SegFault in QSortFilterProxyModelPrivate::build_source_to_proxy_mapping

[fanquake]

Moved from bitcoin/bitcoin#32957.

Is there an existing issue for this?

• I have searched the existing issues

Current behaviour

I was loading a bunch of old wallets sequentially using "bitcoin-cli loadwallet" in a loop. bitcoin-qt crashed shortly after finishing loading one wallet and starting to load the next.

The debug log shows this at the end:

2025-07-13T13:06:26Z init message: Rescanning…
2025-07-13T13:06:26Z [wallet23] Rescanning last 3130 blocks (from block 902235)...
2025-07-13T13:06:26Z [wallet23] Rescan started from block 00000000000000000001009ee18d68a681723b922e5b756aa89c513f28e15876... (fast variant using block filters)
2025-07-13T13:07:02Z [wallet23] Scanning current mempool transactions.
2025-07-13T13:07:02Z [wallet23] Rescan completed in           36695ms
2025-07-13T13:07:02Z [wallet23] setKeyPool.size() = 60000
2025-07-13T13:07:02Z [wallet23] mapWallet.size() = 303
2025-07-13T13:07:02Z [wallet23] m_address_book.size() = 16
2025-07-13T13:07:02Z Using SQLite Version 3.40.1
2025-07-13T13:07:02Z Using wallet /home/user/.bitcoin/wallets/wallet24
2025-07-13T13:07:02Z init message: Loading wallet…
2025-07-13T13:07:02Z [wallet24] Wallet file version = 10500, last client version = 280000

gdb shows this stack trace:

Thread 1 "bitcoin-qt-v29." received signal SIGSEGV, Segmentation fault.
QSortFilterProxyModelPrivate::build_source_to_proxy_mapping (proxy_to_source=..., source_to_proxy=..., this=this@entry=0x55555b826470)
    at ../../include/QtCore/../../src/corelib/tools/qarraydata.h:61
61      ../../include/QtCore/../../src/corelib/tools/qarraydata.h: No such file or directory.

