gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64()

Bug #1714989 reported by Paul
394
This bug affects 47 people
Affects Status Importance Assigned to Milestone
GNOME Shell
Fix Released
Critical
gjs (Ubuntu)
Triaged
Undecided
Marco Trevisan (Treviño)
Declined for Artful by Steve Langasek
Nominated for Trusty by Marco Trevisan (Treviño)
Declined for Zesty by Steve Langasek
Bionic
Won't Fix
Undecided
Unassigned
gnome-shell (Ubuntu)
Fix Released
Medium
Marco Trevisan (Treviño)
Declined for Artful by Steve Langasek
Nominated for Trusty by Marco Trevisan (Treviño)
Declined for Zesty by Steve Langasek
Bionic
Fix Released
Undecided
Unassigned

Bug Description

Saw some reports with the same title but they're all for previous versions.

error reports:
https://errors.ubuntu.com/problem/1c95cc2653ab00054b5d1764e41d974328a5f49d
https://errors.ubuntu.com/problem/811164cadd3e9e891f9e2d439bda59925f91a62c

[ Impact ]

gnome-shell crashes

[ Test case ]

1. No clear test case for this issue.

Some extensions (clipboard indicator) seems to trigger it, but there's no an an easy and reproducible test-case for this so far.

So install "clipboard indicator" indicator and expect this to run properly.

[ Regression Potential ]

Nothing really should be regressing.
Labels could not be updated correctly on disposed labels (not destroyed yet).

ProblemType: CrashDistroRelease: Ubuntu 17.10
Package: gnome-shell 3.25.91-0ubuntu2
ProcVersionSignature: Ubuntu 4.12.0-12.13-generic 4.12.8
Uname: Linux 4.12.0-12-generic x86_64
NonfreeKernelModules: nvidia_uvm nvidia
ApportVersion: 2.20.7-0ubuntu1
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Mon Sep 4 16:52:13 2017
DisplayManager: gdm3
EcryptfsInUse: Yes
ExecutablePath: /usr/bin/gnome-shell
InstallationDate: Installed on 2017-04-21 (135 days ago)
InstallationMedia: Ubuntu 17.04 "Zesty Zapus" - Release amd64 (20170412)
ProcCmdline: /usr/bin/gnome-shell
ProcEnviron:
 LANGUAGE=en_GB:en
 PATH=(custom, user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_GB.UTF-8
 SHELL=/bin/bash
SegvAnalysis:
 Segfault happened at: 0x7fd97c8e7e5d <g_type_check_instance_cast+77>: movzbl 0x16(%rax),%edx
 PC (0x7fd97c8e7e5d) ok
 source "0x16(%rax)" (0x0000eb1e) not located in a known VMA region (needed readable region)!
 destination "%edx" ok
SegvReason: reading NULL VMA
Signal: 11SourcePackage: gnome-shell
StacktraceTop:
 g_type_check_instance_cast () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
 st_label_set_text () from /usr/lib/gnome-shell/libst-1.0.so
 ffi_call_unix64 () from /usr/lib/x86_64-linux-gnu/libffi.so.6
 ffi_call () from /usr/lib/x86_64-linux-gnu/libffi.so.6
 ?? () from /usr/lib/libgjs.so.0
Title: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

Revision history for this message
Paul (sabret00the) wrote :
Revision history for this message
Apport retracing service (apport) wrote :

StacktraceTop:
 g_type_check_instance_cast (type_instance=0xcc06b6cda0, iface_type=876225709408) at ../../../../gobject/gtype.c:4058
 st_label_set_text (label=0xcc06696e10, text=0xcc061762b0 "Nightly Web Browser") at ../src/st/st-label.c:331
 ffi_call_unix64 () at ../src/x86/unix64.S:76
 ffi_call (cif=cif@entry=0xcc05332598, fn=<optimized out>, rvalue=<optimized out>, rvalue@entry=0x7ffcbc1c0608, avalue=avalue@entry=0x7ffcbc1c0500) at ../src/x86/ffi64.c:525
 gjs_invoke_c_function (context=context@entry=0xcc03821400, function=function@entry=0xcc05332580, obj=..., obj@entry=..., args=..., js_rval=..., r_value=r_value@entry=0x0) at gi/function.cpp:1037

