Bug 724406 – segfault in shell_app_compare

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 724406 - segfault in shell_app_compare


Summary:	segfault in shell_app_compare


Status:	RESOLVED DUPLICATE of bug 723308

Product:	gnome-shell
Classification:	Core
Component:	general
Version:	3.10.x
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	---
Assigned To:	gnome-shell-maint
QA Contact:	gnome-shell-maint

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2014-02-15 10:13 UTC by Tim Cuthbertson
Modified:	2014-02-15 11:08 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Tim Cuthbertson 2014-02-15 10:13:25 UTC

With shellshape[0] installed, I can reproduce reliably:

1) Install gnustep-examples package (fedora)
2) run the `Calculator` example program (/usr/bin/Calculator)
3) quit the app (alt-q)
4) Press the overview key (Super_L)

[0] https://extensions.gnome.org/extension/294/shellshape/

gnome-shell crashes before the overview is displayed. I don't know why shellshape causes the crash, most likely it's just exercising some less common code path (it iterates through active windows a lot, for example). I also don't know why gnustep apps would trigger it, but perhaps they're doing something abnormal with those floating non-application windows (both gnustep examples I've tried cause the bug, it's not specific to Calculator).

When I attach to gnome-shell with gdb, I get the following backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007f9d9dd8548e in shell_app_compare () from /usr/lib64/gnome-shell/libgnome-shell.so
(gdb) bt

+ Trace 233178

#0 shell_app_compare
from /usr/lib64/gnome-shell/libgnome-shell.so
#1 g_slist_sort_real
from /lib64/libglib-2.0.so.0
#2 g_slist_sort_real
from /lib64/libglib-2.0.so.0
#3 shell_app_system_get_running
from /usr/lib64/gnome-shell/libgnome-shell.so
#4 ffi_call_unix64
from /lib64/libffi.so.6
#5 ffi_call
from /lib64/libffi.so.6
#6 ??
from /lib64/libgjs.so.0
#7 ??
from /lib64/libgjs.so.0
#8 js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct)
from /lib64/libmozjs-17.0.so
#9 js::Interpret(JSContext*, js::StackFrame*, js::InterpMode)
from /lib64/libmozjs-17.0.so
#10 UncachedInlineCall(js::VMFrame&, js::InitialFrameFlags, void**, bool*, unsigned int)
from /lib64/libmozjs-17.0.so
#11 js::mjit::stubs::UncachedCallHelper(js::VMFrame&, unsigned int, bool, js::mjit::stubs::UncachedCallResult*)
from /lib64/libmozjs-17.0.so
#12 js::mjit::stubs::CompileFunction(js::VMFrame&, unsigned int)
from /lib64/libmozjs-17.0.so
#13 ??
#14 ??
#15 ??

Comment 1 Tim Cuthbertson 2014-02-15 10:27:14 UTC

After some more digging, I've ruled out shellshape: you can get the same crash without shellshape installed by following the same steps as above, but by replacing step 4) with:

4) run looking glass (alt+f2, "lg")
5) evaluate:
imports.gi.Shell.AppSystem.get_default().get_running();

Comment 2 Florian Müllner 2014-02-15 11:08:39 UTC

Thanks for the bug report. This particular bug has already been reported into our bug tracking system, but please feel free to report any further bugs you find.

*** This bug has been marked as a duplicate of bug 723308 ***