segfault using PyQt6 version 6.10.1

[Dmitry Shachnev]

On Wed, Dec 24, 2025 at 12:00:21AM +0300, Dmitry Shachnev wrote:
> Similar crashes (in QtWaylandClient::QWaylandClipboard::setMimeData) were
> reported in Debian:
> 
> - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123850
> - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123860
> 
> And in Debian the Qt version is still 6.9.2, so it looks like a regression
> in PyQt or SIP, not in Qt.
> 
> According to the reporter, downgrading PyQt from v6.10.1 to v6.10.0 helps.
> 
> PyQt v6.10.0 was built using SIP v6.14.0.
> PyQt v6.10.1 was built using SIP v6.15.0 + commit 79da3321082f17d5 backported.

Rebuilding PyQt with SIP v6.15.1 does not help.

I attached a valgrind stacktrace. I believe it may be helpful, since it shows
that PyQt code deleted an object which is later used by Qt code.

--
Dmitry Shachnev
-------------- next part --------------
Invalid read of size 8
   at 0x10DBF232: QtWaylandClient::QWaylandClipboard::setMimeData(QMimeData*, QClipboard::Mode) (qwaylandclipboard.cpp:90)
   by 0xAEA2D2E: QWidgetTextControlPrivate::mouseReleaseEvent(QEvent*, Qt::MouseButton, QPointF const&, QFlags<Qt::KeyboardModifier>, QFlags<Qt::MouseButton>, QPoint const&) (qwidgettextcontrol.cpp:1795)
   by 0xAEA7513: QWidgetTextControl::processEvent(QEvent*, QTransform const&, QWidget*) (qwidgettextcontrol.cpp:1048)
   by 0xAE9BBDA: QWidgetTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qwidgettextcontrol.cpp:994)
   by 0xAE76FBC: UnknownInlinedFun (qplaintextedit_p.h:108)
   by 0xAE76FBC: QPlainTextEdit::mouseReleaseEvent(QMouseEvent*) (qplaintextedit.cpp:2073)
   by 0xA72CBB2: sipQPlainTextEdit::mouseReleaseEvent(QMouseEvent*) (sipQtWidgetsQPlainTextEdit.cpp:781)
   by 0xAC8FE76: QWidget::event(QEvent*) (qwidget.cpp:8983)
   by 0xACF3801: QFrame::event(QEvent*) (qframe.cpp:521)
   by 0xA730282: sipQPlainTextEdit::viewportEvent(QEvent*) (sipQtWidgetsQPlainTextEdit.cpp:1338)
   by 0x9B9C559: QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (qcoreapplication.cpp:1243)
   by 0xAC37C37: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3294)
   by 0xAC3CA6E: QApplication::notify(QObject*, QEvent*) (qapplication.cpp:2777)
 Address 0x95ad470 is 0 bytes inside a block of size 40 free'd
   at 0x484C86D: operator delete(void*, unsigned long) (vg_replace_malloc.c:1181)
   by 0x6416A1D: forgetObject (sip_core.c:10140)
   by 0x6416A83: sipWrapper_dealloc (sip_core.c:9785)
   by 0x5E45C5: subtype_dealloc.lto_priv.0 (typeobject.c:2389)
   by 0x64112F3: Py_DECREF (object.h:954)
   by 0x64112F3: sip_api_parse_result_ex (sip_core.c:2434)
   by 0xA633AE3: sipVH_QtWidgets_183(PyGILState_STATE, void (*)(_sipSimpleWrapper*, PyGILState_STATE), _sipSimpleWrapper*, _object*) (sipQtWidgetscmodule.cpp:5128)
   by 0xA72B7B5: sipQPlainTextEdit::createMimeDataFromSelection() const (sipQtWidgetsQPlainTextEdit.cpp:490)
   by 0xAE9B8E8: QWidgetTextControlPrivate::setClipboardSelection() (qwidgettextcontrol.cpp:641)
   by 0xAEA2D2E: QWidgetTextControlPrivate::mouseReleaseEvent(QEvent*, Qt::MouseButton, QPointF const&, QFlags<Qt::KeyboardModifier>, QFlags<Qt::MouseButton>, QPoint const&) (qwidgettextcontrol.cpp:1795)
   by 0xAEA7513: QWidgetTextControl::processEvent(QEvent*, QTransform const&, QWidget*) (qwidgettextcontrol.cpp:1048)
   by 0xAE9BBDA: QWidgetTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qwidgettextcontrol.cpp:994)
   by 0xAE76FBC: UnknownInlinedFun (qplaintextedit_p.h:108)
   by 0xAE76FBC: QPlainTextEdit::mouseReleaseEvent(QMouseEvent*) (qplaintextedit.cpp:2073)
 Block was alloc'd at
   at 0x4848F93: operator new(unsigned long) (vg_replace_malloc.c:487)
   by 0x982D979: init_type_QMimeData (sipQtCoreQMimeData.cpp:1005)
   by 0x982D979: init_type_QMimeData (sipQtCoreQMimeData.cpp:998)
   by 0x6416F4D: sipSimpleWrapper_init (sip_core.c:8826)
   by 0x551FCF: UnknownInlinedFun (typeobject.c:1998)
   by 0x551FCF: _PyObject_MakeTpCall (call.c:242)
   by 0x56E63D: _PyEval_EvalFrameDefault (generated_cases.c.h:813)
   by 0x5DBB49: UnknownInlinedFun (pycore_call.h:168)
   by 0x5DBB49: method_vectorcall.lto_priv.0 (classobject.c:71)
   by 0x640FB8B: call_method (sip_core.c:1991)
   by 0x640FDFC: sip_api_call_method (sip_core.c:2046)
   by 0xA633AAD: sipVH_QtWidgets_183(PyGILState_STATE, void (*)(_sipSimpleWrapper*, PyGILState_STATE), _sipSimpleWrapper*, _object*) (sipQtWidgetscmodule.cpp:5126)
   by 0xA72B7B5: sipQPlainTextEdit::createMimeDataFromSelection() const (sipQtWidgetsQPlainTextEdit.cpp:490)
   by 0xAE9B8E8: QWidgetTextControlPrivate::setClipboardSelection() (qwidgettextcontrol.cpp:641)
   by 0xAEA2D2E: QWidgetTextControlPrivate::mouseReleaseEvent(QEvent*, Qt::MouseButton, QPointF const&, QFlags<Qt::KeyboardModifier>, QFlags<Qt::MouseButton>, QPoint const&) (qwidgettextcontrol.cpp:1795)


