After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 789070 - Xwayland error "invalid global wl_output" and gnome-shell segfault
Xwayland error "invalid global wl_output" and gnome-shell segfault
Status: RESOLVED FIXED
Product: mutter
Classification: Core
Component: wayland
git master
Other Linux
: Normal normal
: ---
Assigned To: mutter-maint
mutter-maint
Depends on:
Blocks:
 
 
Reported: 2017-10-16 17:40 UTC by Reto Kaiser
Modified: 2017-12-15 14:00 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
journal log entries (14.96 KB, text/x-log)
2017-10-16 17:40 UTC, Reto Kaiser
  Details
wayland-outputs: Delay wl_output destruction (2.12 KB, patch)
2017-12-07 15:05 UTC, Rui Matos
committed Details | Review

Description Reto Kaiser 2017-10-16 17:40:25 UTC
Created attachment 361690 [details]
journal log entries

My gnome-shell "3.26.1+3+g43ec5280b-1" on Arch Linux crashes when logging in after a reboot.


The journal contains this:
---------
Okt 16 19:16:17 njamxps13 org.gnome.Shell.desktop[1158]: (EE)
Okt 16 19:16:17 njamxps13 org.gnome.Shell.desktop[1158]: Fatal server error:
Okt 16 19:16:17 njamxps13 org.gnome.Shell.desktop[1158]: (EE) wl_registry@2: error 0: invalid global wl_output (20)
Okt 16 19:16:17 njamxps13 org.gnome.Shell.desktop[1158]: (EE)
---------

And gnome-shell segfaults with something like this:
---------
       Message: Process 1158 (gnome-shell) of user 1001 dumped core.

                Stack trace of thread 1158:
                #0  0x00007f14e924ccd2 n/a (libglib-2.0.so.0)
                #1  0x00007f14e924cecd g_log_default_handler (libglib-2.0.so.0)
                #2  0x000055831b87f1b8 n/a (gnome-shell)
                #3  0x00007f14e924d4ef g_logv (libglib-2.0.so.0)
                #4  0x00007f14e924d680 g_log (libglib-2.0.so.0)
                #5  0x00007f14e76d292f n/a (libmutter-1.so.0)
                #6  0x00007f14e63e179e _XIOError (libX11.so.6)
                #7  0x00007f14e63df7e3 _XReply (libX11.so.6)
                #8  0x00007f14e642ee0d n/a (libX11.so.6)
                #9  0x00007f14e642eec3 XkbGetUpdatedMap (libX11.so.6)
                #10 0x00007f14e642ef7d XkbGetMap (libX11.so.6)
                #11 0x00007f14e6f70844 n/a (libgdk-3.so.0)
                #12 0x00007f14e6f70cf6 n/a (libgdk-3.so.0)
                #13 0x00007f14e8acf76c n/a (libgtk-3.so.0)
                #14 0x00007f14e8ad1bd4 n/a (libgtk-3.so.0)
                #15 0x00007f14e720f4f6 n/a (libst-1.0.so)
                #16 0x00007f14e7f1a21c n/a (libmutter-clutter-1.so)
                #17 0x00007f14e95126f5 g_closure_invoke (libgobject-2.0.so.0)
                #18 0x00007f14e9525ae2 n/a (libgobject-2.0.so.0)
                #19 0x00007f14e9529efe g_signal_emit_valist (libgobject-2.0.so.0)
                #20 0x00007f14e952b920 g_signal_emit (libgobject-2.0.so.0)
                #21 0x00007f14e7e9b28e clutter_actor_event (libmutter-clutter-1.so)
                #22 0x00007f14e3b461c8 ffi_call_unix64 (libffi.so.6)
                #23 0x00007f14e3b45c2a ffi_call (libffi.so.6)
                #24 0x00007f14e81d7cbb n/a (libgjs.so.0)
                #25 0x00007f14e81d9617 n/a (libgjs.so.0)
                #26 0x00007f14e181164d n/a (libmozjs-52.so.0)
                #27 0x00007f14e1804687 n/a (libmozjs-52.so.0)
                #28 0x00007f14e1810e97 n/a (libmozjs-52.so.0)
                #29 0x00007f14e181146f n/a (libmozjs-52.so.0)
                #30 0x00007f14e1811779 n/a (libmozjs-52.so.0)
                #31 0x00007f14e1601219 n/a (libmozjs-52.so.0)
                #32 0x0000380df33873c6 n/a (n/a)
                #33 0x00007f14e14ffd3e n/a (libmozjs-52.so.0)
                #34 0x00007f14e18109e3 n/a (libmozjs-52.so.0)
                #35 0x00007f14e1810e97 n/a (libmozjs-52.so.0)
                #36 0x00007f14e181146f n/a (libmozjs-52.so.0)
                #37 0x00007f14e1811779 n/a (libmozjs-52.so.0)
                #38 0x00007f14e1601219 n/a (libmozjs-52.so.0)
                #39 0x0000380df33873c6 n/a (n/a)
---------


This looks similar like what was reported in https://bugzilla.gnome.org/show_bug.cgi?id=785657#c101

I have no extensions enabled.
Comment 1 Reto Kaiser 2017-10-16 17:55:26 UTC
Important detail: this only happens when the Thunderbolt dock "Dell TB16" is connected to the computer. But no monitor is connected to the dock!
Comment 2 Reto Kaiser 2017-10-19 15:56:19 UTC
Doesn't happen anymore after upgrading:
- mutter (3.26.1+12+gd6e3193c2-1 -> 3.26.1+15+gb48c34979-1) https://github.com/GNOME/mutter/compare/d6e3193c2...b48c34979
- linux (4.13.6-1 -> 4.13.7-1)
- libdrm (2.4.83-1 -> 2.4.84-1)
Comment 3 Rui Matos 2017-12-07 15:04:42 UTC
I'm pretty sure this still happens and I thought we had an open bug for it already since it's a known issue but can't find it. Anyway this bug exactly describes it so I'm attaching a patch that I quickly hacked yesterday to try and reduce the likelihood of this happening.
Comment 4 Rui Matos 2017-12-07 15:05:07 UTC
Created attachment 365198 [details] [review]
wayland-outputs: Delay wl_output destruction

This tries to avoid wayland clients getting disconnected for binding
to a wl_output that we already destroyed which is a known protocol
race condition, see https://phabricator.freedesktop.org/T7722 .
Comment 5 Jonas Ådahl 2017-12-11 10:05:42 UTC
Review of attachment 365198 [details] [review]:

lgtm

::: src/wayland/meta-wayland-outputs.c
@@ +338,3 @@
+delayed_destroy_outputs (gpointer data)
+{
+  g_hash_table_destroy ((GHashTable *) data);

Is this cast needed? gpointer is junt void* right?
Comment 6 Rui Matos 2017-12-15 14:00:02 UTC
(In reply to Jonas Ådahl from comment #5)
> +  g_hash_table_destroy ((GHashTable *) data);
>
> Is this cast needed? gpointer is junt void* right?

Indeed, removed it and pushed to master and gnome-3-26.

Attachment 365198 [details] pushed as 1923db9 - wayland-outputs: Delay wl_output destruction