Revision history for this message
Apport retracing service (apport) wrote : Stacktrace.txt
Revision history for this message
Apport retracing service (apport) wrote : StacktraceSource.txt
Revision history for this message
Apport retracing service (apport) wrote : ThreadStacktrace.txt
Changed in gnome-shell (Ubuntu):
importance: Undecided → Medium
tags: removed: need-amd64-retrace
information type: Private → Public
summary: - gnome-shell crashed with SIGSEGV in g_type_check_instance_cast()
+ gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from
+ st_label_set_text()
Revision history for this message
Launchpad Janitor (janitor) wrote : Re: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text()

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnome-shell (Ubuntu):
status: New → Confirmed
Revision history for this message
Juerg Haefliger (juergh) wrote :

This also happens quite frequently on Artful.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

It's quite hard to debug this without a javascript dump...

Please if anyone gets this frequently, connect to gnome-shell with sudo gdb -p $(gnome-shell) continue the execution and when the crash happens, do a "call gjs_dumpstack()"

Changed in gnome-shell (Ubuntu):
status: Confirmed → Incomplete
Revision history for this message
Paul (sabret00the) wrote :

@Marco:

sudo gdb -p $(gnome-shell)
org.gnome.Shell already exists on bus and --replace not specified
gdb: option '-p' requires an argument
Use `gdb --help' for a complete list of options.

Should I add --replace?

Revision history for this message
Juerg Haefliger (juergh) wrote :

Hmm...

$ sudo gdb -p 6478
GNU gdb (Ubuntu 8.0.1-0ubuntu1) 8.0.1
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Attaching to process 6478
[New LWP 6482]
[New LWP 6485]
[New LWP 6487]
[New LWP 6491]
[New LWP 6492]
[New LWP 6493]
[New LWP 6494]
[New LWP 6495]
[New LWP 6496]
[New LWP 6497]
[New LWP 6498]
[New LWP 6499]
[New LWP 6500]
[New LWP 6501]
[New LWP 6502]
[New LWP 6503]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x00007f717427f831 in __GI___poll (fds=0x558ad4f04000, nfds=16, timeout=11693) at ../sysdeps/unix/sysv/linux/poll.c:29
29 ../sysdeps/unix/sysv/linux/poll.c: No such file or directory.
(gdb) c
Continuing.

Thread 1 "gnome-shell" received signal SIGSEGV, Segmentation fault.
0x00007f71765cde0d in g_type_check_instance_cast () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
(gdb) call gjs_dumpstack()
$1 = -776839760
(gdb)

Changed in gnome-shell (Ubuntu):
assignee: nobody → Marco Trevisan (Treviño) (3v1n0)
Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Juerg, I forgot to mention. Check your journal (journalctl -e /usr/bin/gnome-shell) the output for the "call gjs_dumpstack()" will be there (not in gdb).

Hopefully you still have those informations there...

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Paul, sorry it was

  sudo gdb -p $(pidof gnome-shell)

description: updated
Changed in gnome-shell:
importance: Unknown → Critical
status: Unknown → Incomplete
Revision history for this message
Juerg Haefliger (juergh) wrote :

I kind of suspected that it was dash-to-panel. But a misbehaving extension shouldn't bring gnome-shell down.

Oct 17 13:54:52 gollum org.gnome.Shell.desktop[30048]: == Stack trace for context 0x5567bdf59170 ==
Oct 17 13:54:52 gollum org.gnome.Shell.desktop[30048]: #0 0x5567be390fb0 i /<email address hidden>/windowPreview.js:506 (0x7f58d905d918 @ 36)
Oct 17 13:54:52 gollum org.gnome.Shell.desktop[30048]: #1 0x7fff501a1ef0 I self-hosted:917 (0x7f59284ee4d8 @ 394)

Revision history for this message
Rui Coelho (ruicoelhopedro) wrote :

Been experiencing this issue as well, and like Juerg said, I also have dash-to-panel running.

Revision history for this message
Arp (arphiemstra) wrote :

I also have dash-to-pannel running.

summary: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from
- st_label_set_text()
+ st_label_set_text() (dash-to-panel specific?)
Revision history for this message
mtvoid (mtvoid) wrote : Re: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() (dash-to-panel specific?)

The dash to panel extension is not present on my system (Ubuntu GNOME), so the bug is surely not specific to that, as seen in the linked GNOME Bugzilla report.

