Three identical faults in dmesg over three days, all
`segfault at 8 ... libQt6QmlModels.so.6.11.1[420c5]`. `nm -DC` puts that
offset in `QQmlDelegateModel::model()`; the QVariant return means sret,
so %rsi is `this` and address 8 is a null pointer plus the member offset.
`QQuickItemView::model()` reads its d-pointer, checks a QPointer guard and
then calls straight through without testing the value.
The re-entry is `onContentYChanged`, not `onModelChanged` as first
assumed: `setModel()` emits it from inside the window where the old
delegate model is already gone. Switching to Labels re-derives the model
AND clamps contentY to a shorter list, which is the emit -- hence the
intermittency, since at contentY 0 nothing is emitted and nothing
crashes. Reproduced in plain qml6 with no app and no login, and bisected:
readback in onContentYChanged dies, in onModelChanged survives 401 swaps,
cached array survives everything.
The fix is to stop asking the view for its own model. A tree-wide audit
found `.model` is the only member that is unsafe this way in 6.11.1 --
count, contentHeight, indexAt and itemAtIndex all null-check -- and the
three LocalLibrary tabs already cached their arrays, which is why this
stayed a Library-only bug.
Also: `clip: true` is a RECTANGULAR scissor in Qt Quick and does not
follow `radius`, so the album/artist header band painted over the content
pane's rounded corners. Slint clips to the rounded shape on the same
element, which is why the identical structure is correct there. The mask
sits OUTSIDE the frame rather than at a high z, because ADR-009 pins
in-pane modals at z >= 3000 with no ceiling and a z fix would be a
standing arms race.
cc
vicrodh
d5bf4398ac