(gdb) where
#0  QSortFilterProxyModelPrivate::build_source_to_proxy_mapping (proxy_to_source=..., source_to_proxy=..., this=this@entry=0x55555b826470)
    at ../../include/QtCore/../../src/corelib/tools/qarraydata.h:61
#1  0x00007ffff6682b97 in QSortFilterProxyModelPrivate::sort (this=0x55555b82b3e0) at itemmodels/qsortfilterproxymodel.cpp:634
#2  0x00005555557b4c54 in OverviewPage::setWalletModel (this=this@entry=0x7fff28023430, model=0x7ffb66326a30) at ./qt/overviewpage.cpp:269
#3  0x000055555577c395 in WalletView::WalletView (this=this@entry=0x55555b6ecec0, wallet_model=<optimized out>, _platformStyle=0x555556be0cf0, parent=<optimized out>)
    at ./qt/walletview.cpp:41
#4  0x00005555556ef343 in BitcoinGUI::addWallet (this=0x555556eafdc0, walletModel=<optimized out>) at ./qt/bitcoingui.cpp:739
#5  0x00005555556f478d in _ZZN7GUIUtil20ExceptionSafeConnectIP16WalletControllerMS1_FvP11WalletModelEP10BitcoinGUIMS7_FvS4_EEEDaT_T0_T1_T2_N2Qt14ConnectionTypeEENKUlDpOT_E_clIJRS4_EEEDaSJ_ (__closure=0x555556d431a0) at ./qt/guiutil.h:400
#6  _ZN9QtPrivate11FunctorCallINS_11IndexesListIJLi0EEEENS_4ListIJP11WalletModelEEEvZN7GUIUtil20ExceptionSafeConnectIP16WalletControllerMS9_FvS5_EP10BitcoinGUIMSD_FvS5_EEEDaT_T0_T1_T2_N2Qt14ConnectionTypeEEUlDpOT_E_E4callERSQ_PPv (arg=<optimized out>, f=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:146
#7  _ZN9QtPrivate7FunctorIZN7GUIUtil20ExceptionSafeConnectIP16WalletControllerMS3_FvP11WalletModelEP10BitcoinGUIMS9_FvS6_EEEDaT_T0_T1_T2_N2Qt14ConnectionTypeEEUlDpOT_E_Li1EE4callINS_4ListIJS6_EEEvEEvRSM_PvPSS_ (arg=<optimized out>, f=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:256
#8  _ZN9QtPrivate18QFunctorSlotObjectIZN7GUIUtil20ExceptionSafeConnectIP16WalletControllerMS3_FvP11WalletModelEP10BitcoinGUIMS9_FvS6_EEEDaT_T0_T1_T2_N2Qt14ConnectionTypeEEUlDpOT_E_Li1ENS_4ListIJS6_EEEvE4implEiPNS_15QSlotObjectBaseEP7QObjectPPvPb (which=<optimized out>, this_=0x555556d43190, r=<optimized out>, a=<optimized out>,
    ret=<optimized out>) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:443
#9  0x00007ffff66dd730 in QObject::event (this=0x555556eafdc0, e=0x7ffb65750450) at kernel/qobject.cpp:1347
#10 0x00007ffff7962fae in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x555556eafdc0, e=0x7ffb65750450) at kernel/qapplication.cpp:3640
#11 0x00007ffff66b1738 in QCoreApplication::notifyInternal2 (receiver=0x555556eafdc0, event=0x7ffb65750450) at kernel/qcoreapplication.cpp:1064
#12 0x00007ffff66b18fe in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462
#13 0x00007ffff66b46c1 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x555556955090) at kernel/qcoreapplication.cpp:1821
#14 0x00007ffff66b4b48 in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>) at kernel/qcoreapplication.cpp:1680
#15 0x00007ffff670a193 in postEventSourceDispatch (s=0x555556a5ac20) at kernel/qeventdispatcher_glib.cpp:277
#16 0x00007ffff571e749 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#17 0x00007ffff571e9d8 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007ffff571ea6c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#19 0x00007ffff6709876 in QEventDispatcherGlib::processEvents (this=0x555556a0b3a0, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#20 0x00007ffff66b01bb in QEventLoop::exec (this=this@entry=0x7fffffffd3b0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#21 0x00007ffff66b8316 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#22 0x00007ffff7130ecc in QGuiApplication::exec () at kernel/qguiapplication.cpp:1863
#23 0x00007ffff7962f25 in QApplication::exec () at kernel/qapplication.cpp:2832
#24 0x00005555556db812 in GuiMain (argc=2, argv=0x7fffffffdb88) at ./qt/bitcoin.cpp:691

Expected behaviour

I expect to be able to load wallets without a seg fault.

Steps to reproduce

This is the only time I've seen this crash.

Relevant log output

See above.

How did you obtain Bitcoin Core

Compiled from source

What version of Bitcoin Core are you using?

29.0.0

Operating system and version

Debian GNU/Linux 12 (bookworm)

Machine specifications

Debian/Intel SSD, hotel wifi

Plenty of RAM and swap

[fanquake]

I just had the same crash happen again. This time very shortly after starting bitcoin-qt, while it was still loading the mempool from disk. I ran the 'loadwallet' loop again, and it crashed on the 2nd wallet in the loop. There's one wallet loaded from bitcoin.conf where it says "wallet=wallet1". I waited for that to finish loading before starting the "bitcoin-cli loadwallet $w" loop.

Here's the debug.log:

