompleted handlers fire and attempt to access or modify JavaScript arrays/objects that are either:
   • Already being modified by the outer binding cascade (re-entrancy)
   • Being garbage-collected because the old component instance is being destroyed while the new one is being created

The specific crash in insertMember during StoreElement::call strongly suggests a JavaScript array or object is being written to after its backing V4 heap object has been freed — classic use-after-free in the QML engine, often triggered by destroying and recreating components during binding evaluation.

Confidence level

Medium-High. The pattern is a well-known class of QML engine crash — re-entrant component creation/destruction during property binding cascades. The exact triggering sequence cannot be pinpointed without runtime debugging, but the stack trace clearly shows the pattern: mouse click → setting change → binding cascade → Loader activation → component creation → signal during finalization → crash writing to freed object.

Who should fix this

This is primarily a DMS (DankMaterialShell) issue, not a Quickshell engine bug. The DMS settings code allows synchronous side effects (scheduleAuthApply → detectAuthCapabilities) during a setting change that can trigger Loader state changes during binding evaluation. The fix needs to be in the DMS QML code.

Suggested fix directions

1. Defer Loader state changes: Ensure that property changes which affect Loader active bindings don't happen synchronously inside a signal handler cascade. Use Qt.callLater() more aggressively around recomputeAuthCapabilities() and the functions that update lockFingerprintReady, lockFingerprintCanEnable, etc.

2. Break the synchronous chain: In SettingsSpec.js, the set() function (line 559) calls the onChange hook synchronously before returning. Consider making scheduleAuthApply truly asynchronous (it already uses a Timer debounce, but the initial detectAuthCapabilities() call from refreshAuthAvailability() in LockScreenTab.qml line 48 can still trigger synchronous recomputation).

3. Guard against re-entrancy in Processes.qml: Add a re-entrancy guard around recomputeAuthCapabilities() / recomputeFingerprintCapabilities() to prevent nested execution.

4. Use asynchronous: true on the lock screen Loader: The lockScreenLoader in SettingsContent.qml doesn't set asynchronous, meaning component creation is synchronous and can cause the finalization signals to fire during the same call stack. Setting asynchronous: true would break the chain.

This crash is intermittent — it depends on the exact timing of which bindings re-evaluate and whether a Loader transitions during the cascade, which is why it happens "during manipulation" rather than on every toggle.