Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-175GitHub issuePublicDecided· Out of scope

quickshell SIGSEGV in Qt QML delegate-model code, preceded by TypeError in Bar.qml injectProps()

Reported by GanWeaving · filed Sep 23, 2026 · open at source

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

quickshell SIGSEGV in Qt QML delegate-model code, preceded by TypeError in Bar.qml injectProps()revision 1 · captured 2026-09-28 21:23 UTC via poll

What happened

quickshell segfaulted (SIGSEGV) while the bar's module Repeater was
regenerating/incubating delegate instances. Deep in the crash-handler-caught
stack, the real fault is in libQt6QmlModels.so.6, reached via
QV4::Runtime::TypeofName -> QV4::QObjectWrapper::getQmlProperty during
QQuickRepeater::regenerate -> incubate -> createInstance.

3 seconds before the crash, quickshell logged repeated TypeErrors from the
same bar:

WARN scene: @plugins/bar/Bar.qml[2004:-1]: TypeError: Cannot assign to
read-only property "moduleName" (exception occurred during delayed
function evaluation)

Bar.qml's injectProps() does:

if ("moduleName" in target) target.moduleName = moduleName

but CustomCommandModule (defined lower in the same file) declares:

readonly property string moduleName: root.entryId(entry)

The in check doesn't distinguish writable from read-only properties, so
this throws whenever the active bar item is a CustomCommandModule. This
looks like the trigger that put the Repeater's delegate-model incubation
into the state that crashed.

Expected

No crash. injectProps() shouldn't attempt to write read-only properties,
and even when a QML binding throws, Qt's Repeater/DelegateModel incubation
shouldn't segfault.

Environment

  • omarchy 4.0.4-1
  • quickshell 0.3.1-1
  • qt6-declarative / qt6-base 6.11.2-3
  • Arch Linux

Backtrace (top real frames, from a symbolized core)

QV4::Runtime::TypeofName::call
QV4::ExecutionContext::getProperty
QV4::QQmlContextWrapper::getPropertyAndBase
QV4::QObjectWrapper::getQmlProperty
libQt6QmlModels.so.6+0xb3f01 (unsymbolized, no debug info published)
libQt6QmlModels.so.6+0xb3530 (unsymbolized, no debug info published)
-- real SIGSEGV here, caught by quickshell's crash handler --
QQuickRepeater::regenerate
QQuickRepeater::setModel
QQmlBinding::update (triggered from QQmlTimer::event)

Filed by Claude Sonnet 5 via Claude Code.

View raw text
## What happened
quickshell segfaulted (SIGSEGV) while the bar's module Repeater was
regenerating/incubating delegate instances. Deep in the crash-handler-caught
stack, the real fault is in libQt6QmlModels.so.6, reached via
QV4::Runtime::TypeofName -> QV4::QObjectWrapper::getQmlProperty during
QQuickRepeater::regenerate -> incubate -> createInstance.

3 seconds before the crash, quickshell logged repeated TypeErrors from the
same bar:

  WARN scene: @plugins/bar/Bar.qml[2004:-1]: TypeError: Cannot assign to
  read-only property "moduleName" (exception occurred during delayed
  function evaluation)

Bar.qml's injectProps() does:

    if ("moduleName" in target) target.moduleName = moduleName

but CustomCommandModule (defined lower in the same file) declares:

    readonly property string moduleName: root.entryId(entry)

The `in` check doesn't distinguish writable from read-only properties, so
this throws whenever the active bar item is a CustomCommandModule. This
looks like the trigger that put the Repeater's delegate-model incubation
into the state that crashed.

## Expected
No crash. injectProps() shouldn't attempt to write read-only properties,
and even when a QML binding throws, Qt's Repeater/DelegateModel incubation
shouldn't segfault.

## Environment
- omarchy 4.0.4-1
- quickshell 0.3.1-1
- qt6-declarative / qt6-base 6.11.2-3
- Arch Linux

## Backtrace (top real frames, from a symbolized core)
QV4::Runtime::TypeofName::call
QV4::ExecutionContext::getProperty
QV4::QQmlContextWrapper::getPropertyAndBase
QV4::QObjectWrapper::getQmlProperty
libQt6QmlModels.so.6+0xb3f01 (unsymbolized, no debug info published)
libQt6QmlModels.so.6+0xb3530 (unsymbolized, no debug info published)
-- real SIGSEGV here, caught by quickshell's crash handler --
QQuickRepeater::regenerate
QQuickRepeater::setModel
QQmlBinding::update (triggered from QQmlTimer::event)

Filed by Claude Sonnet 5 via Claude Code.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 19:34 UTC