After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 787240 - SIGSEGV in in on_crtc_flipped (closure=<optimized out>, view=0x5579ea3462f0) at backends/native/meta-renderer-native.c:456
SIGSEGV in in on_crtc_flipped (closure=<optimized out>, view=0x5579ea3462f0)...
Status: RESOLVED FIXED
Product: mutter
Classification: Core
Component: general
git master
Other Linux
: Normal normal
: ---
Assigned To: mutter-maint
mutter-maint
Depends on:
Blocks:
 
 
Reported: 2017-09-04 10:29 UTC by Julian Andres Klode
Modified: 2018-01-25 09:00 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Julian Andres Klode 2017-09-04 10:29:42 UTC 
This was a really big problem in 3.25.91 (just starting a VM in gnome-boxes crashed shell), but as of commit ce515c5 it is more stable. But I still had another crash today while watching netflix in chrome, so some corner case might be missing

+ Trace 237920

Thread 1 (Thread 0x7f00de173ac0 (LWP 24584))

  • #0 on_crtc_flipped
    at backends/native/meta-renderer-native.c line 456
  • #1 g_closure_invoke
  • #2 invoke_flip_closure
    at backends/native/meta-monitor-manager-kms.c line 1665
  • #3 page_flip_handler
    at backends/native/meta-monitor-manager-kms.c line 1761
  • #4 drmHandleEvent
  • #5 meta_monitor_manager_kms_wait_for_flip
    at backends/native/meta-monitor-manager-kms.c line 1775
  • #6 kms_event_dispatch
    at backends/native/meta-monitor-manager-kms.c line 1534
  • #7 g_main_context_dispatch
  • #8 0x00007f00dd2b61a0 in
  • #9 g_main_loop_run
  • #10 meta_run
    at core/main.c line 648
  • #11 0x00005579e6a732a7 in
  • #12 __libc_start_main
    at ../csu/libc-start.c line 291
  • #13 0x00005579e6a733ba in 






Comment 1


Julian Andres Klode





          2017-09-04 10:32:12 UTC
        



IIRC, the crash happened while I clicked in the full screen chrome window, I assume it was about to un-fullscreen.






Comment 2


Jonas Ådahl





          2017-09-04 13:39:16 UTC
        



Does reverting dbc63430d879c927f7e308e29e4570993eccbfde help?






Comment 3


Julian Andres Klode





          2017-09-04 14:25:22 UTC
        



It seems to help. I could reproduce with starting a VM in gnome-boxes after launching a session 4 out of 4 times before the revert, and 0 out of 2 afterwards.






Comment 4


Jonas Ådahl





          2017-09-04 14:42:23 UTC
        



Thanks for the quick testing. Anyhow, how strange, the path it affects should only be triggered when switching VT / user / suspending. Maybe Boxes interferes with it some how; I'll have to debug that. I reverted that commit for now, as I won't have time to debug this before the code freeze.

Are you sure the click-full-screen-chrome-window is the same crash?






Comment 5


Julian Andres Klode





          2017-09-04 14:53:42 UTC
        



Oh, I just figured out that's it is actually gdm's shell that is crashing for me. The trace _is_ from the chrome related crash, the other crashes with boxes also have the same trace, and the initial boxes crash yesterday had it as well.

I just noticed another crash in the user shell, probably with the patch reverted (16:21:53, and 16:22:26 CEST, I posted that it works at 16:25 CEST, so that was probably when quitting test sessions):





+
Trace
    237922






    

  • 
#0
__GI___libc_free

    
                at malloc.c
                  line
                  2984

    

    • 

  • 
#1
meta_finalize

    
                at core/main.c
                  line
                  301

    

    • 

  • 
#2
meta_run

    
                at core/main.c
                  line
                  650

    

    • 

  • 
#3
0x000055c5907832a7 in

    • 

  • 
#4
__libc_start_main

    
                at ../csu/libc-start.c
                  line
                  291

    

    • 

  • 
#5
0x000055c5907833ba in

    • 








AFAICT that is probably commit 807658e9725bd8d3693e3a7178c72546b8835e63, though.






Comment 6


Julian Andres Klode





          2017-09-04 14:56:46 UTC
        



Damn, now my user shell just crashed when running gnome-boxes in






+
Trace
    237923






    

  • 
#0
_cogl_boxed_value_set_x

    
                at cogl-boxed-value.c
                  line
                  141

    

    • 

  • 
#1
_cogl_boxed_value_set_float

    
                at cogl-boxed-value.c
                  line
                  212

    

    • 

  • 
#2
ffi_call_unix64

    
                at ../src/x86/unix64.S
                  line
                  76

    

    • 

  • 
#3
ffi_call

    
                at ../src/x86/ffi64.c
                  line
                  525

    

    • 

  • 
#4
0x00007fa3f447e058 in

    • 

  • 
#5
0x00007fa3f447f934 in

    • 

  • 
#6
js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)

    
                at ./js/src/jscntxtinlines.h
                  line
                  239

    

    • 

  • 
#7
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  447

    

    • 

  • 
#8
js::CallFromStack(JSContext*, JS::CallArgs const&)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  510