2025-07-13T22:25:10Z Leaving InitialBlockDownload (latching to false)
2025-07-13T22:25:10Z init message: Done loading
2025-07-13T22:25:10Z msghand thread start
2025-07-13T22:25:10Z GUI: Platform customization: "other"
2025-07-13T22:25:20Z New block-relay-only v1 peer connected: version: 70016, blocks=905425, peer=2 peeraddr=[...].onion:8333
2025-07-13T22:25:22Z Saw new header hash=000000000000000000000be794d6abc522af0ee5493339cd9cad814becf3a487 height=905423
2025-07-13T22:25:22Z Saw new header hash=00000000000000000001cdb1472c8f573c91c13fac17411ab517e8f873b49701 height=905424
2025-07-13T22:25:22Z Saw new header hash=0000000000000000000199b08bd144cd4b838eb980ece4e25ea165c443f7d751 height=905425
2025-07-13T22:25:24Z New block-relay-only v1 peer connected: version: 70016, blocks=905425, peer=4 peeraddr=[...].onion:8333
2025-07-13T22:25:26Z Using SQLite Version 3.40.1
2025-07-13T22:25:26Z Using wallet /home/user/.bitcoin/wallets/wallet2
2025-07-13T22:25:26Z init message: Loading wallet…
2025-07-13T22:25:26Z [wallet2] Wallet file version = 10500, last client version = 290000
2025-07-13T22:25:34Z Progress loading mempool transactions from file: 10% (tried 5372, 48342 remaining)
2025-07-13T22:25:34Z New outbound-full-relay v2 peer connected: version: 70016, blocks=905425, peer=6 peeraddr=[...]:8333
2025-07-13T22:25:40Z [wallet2] Descriptors: 2, Descriptor Keys: 1 plaintext, 0 encrypted, 1 total.
2025-07-13T22:25:42Z [wallet2] Setting spkMan to active: id = [...], type = bech32m, internal = false
2025-07-13T22:25:42Z [wallet2] Setting spkMan to active: id = [...], type = bech32m, internal = true
2025-07-13T22:25:42Z [wallet2] Wallet completed loading in           16218ms
2025-07-13T22:25:42Z [wallet2] setKeyPool.size() = 60000
2025-07-13T22:25:42Z [wallet2] mapWallet.size() = 32
2025-07-13T22:25:42Z [wallet2] m_address_book.size() = 1
2025-07-13T22:25:49Z Using SQLite Version 3.40.1
2025-07-13T22:25:49Z Using wallet /home/user/.bitcoin/wallets/wallet3
2025-07-13T22:25:49Z init message: Loading wallet…
2025-07-13T22:25:49Z [wallet3] Wallet file version = 10500, last client version = 290000
2025-07-13T22:25:49Z Progress loading mempool transactions from file: 20% (tried 10743, 42971 remaining)
2025-07-13T22:25:55Z UpdateTip: new best=000000000000000000000be794d6abc522af0ee5493339cd9cad814becf3a487 height=905423 version=0x284ae000 log2_work=95.714191 tx=1213112057 date='2025-07-13T22:22:17Z' progress=0.999999 cache=8.7MiB(62718txo)
2025-07-13T22:25:55Z UpdateTip: new best=00000000000000000001cdb1472c8f573c91c13fac17411ab517e8f873b49701 height=905424 version=0x29a5e000 log2_work=95.714203 tx=1213116159 date='2025-07-13T22:22:45Z' progress=0.999999 cache=10.0MiB(72597txo)

And here's the stack trace, almost identical to the previous one:

Thread 1 "bitcoin-qt-v29." received signal SIGSEGV, Segmentation fault.
QSortFilterProxyModelPrivate::build_source_to_proxy_mapping (proxy_to_source=..., source_to_proxy=..., this=this@entry=0x5555575ad350) at ../../include/QtCore/../../src/corelib/tools/qarraydata.h:61
61      ../../include/QtCore/../../src/corelib/tools/qarraydata.h: No such file or directory.