Here are lines from my syslog from various crashes (not adding any extra debug information, which has been provided in previous comments).

gnome-shell[22316]: segfault at 800000007 ip 00007f096491fcdf sp 00007ffe327b14b8 error 4 in libgobject-2.0.so.0.5400.1[7f09648ea000+52000]

gnome-shell[27132] general protection ip:7f120be3acdf sp:7ffc2b89df68 error:0 in libgobject-2.0.so.0.5400.1[7f120be05000+52000]

gnome-shell[2677] general protection ip:7fa655009cdf sp:7ffd066d4dd8 error:0 in libgobject-2.0.so.0.5400.1[7fa654fd4000+52000]

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Indeed these bugs might be triggered by one extension, more than vanilla experience, but they still underline issues in the code, so it's still a bug we've to fix.

As I said, if you happen to catch this wile running gnome-shell in gdb, please run `call gjs_dumpstack()` from the gdb shell in order to get logs in your journal.

Related to this, thanks Juerg.
I've a point now, at least. While the statement above is still valid for people getting this and running g-s without dash-to-panel extension.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Juerg, also, if you have a core file handy (or a full /var/crash/ *.crash file), that would be helpful.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

So this is mostly triggered by extensions (and considering how things are done, we can't prevent them).
Or some wrong JS code which we didn't identified yet.

Crash for users using dash-to-panel is fixed (I've proposed the fix upstream https://github.com/jderose9/dash-to-panel/pull/263), for the others, gjs_dumpstack's are welcome, or we need to wait some debugging bits to be there.

Revision history for this message
Paul (sabret00the) wrote :

I use dash to dock rather than dash-to-panel but am now running the command and will try and get an output for you.

Changed in gnome-shell:
status: Incomplete → Confirmed
Revision history for this message
Dylan Borg (borgdylan) wrote :

I use dash to panel.

Revision history for this message
Paul (sabret00the) wrote :

I attempted to run

$ sudo gdb -p 4798

twice last night and both times it just caused my system to freeze.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Paul, you need to do that from another system via SSH or from tty3 (or any free one), although you still might not be able to go back to the tty when frozen...
So having another system around (using byobu too) would help.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Ok, actually that's not needed...

Just use this:
  sudo gdb -p $(pidof gnome-shell) -batch \
  -ex "set logging on" -ex continue \
  -ex "bt full" -ex "call gjs_dumpstack()" \
  -ex quit

This could be run from your session too and should not freeze anything.

When you get a crash, just attach here the gdb.txt file that this should generate (saved in the directory where you launch this script from) and the content of

  journalctl /usr/bin/gnome-shell

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Using pgrep here is actually safer:

  sudo gdb -p $(pgrep -U $USER -x gnome-shell) -batch \
    -ex "set logging on" -ex continue \
    -ex "bt full" -ex "call gjs_dumpstack()" \
    -ex quit

Revision history for this message
Paul (sabret00the) wrote :

Here's the gdb.txt

Revision history for this message
Paul (sabret00the) wrote :

And here's my journalctl

Revision history for this message
Mattéo Delabre (matteodelabre) wrote :

I’m encountering a similar crash, this time in "g_type_check_instance_is_fundamentally_a", and not "g_type_check_instance_cast". Attached are the gdb.txt and journalctl.txt files generated following the procedure given above.

This time it seems that it is coming from another extension, Pomodoro, that I’ve been using without any crash before upgrading to Ubuntu 17.10. So it looks like this regression could potentially affect other extensions.

Revision history for this message
Mattéo Delabre (matteodelabre) wrote :

(Here is the journalctl.txt file.)

summary: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from
- st_label_set_text() (dash-to-panel specific?)
+ st_label_set_text() from ffi_call_unix64() [dash-to-panel specific?]
Revision history for this message
Daniel van Vugt (vanvugt) wrote : Re: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64() [dash-to-panel specific?]

Mattéo, that is bug 1723705. Not this one.

Revision history for this message
Mattéo Delabre (matteodelabre) wrote :

Sorry for the inconvenience. I’m new to reporting bugs on Launchpad. Should I post my logs over on the other bug?

Revision history for this message
Daniel van Vugt (vanvugt) wrote :

Sure, it probably can't hurt.