Process terminating with default action of signal 11 (SIGSEGV): dumping core
 Bad permissions for mapped region at address 0x73F6D00
   at 0x73F6D00: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.34)
   by 0x10DBF241: QtWaylandClient::QWaylandClipboard::setMimeData(QMimeData*, QClipboard::Mode) (qwaylandclipboard.cpp:90)
   by 0xAEA2D2E: QWidgetTextControlPrivate::mouseReleaseEvent(QEvent*, Qt::MouseButton, QPointF const&, QFlags<Qt::KeyboardModifier>, QFlags<Qt::MouseButton>, QPoint const&) (qwidgettextcontrol.cpp:1795)
   by 0xAEA7513: QWidgetTextControl::processEvent(QEvent*, QTransform const&, QWidget*) (qwidgettextcontrol.cpp:1048)
   by 0xAE9BBDA: QWidgetTextControl::processEvent(QEvent*, QPointF const&, QWidget*) (qwidgettextcontrol.cpp:994)
   by 0xAE76FBC: UnknownInlinedFun (qplaintextedit_p.h:108)
   by 0xAE76FBC: QPlainTextEdit::mouseReleaseEvent(QMouseEvent*) (qplaintextedit.cpp:2073)
   by 0xA72CBB2: sipQPlainTextEdit::mouseReleaseEvent(QMouseEvent*) (sipQtWidgetsQPlainTextEdit.cpp:781)
   by 0xAC8FE76: QWidget::event(QEvent*) (qwidget.cpp:8983)
   by 0xACF3801: QFrame::event(QEvent*) (qframe.cpp:521)
   by 0xA730282: sipQPlainTextEdit::viewportEvent(QEvent*) (sipQtWidgetsQPlainTextEdit.cpp:1338)
   by 0x9B9C559: QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) (qcoreapplication.cpp:1243)
   by 0xAC37C37: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3294)