(gdb) where
#0  QSortFilterProxyModelPrivate::build_source_to_proxy_mapping (proxy_to_source=..., source_to_proxy=..., this=this@entry=0x5555575ad350)
    at ../../include/QtCore/../../src/corelib/tools/qarraydata.h:61
#1  0x00007ffff6682b97 in QSortFilterProxyModelPrivate::sort (this=0x5555575b1d00) at itemmodels/qsortfilterproxymodel.cpp:634
#2  0x00005555557b4c54 in OverviewPage::setWalletModel (this=this@entry=0x555556d8ea80, model=0x7fffb5f226f0) at ./qt/overviewpage.cpp:269
#3  0x000055555577c395 in WalletView::WalletView (this=this@entry=0x555557171b40, wallet_model=<optimized out>, _platformStyle=0x555556bd92c0, parent=<optimized out>) at ./qt/walletview.cpp:41
#4  0x00005555556ef343 in BitcoinGUI::addWallet (this=0x555556ea9a00, walletModel=<optimized out>) at ./qt/bitcoingui.cpp:739
#5  0x00005555556f478d in _ZZN7GUIUtil20ExceptionSafeConnectIP16WalletControllerMS1_FvP11WalletModelEP10BitcoinGUIMS7_FvS4_EEEDaT_T0_T1_T2_N2Qt14ConnectionTypeEENKUlDpOT_E_clIJRS4_EEEDaSJ_ (
    __closure=0x555556d3ec00) at ./qt/guiutil.h:400
#6  _ZN9QtPrivate11FunctorCallINS_11IndexesListIJLi0EEEENS_4ListIJP11WalletModelEEEvZN7GUIUtil20ExceptionSafeConnectIP16WalletControllerMS9_FvS5_EP10BitcoinGUIMSD_FvS5_EEEDaT_T0_T1_T2_N2Qt14ConnectionTypeEEUlDpOT_E_E4callERSQ_PPv (arg=<optimized out>, f=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:146
#7  _ZN9QtPrivate7FunctorIZN7GUIUtil20ExceptionSafeConnectIP16WalletControllerMS3_FvP11WalletModelEP10BitcoinGUIMS9_FvS6_EEEDaT_T0_T1_T2_N2Qt14ConnectionTypeEEUlDpOT_E_Li1EE4callINS_4ListIJS6_EEEvEEvRSM_PvPSS_ (arg=<optimized out>, f=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:256
#8  _ZN9QtPrivate18QFunctorSlotObjectIZN7GUIUtil20ExceptionSafeConnectIP16WalletControllerMS3_FvP11WalletModelEP10BitcoinGUIMS9_FvS6_EEEDaT_T0_T1_T2_N2Qt14ConnectionTypeEEUlDpOT_E_Li1ENS_4ListIJS6_EEEvE4implEiPNS_15QSlotObjectBaseEP7QObjectPPvPb (which=<optimized out>, this_=0x555556d3ebf0, r=<optimized out>, a=<optimized out>, ret=<optimized out>)
    at /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:443
#9  0x00007ffff66dd730 in QObject::event (this=0x555556ea9a00, e=0x7fffb4913ca0) at kernel/qobject.cpp:1347
#10 0x00007ffff7962fae in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x555556ea9a00, e=0x7fffb4913ca0) at kernel/qapplication.cpp:3640
#11 0x00007ffff66b1738 in QCoreApplication::notifyInternal2 (receiver=0x555556ea9a00, event=0x7fffb4913ca0) at kernel/qcoreapplication.cpp:1064
#12 0x00007ffff66b18fe in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462
#13 0x00007ffff66b46c1 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x555556955090) at kernel/qcoreapplication.cpp:1821
#14 0x00007ffff66b4b48 in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>) at kernel/qcoreapplication.cpp:1680
#15 0x00007ffff670a193 in postEventSourceDispatch (s=0x555556a588d0) at kernel/qeventdispatcher_glib.cpp:277
#16 0x00007ffff571e749 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#17 0x00007ffff571e9d8 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007ffff571ea6c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#19 0x00007ffff6709876 in QEventDispatcherGlib::processEvents (this=0x5555569b15b0, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#20 0x00007ffff66b01bb in QEventLoop::exec (this=this@entry=0x7fffffffd3a0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#21 0x00007ffff66b8316 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#22 0x00007ffff7130ecc in QGuiApplication::exec () at kernel/qguiapplication.cpp:1863
#23 0x00007ffff7962f25 in QApplication::exec () at kernel/qapplication.cpp:2832
#24 0x00005555556db812 in GuiMain (argc=2, argv=0x7fffffffdb78) at ./qt/bitcoin.cpp:691
#25 0x00007ffff624624a in __libc_start_call_main (main=main@entry=0x55555568c860 <main(int, char**)>, argc=argc@entry=2, argv=argv@entry=0x7fffffffdb78) at ../sysdeps/nptl/libc_start_call_main.h:58
#26 0x00007ffff6246305 in __libc_start_main_impl (main=0x55555568c860 <main(int, char**)>, argc=2, argv=0x7fffffffdb78, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, 
    stack_end=0x7fffffffdb68) at ../csu/libc-start.c:360
#27 0x00005555556d35d1 in _start ()
(gdb) 

I will switch to using bitcoind instead of bitcoin-qt, because that will likely prevent the crash and allow me to get these rescans completed. If it there's anything useful I can do to help debug this, let me know and I'll try to trigger it again