GNOME Bugzilla – Bug 729508
gnome-shell crashed with SIGABRT in g_assertion_message()
Last modified: 2017-01-02 00:49:33 UTC
Open bug in launchpad.net: https://bugs.launchpad.net/ubuntu/+source/gnome-shell/+bug/1302752 "Random crash regardless of any program I'm using."
+ Trace 233550
this is almost certainly not a glib issue, but a problem of gjs running garbage collection in a thread
Mh when did we start finalizing boxed types in background? And who thought it was a good idea? Btw, this is still a glib issue: it means gobject-introspection stuff does not use atomic refcounting.
No, I've seen this crash before our recent gjs changes. Also: void g_base_info_unref (GIBaseInfo *info) { GIRealInfo *rinfo = (GIRealInfo*)info; g_assert (rinfo->ref_count > 0 && rinfo->ref_count != INVALID_REFCOUNT); if (!g_atomic_int_dec_and_test (&rinfo->ref_count)) return; ... } It's not a threading issue. There's a mismatched ref / unref somewhere. I don't know why I put it into the introspection category instead of gjs, though. If anybody can find a consistent reproducer, please post it on the bug.
(In reply to comment #3) > No, I've seen this crash before our recent gjs changes. Don't know about that, but the backtrace is inequivocable in telling us the finalize is happening on the background thread. And yet, checking the gjs code, we did not flag the class for background finalize... (In reply to comment #3) > It's not a threading issue. There's a mismatched ref / unref somewhere. I don't > know why I put it into the introspection category instead of gjs, though. If > anybody can find a consistent reproducer, please post it on the bug. How would a mismatched ref/unref cause a corruption of the JSObject* structure? Because that's the only way I'd explain a boxed wrapper getting put in the OBJECT4_BACKGROUND arena, without having the JSCLASS_BACKGROUND_FINALIZE flag. (The proper arena for a boxed wrapper is OBJECT2, btw)
I've seen SpiderMonkey structs get "corrupted" when there's a mismatch between the debug flags that SpiderMonkey was compiled with, and the debug flags that GJS was compiled with. It's particularly dangerous that some struct members in SpiderMonkey header files have "#ifdef DEBUG" around them... In any case I'd say we have to find a consistent way to reproduce this before we can do anything about it.
Closing this bug report as no further information has been provided. Please feel free to reopen this bug report if you can provide the information that was asked for in a previous comment. Thanks!