** Description changed: - We crash while deferencing a MetaWindow during + [ Impact ] + + * GNOME Shell may crash with SIGSEGV on session end (logout, reboot, + power off): pending idle callbacks in the Ubuntu Dock extension may + enumerate windows while mutter is already disposing them, crashing + the shell (see the Error Tracker stack in this report). + + [ Test Plan ] + + * With the dock enabled, open a few GNOME Files windows, then log out + or power off. Check the previous boot: + journalctl -b -1 | grep -E 'GNOME Shell crashed|signal 11' + On affected versions this can show a SIGSEGV with dash-to-dock + fileManager1API.js / utils.js frames in the JS stack. + + * With the fix, repeat logout/poweroff cycles (5-10 times, also with + Files windows open) and verify no "GNOME Shell crashed with signal + 11" shows up, no /var/crash/_usr_bin_gnome-shell.* files appear, and + the session ends normally. + + [ Where problems could occur ] + + * The dock is now torn down slightly earlier during session end. If + that teardown is wrong, shutdown could log non-fatal new dock JS errors. + + * The teardown reuses the normal disable() path, is idempotent and the + shutdown handler is disconnected on first run, so the risk is + limited to the session end phase. + + [ Other Info ] + + * The same commit is already in stonking via + gnome-shell-ubuntu-extensions 51.26.10.1ubuntu (Fix Released here); + this SRU only backports it to earlier releases. + + * The fix lands in gnome-shell-ubuntu-extensions because the faulty + code is in the dock extension, even though the crashing binary is + gnome-shell; the shell-side fix is tracked in the gnome-shell task + (MR !4214). + + --- + + We crash while dereferencing a MetaWindow during `meta_display_list_windows`, which is weird given the refcounting system. Now, a relevant JS stack trace: [294600.830572] gnome-shell[82209]: DING: GNOME nautilus 50.0 [294693.263525] gnome-shell[82209]: Shutting down GNOME Shell [294693.263743] gnome-shell[82209]: Object MetaCompositorNative (0x55c1d9d20700), has been already disposed — impossible to access it. This might be caused by the object having been destroyed from C code using something such as destroy(), dispose(), or remove() vfuncs. == Stack trace for context 0x55c1d98f5220 == #0 55c1d99ec308 i resource:///org/gnome/shell/ui/layout.js:239 (19057db31ce0 @ 107) [294693.265470] gnome-shell[82209]: GNOME Shell crashed with signal 11 [294693.265470] gnome-shell[82209]: == Stack trace for context 0x55c1d98f5220 == [294693.265470] gnome-shell[82209]: #0 55c1d99ec580 i file:///usr/share/gnome-shell/extensions/[email protected]/utils.js:547 (2461cf777b00 @ 10) [294693.265470] gnome-shell[82209]: #1 7ffe4c4e8240 I self-hosted:157 (cf6330b1e20 @ 246) [294693.265470] gnome-shell[82209]: #2 55c1d99ec4d8 i file:///usr/share/gnome-shell/extensions/[email protected]/utils.js:546 (2461cf777a60 @ 194) [294693.265470] gnome-shell[82209]: #3 55c1d99ec428 i file:///usr/share/gnome-shell/extensions/[email protected]/fileManager1API.js:113 (2461cf7a0e20 @ 79) [294693.265470] gnome-shell[82209]: #4 55c1d99ec3a8 i file:///usr/share/gnome-shell/extensions/[email protected]/fileManager1API.js:126 (2461cf7a0f10 @ 12) [294693.265470] gnome-shell[82209]: #5 55c1d99ec308 i resource:///org/gnome/shell/ui/main.js:292 (cf6330fb7e0 @ 119) [294693.263843] gnome-shell[82209]: JS ERROR: Error: Argument child may not be null _init/<@resource:///org/gnome/shell/ui/layout.js:243:30 Which implies the fact that after shutdown we may try to play with things that we should definitely not as the extension does not get fully disabled. --- The Ubuntu Error Tracker has been receiving reports about a problem regarding gnome-shell. This problem was most recently seen with package version 50.1-0ubuntu1, the problem page at https://errors.ubuntu.com/problem/58f1c820797aaefa13a884c98adb389f5422d0b1 contains more details, including versions of packages affected, stacktrace or traceback, and individual crash reports. If you do not have access to the Ubuntu Error Tracker and are a software developer, you can request it at http://forms.canonical.com/reports/. --- External link: https://warthogs.atlassian.net/browse/UDENG-11105
** Description changed: [ Impact ] - * GNOME Shell may crash with SIGSEGV on session end (logout, reboot, - power off): pending idle callbacks in the Ubuntu Dock extension may - enumerate windows while mutter is already disposing them, crashing - the shell (see the Error Tracker stack in this report). + * GNOME Shell may crash with SIGSEGV on session end (logout, reboot, + power off): pending idle callbacks in the Ubuntu Dock extension may + enumerate windows while mutter is already disposing them, crashing + the shell (see the Error Tracker stack in this report). [ Test Plan ] - * With the dock enabled, open a few GNOME Files windows, then log out - or power off. Check the previous boot: - journalctl -b -1 | grep -E 'GNOME Shell crashed|signal 11' - On affected versions this can show a SIGSEGV with dash-to-dock - fileManager1API.js / utils.js frames in the JS stack. + * With the dock enabled, open a few GNOME Files windows, then log out + or power off. Check the previous boot: + journalctl -b -1 | grep -E 'GNOME Shell crashed|signal 11' + On affected versions this can show a SIGSEGV with dash-to-dock + fileManager1API.js / utils.js frames in the JS stack. - * With the fix, repeat logout/poweroff cycles (5-10 times, also with - Files windows open) and verify no "GNOME Shell crashed with signal - 11" shows up, no /var/crash/_usr_bin_gnome-shell.