GNOME Bugzilla – Bug 708289
GNOME Shell use-after-free crash on wakeup
Last modified: 2018-09-21 16:36:46 UTC
On waking from DPMS, I am seeing frequent shell crashes: Thread no. 1 (10 frames) #0 g_object_ref at gobject.c:2884 #1 fire_watch at gnome-idle-monitor.c:148 #2 g_list_foreach at glist.c:949 #3 handle_alarm_notify_event at gnome-idle-monitor.c:193 #4 xevent_filter at gnome-idle-monitor.c:215 #5 gdk_event_apply_filters at gdkeventsource.c:81 #6 gdk_event_source_translate_event at gdkeventsource.c:195 #7 _gdk_x11_display_queue_events at gdkeventsource.c:338 #8 gdk_display_get_event at gdkdisplay.c:313 #14 meta_run at core/main.c:556 See the downstream bug https://bugzilla.redhat.com/show_bug.cgi?id=982766 for full details, and valgrind output.
Created attachment 255221 [details] [review] idle-monitor: hold idle monitor ref across all alarm callbacks instad of each individually If one callback unrefs the monitor, we need to make sure it stays alive for the other callbacks in flight. This commit moves the ref/unref pair up a level to prevent the monitor from getting freed prematurely.
the above patch has not be tested, but seems plausible given the backtrace.
Thanks. I'm now running it on my laptop where I've been seeing the crash on about one in three wakeups, so if it does fix the problem then I'll fairly soon have some confidence in it.
(In reply to comment #1) > Created an attachment (id=255221) [details] [review] > idle-monitor: hold idle monitor ref across all alarm callbacks instad of each > individually > > If one callback unrefs the monitor, we need to make sure it stays alive > for the other callbacks in flight. > > This commit moves the ref/unref pair up a level to prevent the monitor > from getting freed prematurely. This patch surely looks correct, but we probably want to keep the monitor alive when freeing the watches too. See the investigation in bug 708420.
I've just seen another crash using the patch in comment #1. (gdb) t a a bt full
+ Trace 232521
Right, protecting the monitor is not enough, if we can still free the watches after they are extracted from the table but before they're invoked. I guess we need reference counting.
Any chance of an updated patch to test, please? This is still crashing gnome-shell extremely frequently when I wake the machine.
-- GitLab Migration Automatic Message -- This bug has been migrated to GNOME's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.gnome.org/GNOME/gnome-desktop/issues/52.