Revision history for this message
Juerg Haefliger (juergh) wrote :

I worked with Marco on Friday and he submitted a PR for dash-to-panel which fixes my crashes. See https://github.com/jderose9/dash-to-panel/issues/261.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Mateo, that issues is triggered by

This extension file: https://github.com/codito/gnome-pomodoro/blob/master/plugins/gnome/extension/dialogs.js

So please report the issue upstream (I've done it already in https://github.com/codito/gnome-pomodoro/issues/317). It seems the extension doesn't properly disable the timer on actor destruction, and the method it uses isn't enough for safety check.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Paul, you uploaded the journalctl itself :)

No, just launch
  journalctl /usr/bin/gnome-shell

And attach here the output of that command please

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

To get that content easily, just attach here the output of:

  journalctl /usr/bin/gnome-shell | grep -A 30 "== Stack trace for context"

Revision history for this message
Paul (sabret00the) wrote :

Hopefully this is what you was looking for.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Mh, that's again caused by another extension (gnomeGlobalAppMenu), but I'm not sure if the bug is the same, as I don't see any text reference there.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Mattéo, what are the steps to reproduce your crash?

Just random, or it happens on a particular action?

Revision history for this message
Paul (sabret00the) wrote :

Looking through the journalctl, I saw Global App Menu and also Pixel Saver were having problems. Hopefully these issues can be fixed. Though it seems we shouldn't hold out hope for GAM as the author discontinued it: http://www.omgubuntu.co.uk/2017/09/gnome-global-menu-extension-discontinued

Revision history for this message
Mattéo Delabre (matteodelabre) wrote :

Thank you Marco for having forwarded the bug to the right developers.

Unfortunately, I have not managed to reduce the crash to a precise set of steps. I will report back if I manage to make it reproducible.

tags: added: bugpattern-needed
Revision history for this message
Paul (sabret00the) wrote :

I've not had one of these crashes since removing Global App Menu. Anyone else got it installed?

summary: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from
- st_label_set_text() from ffi_call_unix64() [dash-to-panel specific?]
+ st_label_set_text() from ffi_call_unix64() [Global App Menu specific?]
Revision history for this message
Daniel Playfair Cal (daniel-playfair-cal) wrote : Re: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64() [Global App Menu specific?]

I also experience this crash. I don't have global app menu installed but for me the crash occurs when the following line of code is being executed in the Freon shell extension: https://github.com/UshakovVasilii/gnome-shell-extension-freon/blob/f9756b2430b3766c3d21d71e9928963032617bf7/freon%40UshakovVasilii_Github.yahoo.com/extension.js#L360

I've attached a valgrind log of the crash occurring. There is a whole lot of seemingly related bad memory access before the crash occurs.

For me it happens sometimes immediately after logging in, but before the shell successfully loads. I assume it only happens if the Freon extension is installed. I'm on version 29 of the freon shell extension.

Revision history for this message
Sebastien Bacher (seb128) wrote :

thanks for the valgrind log, that indeed has error but seems to be missing the gnome-shell and libmozjs debug symbols

Revision history for this message
Daniel Playfair Cal (daniel-playfair-cal) wrote :
Revision history for this message
Daniel Playfair Cal (daniel-playfair-cal) wrote :

The JS stack trace from comment 45 is:

 == Stack trace for context 0x22ad77f0 ==
#0 0x1ffeffc980 b /usr/share/gnome-shell/extensions/freon@UshakovVasilii_Github.yahoo.com/extension.js:360 (0x42dbdc48 @ 1995)
#1 0x1ffeffd680 I resource:///org/gnome/gjs/modules/_legacy.js:82 (0x3a4c2c48 @ 71)
#2 0x3a981920 i /usr/share/gnome-shell/extensions/freon@UshakovVasilii_Github.yahoo.com/extension.js:231 (0x42dbdb38 @ 17)
#3 0x1ffeffe360 b self-hosted:913 (0x3a4ee4d8 @ 346)
#4 0x1ffeffeb60 b /usr/share/gnome-shell/extensions/freon@UshakovVasilii_Github.yahoo.com/commandLineUtil.js:38 (0x42dc66f8 @ 454)
#5 0x1ffefff970 b self-hosted:917 (0x3a4ee4d8 @ 394)

Revision history for this message
Daniel Playfair Cal (daniel-playfair-cal) wrote :
Revision history for this message
François-Xavier Thomas (fxt.airinov) wrote :

I have (what looks like) the same issue with another extension (specifically this commit: https://github.com/projecthamster/hamster-shell-extension/tree/07cea1824291cb818befd5fb473a065abe334bde).

The crash does not always happen (is it a race condition?), but, when it does, it always occurs right when clicking on a button to close a window.