* files appear, and - the session ends normally. + * With the fix, repeat logout/poweroff cycles (5-10 times, also with + Files windows open) and verify no "GNOME Shell crashed with signal + 11" shows up, no /var/crash/_usr_bin_gnome-shell.* files appear, and + the session ends normally. + + * Also monitor errors: + https://errors.ubuntu.com/problem/58f1c820797aaefa13a884c98adb389f5422d0b1 [ Where problems could occur ] - * The dock is now torn down slightly earlier during session end. If - that teardown is wrong, shutdown could log non-fatal new dock JS errors. + * The dock is now torn down slightly earlier during session end. If + that teardown is wrong, shutdown could log non-fatal new dock JS errors. - * The teardown reuses the normal disable() path, is idempotent and the - shutdown handler is disconnected on first run, so the risk is - limited to the session end phase. + * The teardown reuses the normal disable() path, is idempotent and the + shutdown handler is disconnected on first run, so the risk is + limited to the session end phase. [ Other Info ] - * The same commit is already in stonking via - gnome-shell-ubuntu-extensions 51.26.10.1ubuntu (Fix Released here); - this SRU only backports it to earlier releases. + * The same commit is already in stonking via + gnome-shell-ubuntu-extensions 51.26.10.1ubuntu (Fix Released here); + this SRU only backports it to earlier releases. - * The fix lands in gnome-shell-ubuntu-extensions because the faulty - code is in the dock extension, even though the crashing binary is - gnome-shell; the shell-side fix is tracked in the gnome-shell task - (MR !4214). + * The fix lands in gnome-shell-ubuntu-extensions because the faulty + code is in the dock extension, even though the crashing binary is + gnome-shell; the shell-side fix is tracked in the gnome-shell task + (MR !4214). --- We crash while dereferencing a MetaWindow during `meta_display_list_windows`, which is weird given the refcounting system. Now, a relevant JS stack trace: [294600.830572] gnome-shell[82209]: DING: GNOME nautilus 50.0 [294693.263525] gnome-shell[82209]: Shutting down GNOME Shell [294693.263743] gnome-shell[82209]: Object MetaCompositorNative (0x55c1d9d20700), has been already disposed — impossible to access it. This might be caused by the object having been destroyed from C code using something such as destroy(), dispose(), or remove() vfuncs. == Stack trace for context 0x55c1d98f5220 == #0 55c1d99ec308 i resource:///org/gnome/shell/ui/layout.js:239 (19057db31ce0 @ 107) [294693.265470] gnome-shell[82209]: GNOME Shell crashed with signal 11 [294693.265470] gnome-shell[82209]: == Stack trace for context 0x55c1d98f5220 == [294693.265470] gnome-shell[82209]: #0 55c1d99ec580 i file:///usr/share/gnome-shell/extensions/[email protected]/utils.js:547 (2461cf777b00 @ 10) [294693.265470] gnome-shell[82209]: #1 7ffe4c4e8240 I self-hosted:157 (cf6330b1e20 @ 246) [294693.265470] gnome-shell[82209]: #2 55c1d99ec4d8 i file:///usr/share/gnome-shell/extensions/[email protected]/utils.js:546 (2461cf777a60 @ 194) [294693.265470] gnome-shell[82209]: #3 55c1d99ec428 i file:///usr/share/gnome-shell/extensions/[email protected]/fileManager1API.js:113 (2461cf7a0e20 @ 79) [294693.265470] gnome-shell[82209]: #4 55c1d99ec3a8 i file:///usr/share/gnome-shell/extensions/[email protected]/fileManager1API.js:126 (2461cf7a0f10 @ 12) [294693.265470] gnome-shell[82209]: #5 55c1d99ec308 i resource:///org/gnome/shell/ui/main.js:292 (cf6330fb7e0 @ 119) [294693.263843] gnome-shell[82209]: JS ERROR: Error: Argument child may not be null _init/<@resource:///org/gnome/shell/ui/layout.js:243:30 Which implies the fact that after shutdown we may try to play with things that we should definitely not as the extension does not get fully disabled. --- The Ubuntu Error Tracker has been receiving reports about a problem regarding gnome-shell. This problem was most recently seen with package version 50.1-0ubuntu1, the problem page at https://errors.ubuntu.com/problem/58f1c820797aaefa13a884c98adb389f5422d0b1 contains more details, including versions of packages affected, stacktrace or traceback, and individual crash reports. If you do not have access to the Ubuntu Error Tracker and are a software developer, you can request it at http://forms.canonical.com/reports/. --- External link: https://warthogs.atlassian.net/browse/UDENG-11105 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2150670 Title: gnome-shell crashed (on shutdown?) with SIGSEGV in ffi_call() → meta_workspace_list_windows() → meta_display_list_windows() To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gnome-shell/+bug/2150670/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
