#1240 Qmmp 2.4.1 segfaults on startup when `shuffle=true` is set in `[PlayList]`

[Petra Wurstgesicht]

Qmmp 2.4.1 segfaults on startup when shuffle=true is set in [PlayList]

Summary

Qmmp 2.4.1 crashes with SIGSEGV during startup if shuffle=true is present in the
[PlayList] section of qmmp.conf. The crash happens before any window is shown.

This is self-inflicting: enabling shuffle through the UI writes shuffle=true to the
config, and Qmmp then fails to start on the next launch. The only way out is to edit
the configuration file by hand. Shuffle is effectively unusable.

Environment

• Qmmp 2.4.1 (Qt6)
• Arch-based distribution (CachyOS), x86_64_v3 package built 2026-08-30
• Qt 6, Wayland session
• Output plugin: PipeWire
• UI plugin: qsui ([Ui] current_plugin=qsui)

Steps to reproduce

1. Remove or rename ~/.config/qmmp so Qmmp starts with a fresh configuration.
2. Start Qmmp. It starts normally.
3. Enable shuffle in the UI.
4. Quit Qmmp.
5. Start Qmmp again.

Expected: Qmmp starts with shuffle enabled.
Actual: Qmmp terminates with SIGSEGV before the main window appears.

Removing the shuffle=true line from [PlayList] in ~/.config/qmmp/qmmp.conf
makes it start again. Adding the line back reproduces the crash reliably.

Minimal configuration that triggers the crash

Starting from a freshly generated qmmp.conf, adding a single line to [PlayList]
is enough:

[PlayList]
shuffle=true

The crash occurs regardless of the other [PlayList] keys. It was isolated by
bisecting the section line by line: every other key in the section can be present
without a crash.

Backtrace

Captured with coredumpctl info qmmp. Signal 11 (SEGV), si_code: SI_KERNEL.

Stack trace of thread 13894:
#0  0x00007fd31ece4924 n/a (libqmmpui.so.2 + 0x81924)
#1  0x00007fd31ece5120 _ZN13PlayListModelC1ERK7QStringP7QObject (libqmmpui.so.2 + 0x82120)
#2  0x00007fd31ed12cc9 n/a (libqmmpui.so.2 + 0xafcc9)
#3  0x00007fd31ed14aff _ZN15PlayListManagerC1EP7QObject (libqmmpui.so.2 + 0xb1aff)
#4  0x00007fd31ed01d9a _ZN11MediaPlayerC2EP7QObject (libqmmpui.so.2 + 0x9ed9a)
#5  0x0000558b3e4ff68d n/a (qmmp + 0x1268d)
#6  0x0000558b3e501f02 n/a (qmmp + 0x14f02)
#7  0x0000558b3e4f4e9e n/a (qmmp + 0x7e9e)
#8  0x00007fd31c627d0e n/a (libc.so.6 + 0x27d0e)
#9  0x00007fd31c627e4b __libc_start_main (libc.so.6 + 0x27e4b)
#10 0x0000558b3e4f54f5 n/a (qmmp + 0x84f5)

Demangled call path: MediaPlayer::MediaPlayer(QObject*) ->
PlayListManager::PlayListManager(QObject*) -> PlayListModel::PlayListModel(QString const&, QObject*) -> crash in a function within the same translation unit.

The remaining threads are idle at the time of the crash (Qt event dispatcher,
Wayland client, DBus), so this is a straight null dereference on the main thread
during construction, not a race.

Note

The crash is inside the PlayListModel constructor, which suggests the shuffle
state is read and acted upon while the model is still being set up — possibly
before the track list exists. This is a guess from the backtrace only; I have not
read the source.

Bugreport created with help of Claude Opus 5

[trialuser02]

Fixed by [r13267]. Thank you!