JS and GDB stack traces are below, and I can provide a core dump and other debugging info if necessary.

--------------

JS stack trace :

org.gnome.Shell.desktop[2778]: == Stack trace for context 0x562dad808000 ==
org.gnome.Shell.desktop[2778]: #0 0x7ffdd07c5520 b /<email address hidden>/widgets/panelWidget.js:245 (0x7fa98fe16890 @ 105)
org.gnome.Shell.desktop[2778]: #1 0x7ffdd07c5580 I resource:///org/gnome/gjs/modules/_legacy.js:82 (0x7fa9e83c2c48 @ 71)
org.gnome.Shell.desktop[2778]: #2 0x7ffdd07c5650 b /<email address hidden>/widgets/panelWidget.js:186 (0x7fa98fe16670 @ 208)
org.gnome.Shell.desktop[2778]: #3 0x7ffdd07c56f0 I self-hosted:917 (0x7fa9e83ee4d8 @ 394)
org.gnome.Shell.desktop[2778]: #4 0x7ffdd07c57c0 b resource:///org/gnome/gjs/modules/overrides/Gio.js:90 (0x7fa9e8103670 @ 118)
kernel: gnome-shell[2778]: segfault at 100000016 ip 00007faa120f3e0d sp 00007ffdd07c4e30 error 4 in libgobject-2.0.so.0.5400.1[7faa120be000+52000]

GDB stack trace :

#0 0x00007f4c409ece0d in g_type_check_instance_cast () at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#1 0x00007f4c3e15a768 in st_label_set_text (label=0x555574a9df60, text=0x55557754b990 "No activity") at ../src/st/st-label.c:331
#2 0x00007f4c3a64be18 in ffi_call_unix64 () at /usr/lib/x86_64-linux-gnu/libffi.so.6
#3 0x00007f4c3a64b87a in ffi_call () at /usr/lib/x86_64-linux-gnu/libffi.so.6
#4 0x00007f4c3f6af3c8 in () at /usr/lib/libgjs.so.0
#5 0x00007f4c3f6b0ca4 in () at /usr/lib/libgjs.so.0
#6 0x00007f4c3763fe6c in () at /usr/lib/x86_64-linux-gnu/libmozjs-52.so.0
#7 0x00007f4c37632eca in () at /usr/lib/x86_64-linux-gnu/libmozjs-52.so.0
#8 0x00007f4c3763f6d6 in () at /usr/lib/x86_64-linux-gnu/libmozjs-52.so.0
#9 0x00007f4c3763fcaf in () at /usr/lib/x86_64-linux-gnu/libmozjs-52.so.0
#10 0x00007f4c3763ff89 in () at /usr/lib/x86_64-linux-gnu/libmozjs-52.so.0
#11 0x00007f4c37433d09 in () at /usr/lib/x86_64-linux-gnu/libmozjs-52.so.0

Revision history for this message
François-Xavier Thomas (fxt.airinov) wrote :

By the way, comment #48 is on Ubuntu Artful, latest packages at the time of writing, with Gnome Shell 3.26.1-0ubuntu4.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Thanks for all these reports...

Unfortunately all these issues are unrelated to the shell itself, but I please you guys to report these crashes to the extensions authors (as I already did in various cases, proposing fixes too).

In fact, what I suspect might have changed is the way gjs (or new mozjs) handles the destruction of the actors (as js elements)... Or the shell itself might destroy the extension actors at its request.

When this happens, the extensions should block all the async operations that are happening, so as a generic rule I guess they should connect to the extension actor "destroy" signal and stop all the async operations there.

Revision history for this message
gadLinux (gad-aguilardelgado) wrote : Re: [Bug 1714989] Re: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64() [Global App Menu specific?]

Hi,

Yes, but's quite difficult for normal user know what's the plugin that's
behaving wrong.

Best regards,

On 17/11/17 22:40, Marco Trevisan (Treviño) wrote:
> Thanks for all these reports...
>
> Unfortunately all these issues are unrelated to the shell itself, but I
> please you guys to report these crashes to the extensions authors (as I
> already did in various cases, proposing fixes too).
>
> In fact, what I suspect might have changed is the way gjs (or new mozjs)
> handles the destruction of the actors (as js elements)... Or the shell
> itself might destroy the extension actors at its request.
>
> When this happens, the extensions should block all the async operations
> that are happening, so as a generic rule I guess they should connect to
> the extension actor "destroy" signal and stop all the async operations
> there.
>

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote : Re: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64() [Global App Menu specific?]