    

    • 

  • 
#9
Interpret(JSContext*, js::RunState&)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  2922

    

    • 

  • 
#10
js::RunScript(JSContext*, js::RunState&)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  405

    

    • 

  • 
#11
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  477

    

    • 

  • 
#12
InternalCall(JSContext*, js::AnyInvokeArgs const&)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  504

    

    • 

  • 
#13
js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  523

    

    • 

  • 
#14
js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  650

    

    • 

  • 
#15
SetExistingProperty

    
                at ./js/src/vm/NativeObject.cpp
                  line
                  2434

    

    • 

  • 
#16
js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&)

    
                at ./js/src/vm/NativeObject.cpp
                  line
                  2469

    

    • 

  • 
#17
js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)

    
                at ./js/src/vm/NativeObject.h
                  line
                  1540

    

    • 

  • 
#18
SetObjectElementOperation

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  1496

    

    • 

  • 
#19
js::SetObjectElement(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool, JS::Handle<JSScript*>, unsigned char*)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  4538

    

    • 

  • 
#20
js::jit::DoSetElemFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICSetElem_Fallback*, JS::Value*, JS::HandleValue, JS::HandleValue, JS::HandleValue)

    
                at ./js/src/jit/BaselineIC.cpp
                  line
                  2554

    

    • 

  • 
#21
0x00002da9da3c9fc0 in

    • 

  • 
#22
0x00007ffdbc9cdcf0 in

    • 

  • 
#23
0x00007ffdbc9cdca8 in

    • 

  • 
#24
0x00007fa3ae8eff70 in

    • 

  • 
#25
js::jit::DoSetElemFallbackInfo

    • 

  • 
#26
0x00007fa3cc371670 in

    • 

  • 
#27
0x00002da9da5f97e5 in

    • 

  • 
#89
ComputeImplicitThis

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  1364

    

    • 

  • 
#90
js::ImplicitThisOperation(JSContext*, JS::Handle<JSObject*>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)

    
                at ./js/src/vm/Interpreter.cpp
                  line
                  4633

    

    • 








Is that in mutter too? I can open a new bug for that.






Comment 7


Jonas Ådahl





          2017-09-04 15:06:07 UTC
        



(In reply to Julian Andres Klode from comment #5)
> AFAICT that is probably commit 807658e9725bd8d3693e3a7178c72546b8835e63, though.

That commit should fix the crash you saw in meta_finalize().

(In reply to Julian Andres Klode from comment #6)
> Damn, now my user shell just crashed when running gnome-boxes in

This new crash seems unrelated. Some Javascript code (can't tell, it just looks like it comes from Javascript) that calls _cogl_boxed_value_set_float() with NULL as target. It's either mutter, gnome-shell or gjs. Hard to tell.






Comment 8


Daniel van Vugt





          2017-09-06 01:40:39 UTC
        



For more data on this crash, see:
https://bugs.launchpad.net/ubuntu/+source/gnome-shell/+bug/1714330
https://errors.ubuntu.com/problem/196617236bfd49c847a208a8eda38e2bd701ca99

It seems to be the noisiest regression we're seeing since Ubuntu 17.10 moved to 3.25.






Comment 9


Jonas Ådahl





          2017-09-06 02:03:41 UTC
        



(In reply to Daniel van Vugt from comment #8)
> For more data on this crash, see:
> https://bugs.launchpad.net/ubuntu/+source/gnome-shell/+bug/1714330
> https://errors.ubuntu.com/problem/196617236bfd49c847a208a8eda38e2bd701ca99
> 
> It seems to be the noisiest regression we're seeing since Ubuntu 17.10 moved
> to 3.25.

The second link is restricted. Regarding the first one, did you try to use the dd4ad4efc419e git snapshot? I only see things about the ce515c5 snapshot, which doesn't include the revert mentioned above.






Comment 10


Adam Williamson





          2017-09-12 00:11:36 UTC
        



We have a downstream Fedora report of the _cogl_boxed_value_set_float() crash:

https://bugzilla.redhat.com/show_bug.cgi?id=1490072

I have consistently seen it on my main box (which runs Fedora 27); my session almost always crashes when I launch a vm in virt-manager.

Ubuntu has a report of the same crash now too:

https://bugs.launchpad.net/ubuntu/+source/gnome-shell/+bug/1715330

I guess I'll open a new report for it?






Comment 11


Adam Williamson





          2017-09-12 01:18:11 UTC
        



Filed https://bugzilla.gnome.org/show_bug.cgi?id=787568 specifically for the _cogl_boxed_value_set_x() crash.






Comment 12


Daniel van Vugt





          2018-01-25 08:48:49 UTC
        



This bug hasn't been seen at all since Ubuntu 17.10. It's definitely fixed somewhere.






Comment 13


Jonas Ådahl





          2018-01-25 09:00:21 UTC
        



(In reply to Daniel van Vugt from comment #12)
> This bug hasn't been seen at all since Ubuntu 17.10. It's definitely fixed
> somewhere.

I guess we can close it then. Thanks.