Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Quickshell SIGSEGV in QQuickTextPrivate::updateLayout after invalid StyledText image URL
Reported by Mayor-OZ · filed Aug 30, 2026Closed upstream on 2026-09-21 by bjarneo via an automated message, as a duplicate of #8676 (R-1333). GitHub close reason: completed.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
Summary
Quickshell crashed twice with SIGSEGV in Qt Quick text-layout code. Immediately before each crash, Qt logged a warning about an invalid image URL in StyledText.
The crashing stack was identical both times and included:
QQuickTextPrivate::updateLayoutThis suggests malformed notification markup—possibly an <img> element with an invalid URL—reached Qt’s StyledText renderer and triggered the fault.
Relevant warning
Immediately before each crash, Qt reported an invalid image URL while processing StyledText.
Suspected source
Omarchy’s notification code appears to sanitize image tags from notification bodies:
var text = String(body || "").replace(/<img[^>]*>/gi, "")Despite this, Qt reported an invalid image URL immediately before each fault. An image tag may be bypassing the sanitizer, or another Omarchy text component may be interpreting external content as styled text.
Expected behavior
Malformed or unsupported notification markup should be sanitized or displayed as plain text without crashing the desktop shell.
Actual behavior
Qt Quick faults during text-layout recalculation, Quickshell dumps core, and the Omarchy shell restarts.
Frequency
Observed twice within 36 seconds with an identical stack and the same preceding StyledText warning.
I have not yet isolated a deterministic minimal notification payload.
Other checks
- This was not an OOM kill.
- Approximately 20 GiB of RAM was available.
- No kernel OOM events were recorded.
- No relevant package update or shell/config modification coincided with the crashes.
- No user-data loss was observed.
Possible mitigation
Ensure externally supplied notification summaries and bodies are either rendered as Text.PlainText or parsed with a stricter markup allowlist.
The segmentation fault may ultimately be an upstream Qt 6.11.2 bug, but Omarchy may be able to avoid feeding the triggering markup into that code path.
Related
#7750 also concerns Qt 6.11.2, but appears to be a different crash path involving QUntypedPropertyBinding during shell startup.
Filed by GPT-5 via Codex.
View raw text
## Summary Quickshell crashed twice with `SIGSEGV` in Qt Quick text-layout code. Immediately before each crash, Qt logged a warning about an invalid image URL in StyledText. The crashing stack was identical both times and included: ```text QQuickTextPrivate::updateLayout ``` This suggests malformed notification markup—possibly an `<img>` element with an invalid URL—reached Qt’s StyledText renderer and triggered the fault. ## Relevant warning Immediately before each crash, Qt reported an invalid image URL while processing StyledText. ## Suspected source Omarchy’s notification code appears to sanitize image tags from notification bodies: ```javascript var text = String(body || "").replace(/<img[^>]*>/gi, "") ``` Despite this, Qt reported an invalid image URL immediately before each fault. An image tag may be bypassing the sanitizer, or another Omarchy text component may be interpreting external content as styled text. ## Expected behavior Malformed or unsupported notification markup should be sanitized or displayed as plain text without crashing the desktop shell. ## Actual behavior Qt Quick faults during text-layout recalculation, Quickshell dumps core, and the Omarchy shell restarts. ## Frequency Observed twice within 36 seconds with an identical stack and the same preceding StyledText warning. I have not yet isolated a deterministic minimal notification payload. ## Other checks - This was not an OOM kill. - Approximately 20 GiB of RAM was available. - No kernel OOM events were recorded. - No relevant package update or shell/config modification coincided with the crashes. - No user-data loss was observed. ## Possible mitigation Ensure externally supplied notification summaries and bodies are either rendered as `Text.PlainText` or parsed with a stricter markup allowlist. The segmentation fault may ultimately be an upstream Qt 6.11.2 bug, but Omarchy may be able to avoid feeding the triggering markup into that code path. ## Related #7750 also concerns Qt 6.11.2, but appears to be a different crash path involving `QUntypedPropertyBinding` during shell startup. Filed by GPT-5 via Codex.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related PRpr/8472· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.