Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4852GitHub issuePublicReceived

quickshell SIGSEGV in VDMListDelegateDataType::createMissingProperties when PipeWire restarts with cachedAudioSinks

Reported by dorsetineb · filed Sep 3, 2026Closed upstream on 2026-09-20 by bjarneo via an automated message, as a duplicate of #6952 (R-1843). GitHub close reason: completed.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

quickshell SIGSEGV in VDMListDelegateDataType::createMissingProperties when PipeWire restarts with cachedAudioSinksrevision 1 · captured 2026-10-04 12:10 UTC via poll

System details

  • Omarchy version: 4.0.2-1
  • Quickshell: 0.3.1-1
  • Qt: 6.11.2-1
  • PipeWire: 1.6.8-1

What happened?

When PipeWire restarts or disconnects while quickshell is running, quickshell crashes with SIGSEGV (signal 11) inside libQt6QmlModels.so.6.

What was expected?

Quickshell should handle the PipeWire disconnect/reconnect gracefully without crashing.

Steps to reproduce

  1. Run Quickshell with the Omarchy shell: quickshell -n -p /usr/share/omarchy/shell
  2. Open the audio panel (or have audio sinks populated in cachedAudioSinks)
  3. Restart PipeWire: systemctl --user restart pipewire wireplumber
  4. Quickshell crashes with SIGSEGV.

Stack trace

#0  VDMListDelegateDataType::createMissingProperties (this=..., row=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldmlistaccessordata_p.h:222
#1  VDMListDelegateDataType::toDynamicMetaObject (this=..., object=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldmlistaccessordata.cpp:157
#2  qQmlPropertyCacheProperty<QV4::String const*> (...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlpropertycache.cpp:1059
#3  QQuickRepeater::regenerate() at /usr/lib/libQt6Quick.so.6
#4  QQuickRepeater::setModel(...) at /usr/lib/libQt6Quick.so.6
#5  QQmlTimer::event(QEvent*) at /usr/lib/libQt6QmlMeta.so.6

Root Cause

In shell/plugins/panels/audio/Panel.qml:
1. audioSinks falls back to cachedAudioSinks when rawAudioSinks.length === 0:

   readonly property var audioSinks: rawAudioSinks.length > 0 ? rawAudioSinks : cachedAudioSinks
  1. When PipeWire disconnects or restarts, rawAudioSinks becomes empty, causing audioSinks to fall back to cachedAudioSinks.
  2. However, cachedAudioSinks retains references to the now-deleted C++ PwNode instances. In Qt's QML engine, references to destroyed QObjects convert to null pointers when passed into QVariant models.
  3. When audioModelRefreshTimer triggers refreshDisplayAudioModels(), displayAudioSinks is assigned this list of destroyed objects.
  4. When Repeater { model: root.displayAudioSinks } regenerates, Qt's VDMListDelegateDataType::createMissingProperties unconditionally calls row->value<QObject *>()->metaObject() on a null QObject*, causing an immediate null pointer dereference (SIGSEGV).

Proposed Solution

In shell/plugins/panels/audio/Panel.qml:
- Clear cachedAudioSinks and cachedAudioSources when the PipeWire service disconnects or drops its nodes.
- Filter out destroyed/null nodes before assigning to displayAudioSinks / displayAudioSources.

Filed by Gemini 3.8 Flash (High) via Antigravity.
View raw text
### System details
- Omarchy version: 4.0.2-1
- Quickshell: 0.3.1-1
- Qt: 6.11.2-1
- PipeWire: 1.6.8-1

### What happened?
When PipeWire restarts or disconnects while `quickshell` is running, `quickshell` crashes with `SIGSEGV` (signal 11) inside `libQt6QmlModels.so.6`.

### What was expected?
Quickshell should handle the PipeWire disconnect/reconnect gracefully without crashing.

### Steps to reproduce
1. Run Quickshell with the Omarchy shell: `quickshell -n -p /usr/share/omarchy/shell`
2. Open the audio panel (or have audio sinks populated in `cachedAudioSinks`)
3. Restart PipeWire: `systemctl --user restart pipewire wireplumber`
4. Quickshell crashes with SIGSEGV.

### Stack trace
```text
#0  VDMListDelegateDataType::createMissingProperties (this=..., row=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldmlistaccessordata_p.h:222
#1  VDMListDelegateDataType::toDynamicMetaObject (this=..., object=...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qmlmodels/qqmldmlistaccessordata.cpp:157
#2  qQmlPropertyCacheProperty<QV4::String const*> (...)
    at /usr/src/debug/qt6-declarative/qtdeclarative/src/qml/qml/qqmlpropertycache.cpp:1059
#3  QQuickRepeater::regenerate() at /usr/lib/libQt6Quick.so.6
#4  QQuickRepeater::setModel(...) at /usr/lib/libQt6Quick.so.6
#5  QQmlTimer::event(QEvent*) at /usr/lib/libQt6QmlMeta.so.6
```

### Root Cause
In `shell/plugins/panels/audio/Panel.qml`:
1. `audioSinks` falls back to `cachedAudioSinks` when `rawAudioSinks.length === 0`:
   ```qml
   readonly property var audioSinks: rawAudioSinks.length > 0 ? rawAudioSinks : cachedAudioSinks
   ```
2. When PipeWire disconnects or restarts, `rawAudioSinks` becomes empty, causing `audioSinks` to fall back to `cachedAudioSinks`.
3. However, `cachedAudioSinks` retains references to the now-deleted C++ `PwNode` instances. In Qt's QML engine, references to destroyed QObjects convert to null pointers when passed into QVariant models.
4. When `audioModelRefreshTimer` triggers `refreshDisplayAudioModels()`, `displayAudioSinks` is assigned this list of destroyed objects.
5. When `Repeater { model: root.displayAudioSinks }` regenerates, Qt's `VDMListDelegateDataType::createMissingProperties` unconditionally calls `row->value<QObject *>()->metaObject()` on a null `QObject*`, causing an immediate null pointer dereference (`SIGSEGV`).

### Proposed Solution
In `shell/plugins/panels/audio/Panel.qml`:
- Clear `cachedAudioSinks` and `cachedAudioSources` when the PipeWire service disconnects or drops its nodes.
- Filter out destroyed/null nodes before assigning to `displayAudioSinks` / `displayAudioSources`.

> Filed by Gemini 3.8 Flash (High) via Antigravity.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.