GadLinux, not so hard now... We've added tools in gnome-shell to show this in the journal.

Or just follow this https://is.gd/wiki_gnome_shell_crash_debug to see what's crashing.

Anyway, the fix for the issue of GS is in gnome, will be released in next point release.

summary: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from
- st_label_set_text() from ffi_call_unix64() [Global App Menu specific?]
+ st_label_set_text() from ffi_call_unix64()
Changed in gnome-shell:
status: Confirmed → Fix Released
Revision history for this message
gadLinux (gad-aguilardelgado) wrote : Re: [Bug 1714989] Re: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64() [Global App Menu specific?]

Hi Marco,

Good. I will give it a try. But since the whole screen get freezed I
don't know if I will able catch anything.

Best regards,

On 21/11/17 17:08, Marco Trevisan (Treviño) wrote:
> GadLinux, not so hard now... We've added tools in gnome-shell to show
> this in the journal.
>
> Or just follow this https://is.gd/wiki_gnome_shell_crash_debug to see
> what's crashing.
>
> Anyway, the fix for the issue of GS is in gnome, will be released in
> next point release.
>
> ** Summary changed:
>
> - gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64() [Global App Menu specific?]
> + gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64()
>

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Well, you won't be able to catch it immediately.

But when you restart your session, journalctl will still contain the trace

Revision history for this message
André (afsverissimo) wrote :

@marco, should an extension be able to crash a gnome-shell session?

This does not seem right, I'm sure it is not that simple, but if this by design then there should be a warning on gnome-extensions, or some information on next session startup (or disable them all).

It took me a while to understand which extension was causing the problem. And while I disabled some that were described in this bug report, those were not causing it. For me it was dash-to-dock and now it one is triggered by low disk notification

The only pattern I've detected is that it was always triggered by notifications.

Anyway... i feel that this creates frustration and a bad user experience as I had to install an alternative environment for those critical moments where it has to work (and cannot afford to free space/disable extensions/debug)

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

André, this is something we discussed a bit upstream (see comments starting from https://bugzilla.gnome.org/show_bug.cgi?id=788931#c61).

So as said it would be better not to make it crash, the shell too... However it's something gjs should probably handle better, but I'm not sure how this is something that could be wanted or not upstream. I'm looking how to manage that, though.

It's even true that those extensions should not play with objects that might have been destroyed on their async functions, then they need to be fixed too.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Adding gjs here as it's the one that should avoid such hard crashes.

In order to avoid them I've prepared a pull request for upstream
 https://gitlab.gnome.org/GNOME/gjs/merge_requests/22

And that works quite well in such cases, let's see what upstream thinks.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gjs (Ubuntu):
status: New → Confirmed
Revision history for this message
dino99 (9d9) wrote :
Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote : Re: [Bug 1714989] Re: gnome-shell crashed with SIGSEGV in g_type_check_instance_cast() from st_label_set_text() from ffi_call_unix64()

2017-12-04 23:50 GMT-05:00 dino99 <email address hidden>:
> new gjs available:
> http://ftp.gnome.org/pub/GNOME/sources/gjs/1.51/gjs-1.51.2.news

The fix isn't included in that release yet, however I've just pushed
upstream a backport for the gnome-3.26 branch, so it might be
available at next point release.

Revision history for this message
Luis Alberto Pabón (copong) wrote :

Thank you, would be great to have this backported into 17.10 as this is causing me occasional login issues with the set of extensions I have installed.

Revision history for this message
anagor (anagor) wrote :

I'm running gnome-shell on upgraded Ubuntu 17.10 with X server, not Wayland, due to other compatibility issues.
In my case if I lock the desktop but the gnome-shell is restarted because of segfault it kills the lock screen and leaves the desktop completely open with the user logged in.

I therefore think that this bug as it manifests in ubuntu's gnome-shell should be upgraded to critical/security.

Thank you,

Revision history for this message
André (afsverissimo) wrote :

Marco, thanks for the context and the steps you and the team are taking to resolve this issue more broadly. Linking js and C is bound to have these problems.

And it seems that the extensions are also maturing and dealing with the bug reports.

