After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 792709 - Cleaning up surface actors lingering in the Javascript GC on tear down causes crash
Cleaning up surface actors lingering in the Javascript GC on tear down causes...
Status: RESOLVED OBSOLETE
Product: gnome-shell
Classification: Core
Component: general
3.26.x
Other Linux
: Normal normal
: ---
Assigned To: gnome-shell-maint
gnome-shell-maint
Depends on:
Blocks:
 
 
Reported: 2018-01-20 04:58 UTC by Paul Wise
Modified: 2021-07-05 14:46 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
gdb backtrace of the crash (68.16 KB, text/plain)
2018-01-20 04:58 UTC, Paul Wise
Details
second gdb backtrace of the crash (70.05 KB, text/plain)
2018-01-23 05:43 UTC, Paul Wise
Details

Description Paul Wise 2018-01-20 04:58:17 UTC
Created attachment 367129 [details]
gdb backtrace of the crash

I got a random crash (SIGSEGV) in gnome-shell. I am using gnome-shell 3.26.2-3, Xorg 2:1.19.5-1 and GNOME 3.26 on Debian buster. If the below gdb backtrace and the attached full gdb backtrace isn't useful, please close this bug. The core file will be automatically deleted in a week but I can keep it around for longer if needed.

Core was generated by `gnome-shell --replace'.
Program terminated with signal SIGSEGV, Segmentation fault.
  • #0 XFreePixmap
    at ../../src/FreePix.c line 38
  • #0 XFreePixmap
    at ../../src/FreePix.c line 38
  • #1 detach_pixmap
    at compositor/meta-surface-actor-x11.c line 101
  • #2 meta_surface_actor_x11_dispose
    at compositor/meta-surface-actor-x11.c line 360
  • #3 g_object_unref
    at ../../../../gobject/gobject.c line 3293
  • #4 release_native_object(ObjectInstance*)
    at gi/object.cpp line 1159
  • #5 disassociate_js_gobject
    at gi/object.cpp line 1337
  • #6 update_heap_wrapper_weak_pointers(JSContext*, JSCompartment*, gpointer)
    at gi/object.cpp line 1247
  • #7 js::gc::GCRuntime::callWeakPointerCompartmentCallbacks(JSCompartment*) const
    at ./js/src/jsgc.cpp line 1474
  • #8 js::gc::GCRuntime::beginSweepingZoneGroup(js::AutoLockForExclusiveAccess&)
    at ./js/src/jsgc.cpp line 5027
  • #9 js::gc::GCRuntime::beginSweepPhase(bool, js::AutoLockForExclusiveAccess&)
    at ./js/src/jsgc.cpp line 5232
  • #10 js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason, js::AutoLockForExclusiveAccess&)
    at ./js/src/jsgc.cpp line 5913
  • #11 js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason)
    at ./js/src/jsgc.cpp line 6201
  • #12 js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason)
    at ./js/src/jsgc.cpp line 6329
  • #13 js::gc::GCRuntime::gc(JSGCInvocationKind, JS::gcreason::Reason)
    at ./js/src/jsgc.cpp line 6397
  • #14 JS_GC(JSContext*)
    at ./js/src/jsapi.cpp line 1326
  • #15 gjs_context_dispose(GObject*)
    at gjs/context.cpp line 234
  • #16 g_object_unref
    at ../../../../gobject/gobject.c line 3293
  • #17 main
    at ../src/main.c line 533

Comment 1 Paul Wise 2018-01-23 05:43:57 UTC
Created attachment 367277 [details]
second gdb backtrace of the crash

I got another similar crash, here is the backtrace:

Core was generated by `gnome-shell --replace'.
Program terminated with signal SIGSEGV, Segmentation fault.
  • #0 XFreePixmap
    at ../../src/FreePix.c line 38
  • #0 XFreePixmap
    at ../../src/FreePix.c line 38
  • #1 detach_pixmap
    at compositor/meta-surface-actor-x11.c line 101
  • #2 meta_surface_actor_x11_dispose
    at compositor/meta-surface-actor-x11.c line 360
  • #3 g_object_unref
    at ../../../../gobject/gobject.c line 3293
  • #4 release_native_object(ObjectInstance*)
    at gi/object.cpp line 1159
  • #5 disassociate_js_gobject
    at gi/object.cpp line 1337
  • #6 update_heap_wrapper_weak_pointers(JSContext*, JSCompartment*, gpointer)
    at gi/object.cpp line 1247
  • #7 js::gc::GCRuntime::callWeakPointerCompartmentCallbacks(JSCompartment*) const
    at ./js/src/jsgc.cpp line 1474
  • #8 js::gc::GCRuntime::beginSweepingZoneGroup(js::AutoLockForExclusiveAccess&)
    at ./js/src/jsgc.cpp line 5027
  • #9 js::gc::GCRuntime::beginSweepPhase(bool, js::AutoLockForExclusiveAccess&)
    at ./js/src/jsgc.cpp line 5232
  • #10 js::gc::GCRuntime::incrementalCollectSlice(js::SliceBudget&, JS::gcreason::Reason, js::AutoLockForExclusiveAccess&)
    at ./js/src/jsgc.cpp line 5913
  • #11 js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason)
    at ./js/src/jsgc.cpp line 6201
  • #12 js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason)
    at ./js/src/jsgc.cpp line 6329
  • #13 js::gc::GCRuntime::gc(JSGCInvocationKind, JS::gcreason::Reason)
    at ./js/src/jsgc.cpp line 6397
  • #14 JS_GC(JSContext*)
    at ./js/src/jsapi.cpp line 1326
  • #15 gjs_context_dispose(GObject*)
    at gjs/context.cpp line 234
  • #16 g_object_unref
    at ../../../../gobject/gobject.c line 3293
  • #17 main
    at ../src/main.c line 533

Comment 2 Jonas Ådahl 2018-01-24 05:55:59 UTC
Seems to be caused by the Javascript GC keeping references to MetaSurfaceActor objects that fail to clean themselves up because we tear down the X11 display connection (and everything else associated with it) before we tear down the Javascript context.
Comment 3 Matěj Cepl 2018-03-07 12:44:03 UTC
There are some other bugs with similar backtrace, not sure whether they
are out right duplicates. bug 785327 and 788366.
Comment 4 Paul Wise 2018-04-07 23:54:37 UTC
FYI, I'm still getting this crash with gnome-shell 3.28.0-1+b1 from Debian buster.
Comment 5 GNOME Infrastructure Team 2021-07-05 14:46:13 UTC
GNOME is going to shut down bugzilla.gnome.org in favor of  gitlab.gnome.org.
As part of that, we are mass-closing older open tickets in bugzilla.gnome.org
which have not seen updates for a longer time (resources are unfortunately
quite limited so not every ticket can get handled).

If you can still reproduce the situation described in this ticket in a recent
and supported software version, then please follow
  https://wiki.gnome.org/GettingInTouch/BugReportingGuidelines
and create a new ticket at
  https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/

Thank you for your understanding and your help.