Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
quickshell segfaults in QML engine (typeof in fresh module context) during network panel Repeater incubation
Reported by wolflyfe · filed Sep 20, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
quickshell (0.3.1, Qt 6.11.2) segfaulted while running the default shell
config (/usr/share/omarchy/shell/shell.qml). It was long-running and idle;
the crash happened seconds after a Wi-Fi scan completed and NetworkManager
pushed a burst of access-point add/remove/property-change events.
quickshell's own crash handler caught the fault and wrote a report
(~/.cache/quickshell/crashes/<id>/report.txt). Symbolizing the coredump
(gdb + Arch's debuginfod) confirms qs::crash::signalHandler re-raised the
signal for the coredump after logging — the original fault is one frame
below it:
QQuickRepeater::setModel → regenerate → incubate → createInstance
→ createInternalContext → QV4::Module::evaluate()
→ Runtime::TypeofName::call() → ExecutionContext::getProperty()
→ QQmlContextWrapper::getPropertyAndBase() → QObjectWrapper::getQmlProperty()
→ [SIGSEGV inside libQt6QmlModels.so.6, delegate-model internals]
i.e. a Repeater's model changed, it began incubating a delegate, and while
evaluating a QML JS module for the first time in that fresh context, it
crashed evaluating a typeof expression. Qt's libQt6Qml.so.6 /libQt6QmlModels.so.6 have no debuginfod symbols on Arch, so the exact
internal function can't be named.
Likely trigger
plugins/panels/network/Model.js had, as a top-level statement:
if (typeof module !== "undefined") {
module.exports = { ... }
}
This is dead CommonJS/UMD boilerplate — module is never defined in a
quickshell JS-module context — but it means every fresh evaluation of this
module runs a typeof <undefined-name> check at module scope. That matches
the crash signature (TypeofName + Module::evaluate()) and the timing
(the network panel's model reacting to the AP list change right as it
crashed). I can't prove from the binary that this exact line executed (no
Qt debug symbols), but the static match plus timing is strong circumstantial
evidence.
System
- Omarchy 4.0.3, quickshell 0.3.1 (Arch build), Qt 6.11.2
- Single occurrence so far (not a repeating crash loop)
- No OOM, no other related crashes at the time
Fix applied locally
Removed the dead if (typeof module !== "undefined") { module.exports = ... }
guard from Model.js on the affected machine — it serves no purpose under
quickshell and appears to tickle a Qt QML engine sensitivity around typeof
during module-context creation inside Repeater delegate incubation. A local
edit to a package file will be reverted by the next update, so filing this
so the removal can land in the package itself.
Filed by Claude (Sonnet 5) via Claude Code.
View raw text
## What happened
quickshell (0.3.1, Qt 6.11.2) segfaulted while running the default shell
config (`/usr/share/omarchy/shell/shell.qml`). It was long-running and idle;
the crash happened seconds after a Wi-Fi scan completed and NetworkManager
pushed a burst of access-point add/remove/property-change events.
quickshell's own crash handler caught the fault and wrote a report
(`~/.cache/quickshell/crashes/<id>/report.txt`). Symbolizing the coredump
(gdb + Arch's debuginfod) confirms `qs::crash::signalHandler` re-raised the
signal for the coredump after logging — the original fault is one frame
below it:
QQuickRepeater::setModel → regenerate → incubate → createInstance
→ createInternalContext → QV4::Module::evaluate()
→ Runtime::TypeofName::call() → ExecutionContext::getProperty()
→ QQmlContextWrapper::getPropertyAndBase() → QObjectWrapper::getQmlProperty()
→ [SIGSEGV inside libQt6QmlModels.so.6, delegate-model internals]
i.e. a `Repeater`'s model changed, it began incubating a delegate, and while
evaluating a QML JS module for the first time in that fresh context, it
crashed evaluating a `typeof` expression. Qt's `libQt6Qml.so.6` /
`libQt6QmlModels.so.6` have no debuginfod symbols on Arch, so the exact
internal function can't be named.
## Likely trigger
`plugins/panels/network/Model.js` had, as a top-level statement:
if (typeof module !== "undefined") {
module.exports = { ... }
}
This is dead CommonJS/UMD boilerplate — `module` is never defined in a
quickshell JS-module context — but it means every fresh evaluation of this
module runs a `typeof <undefined-name>` check at module scope. That matches
the crash signature (`TypeofName` + `Module::evaluate()`) and the timing
(the network panel's model reacting to the AP list change right as it
crashed). I can't prove from the binary that this exact line executed (no
Qt debug symbols), but the static match plus timing is strong circumstantial
evidence.
## System
- Omarchy 4.0.3, quickshell 0.3.1 (Arch build), Qt 6.11.2
- Single occurrence so far (not a repeating crash loop)
- No OOM, no other related crashes at the time
## Fix applied locally
Removed the dead `if (typeof module !== "undefined") { module.exports = ... }`
guard from `Model.js` on the affected machine — it serves no purpose under
quickshell and appears to tickle a Qt QML engine sensitivity around `typeof`
during module-context creation inside Repeater delegate incubation. A local
edit to a package file will be reverted by the next update, so filing this
so the removal can land in the package itself.
---
Filed by Claude (Sonnet 5) via Claude Code.Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related PRpr/12892· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 16:52 UTC