https://bugs.kde.org/show_bug.cgi?id=523163
Bug ID: 523163
Summary: # plasmashell crashes with SIGSEGV when decoding HEIC
wallpapers after kf6-kimageformats 6.27.0 → 6.28.0
update ## Summary plasmashell (Plasma 6.7.2) reliably
crashes with SIGSEGV and enters a crash loop when the
desktop wallpaper slideshow directory con
Classification: Frameworks and Libraries
Product: frameworks-kimageformats
Version First 6.28.0
Reported In:
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected], [email protected]
Target Milestone: ---
## Summary
plasmashell (Plasma 6.7.2) reliably crashes with SIGSEGV and enters a crash
loop
when the desktop wallpaper slideshow directory contains HEIC/HEIF images. This
started immediately after updating `kf6-kimageformats` from 6.27.0-1 to
6.28.0-1 (pulled in as part of the routine KF6 6.27→6.28 update on Fedora 44).
Removing the HEIC files from the slideshow folder stops the crash loop
immediately; no other configuration change was made.
## Environment
- OS: Fedora Linux 44 (released, not Rawhide)
- Plasma: 6.7.2-2.fc44
- KDE Frameworks: 6.28.0-1.fc44 (upgraded from 6.27.0-1.fc44)
- kf6-kimageformats: 6.28.0-1.fc44 (upgraded from 6.27.0-1.fc44)
- libheif: 1.21.2-3.fc44 (libheif-freeworld, RPM Fusion)
- Qt: 6.11.1 (qt6-qtdeclarative upgraded 6.11.1-2 → 6.11.1-3 in the same
transaction)
- Session: Wayland
- GPU: NVIDIA, driver 610.43.03 (also upgraded in the same transaction)
- Package/transaction: `dnf update -y` on 2026-07-17, transaction ID 427
## Steps to Reproduce
1. Configure a desktop wallpaper slideshow (`org.kde.slideshow`) pointing to a
folder containing one or more `.HEIC` images alongside JPG/PNG images
(e.g. `~/Pictures/Wallpaper/`).
2. Let plasmashell start normally / let the slideshow rotate, or simply
restart plasmashell.
3. plasmashell crashes with SIGSEGV shortly after startup and re-crashes on
every automatic restart attempt (KCrash `crashRecursionCounter` climbs),
resulting in a full crash loop with no usable desktop shell.
## Actual Result
`plasmashell` dumps core with SIGSEGV. Multiple worker threads spawned by
`QtConcurrent` inside `libplasma_wallpaper_image.so` are concurrently
decoding images via `QImageReader`; several of them are inside `libheif`
(`ImageItem_Grid::decode_and_paste_tile_image`, `libde265` worker thread
pool) at the time of the crash. Removing the `.HEIC` files from the
slideshow source folder resolves the crash immediately and the desktop
returns to normal on the next plasmashell restart.
## Expected Result
plasmashell should decode or gracefully skip HEIC wallpaper images without
crashing.
## Backtrace (relevant threads, full coredumpctl output available on request)
```
Signal: 11 (SEGV)
Package: plasma-workspace-6.7.2-2.fc44
Stack trace of thread 8813 (future/thread join path):
#3 __pthread_clockjoin_ex (libc.so.6)
#4 std::thread::join() (libstdc++.so.6)
#7 std::future<Error>::get() (libheif.so.1)
#8 ImageItem_Grid::decode_compressed_image(...) (libheif.so.1)
#9 ImageItem::decode_image(...) (libheif.so.1)
#10 HeifContext::decode_image(...) (libheif.so.1)
#11 heif_decode_image (libheif.so.1)
#12 HEIFHandler::ensureDecoder() (kimg_heif.so)
#13 HEIFHandler::option(QImageIOHandler::ImageOption) (kimg_heif.so)
#14 QImageReader::size() const (libQt6Gui.so.6)
#15 loadImage(TransientImageOptions const&) (libplasma_wallpaper_image.so)
#16-19 QtConcurrent::RunFunctionTaskBase<QImage>::run() /
QThreadPoolThread::run() (libQt6Core.so.6)
Stack trace of thread 8822/8825 (concurrent grid-tile decode, memory alloc
path):
#4 operator new (libstdc++.so.6)
#5 std::_Rb_tree copy ctor (libheif.so.1)
#6 ImageItem_Grid::decode_and_paste_tile_image(...) (libheif.so.1)
#7 std::_Function_handler<...>::_M_invoke(...) (libheif.so.1)
#8 std::__future_base::_State_baseV2::_M_do_set(...) (libheif.so.1)
#11 std::__future_base::_Async_state_impl<...>::_M_run() (libheif.so.1)
Stack trace of thread 8823 (libde265 worker pool startup):
#3 thread_pool::start(int) (libde265.so.0)
#4 decoder_context::start_thread_pool(int) (libde265.so.0)
#5 de265_start_worker_threads (libde265.so.0)
#6 libde265_new_decoder2(...) (libheif-libde265.so)
#7 Decoder::decode_sequence_frame_from_compressed_data(...) (libheif.so.1)
#11 ImageItem_Grid::decode_and_paste_tile_image(...) (libheif.so.1)
```
Multiple additional QThreadPool worker threads (8792, 8793, 8810, 8811,
8812, 8814) are simultaneously inside `libpng`/`libjpeg`/`libheif` decoders,
all reached via `loadImage()` in `libplasma_wallpaper_image.so`, confirming
that the wallpaper slideshow plugin fires off many concurrent
`QImageReader` decode tasks — several of which are HEIC images entering
`libheif`'s own internal thread pool (`libde265` worker threads +
`std::future`/`std::async`) at the same time.
## Suspected Cause
This looks like a re-entrancy / thread-safety issue triggered by decoding
multiple grid-based HEIC images concurrently from separate `QtConcurrent`
worker threads: each concurrent HEIC decode spins up its own `libde265`
worker thread pool via `std::async`/`std::future`, and Plasma's wallpaper
slideshow plugin does not serialize or limit concurrent HEIF decodes. This
combination previously worked fine (same wallpaper folder, same HEIC files)
prior to the `kf6-kimageformats` 6.27.0 → 6.28.0 update, suggesting a
regression in the KImageFormats HEIF plugin (`kimg_heif.so`) — possibly
around `ensureDecoder()` / `canRead()` handling — introduced in that release,
rather than in `libheif` itself (which did not change version in the same
transaction).
## Workaround
Remove or convert `.HEIC`/`.heic` files out of any folder used as a Plasma
wallpaper slideshow source. Static (non-slideshow) wallpapers and
JPG/PNG-only slideshow folders are unaffected.
## Additional Notes
- `dnf history info 427` shows `kf6-kimageformats` upgraded 6.27.0-1.fc44 →
6.28.0-1.fc44 as part of the broader KF6 6.27→6.28 upgrade; `libheif` and
`libheif-freeworld` were *not* part of that transaction, pointing at
kimageformats/kimg_heif.so as the more likely regression source.
- Happy to attach the full coredump / run additional gdb `bt full` with
debuginfo installed if useful for triage.
--
You are receiving this mail because:
You are watching all bug changes.