Revision history for this message
Daniel van Vugt (vanvugt) wrote :

It appears the fix for this bug is scheduled for release in gnome-shell, specifically 3.26.3:

https://git.gnome.org/browse/gnome-shell/commit/?h=gnome-3-26&id=3b4be770a0590bcee9c739f3d9264320e23d555b

fermulator (fermulator)
Changed in gnome-shell (Ubuntu):
status: Incomplete → Confirmed
tags: added: bionic
tags: added: fixed-in-3.26.3
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gnome-shell - 3.27.91-0ubuntu1

---------------
gnome-shell (3.27.91-0ubuntu1) bionic; urgency=medium

  [ Didier Roche ]
  * New upstream version (LP: #1751070, LP: #1722725,
    LP: #1714989, LP: #1724557, LP: #1723857, LP: #1744970):
    - debian/patches/70_allow_sound_above_100.patch,
      debian/patches/ubuntu-lightdm-user-switching.patch patches
      refreshed for new release. Removed ': function()' syntax as
      upstreamed removed them in those context.
    - debian/patches/ubuntu_panel_center_date_workarea.patch removed as
      upstreamed now.
    - debian/control.in, debian/rules:
      bump deps, add sassc and libnm-dev which is now required.
      drop caribou dep, as the OSK is now built-in.
    - debian/rules:
      use now with renamed build options.
  * debian/ubuntu-session-mods/ubuntu.css, debian/rules:
    - adapt to new GNOME Shell theme including OSK.
    - color shift keys in orange in OSK and use differente svg.
  * debian/rules:
    - some duplication removal.
  * debian/patches/27-nm-libexec-path.patch,
    debian/patches/71_smarter_alt_tab.patch,
    debian/patches/fix-wayland-vbox-crash.patch,
    debian/patches/optional-hot-corner.patch,
    debian/patches/ubuntu_block_mode_extension_update.patch,
    debian/patches/ubuntu_gdm.patch,
    debian/patches/ubuntu_lock_on_suspend.patch:
    - unfuzzed
  * Cherry-pick git_ea0770ae22a6c34797db4343cf7d2f59bb8d68f6.patch:
    - upstream mutter API bump.
  * debian/gnome-shell-common.install, debian/rules:
    - the .css files aren't shipped anymore, so copy from the built version.

  [ Jeremy Bicha ]
  * Update NetworkManager dependencies

 -- Didier Roche <email address hidden> Fri, 02 Mar 2018 10:04:06 +0100

Changed in gnome-shell (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

It's still happening in 3.28.0: bug 1759621

Revision history for this message
Daniel van Vugt (vanvugt) wrote :

Closing this bug, but it continues in bug 1759621.

Changed in gjs (Ubuntu):
status: Confirmed → Invalid
description: updated
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

OK then. Forget bug 1759621. Let's continue using this one.

Changed in gjs (Ubuntu):
status: Invalid → Confirmed
assignee: nobody → Marco Trevisan (Treviño) (3v1n0)
description: updated
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Paul, or anyone else affected,

Accepted gnome-shell into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gnome-shell/3.28.2-0ubuntu0.18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in gnome-shell (Ubuntu Bionic):
status: New → Fix Committed
tags: added: verification-needed verification-needed-bionic
Changed in gjs (Ubuntu Bionic):
status: New → Won't Fix
Changed in gjs (Ubuntu):
status: Confirmed → Triaged
Revision history for this message
Sebastien Bacher (seb128) wrote :

Using 3.28.2-0ubuntu0.18.04.1 there are no visible issues and the error report page has no entry for this version

tags: added: verification-done verification-done-bionic
removed: verification-needed verification-needed-bionic
Revision history for this message
Robert Mader (robert.posteo) wrote :

The patch got accepted upstream for gnome-shell 3.30. And hopefully for some 3.28.3 version.

For Fedora users who end up here because it's the top entry on a common search engine, the corresponding bug entry is here: https://bugzilla.redhat.com/show_bug.cgi?id=1489554

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gnome-shell - 3.28.2-0ubuntu0.18.04.1

---------------
gnome-shell (3.28.2-0ubuntu0.18.04.1) bionic; urgency=medium

  [ Olivier Tilloy ]
  * New upstream release (LP: #1775145)
    - fixes valid password rejection at login screen (LP: #1765261)
  * Drop patches applied upstream:
    - debian/patches/polkitAgent-Guard-against-repeated-close-calls.patch
    - debian/patches/popupMenu-Fix-wrong-call-to-clutter_actor_add_child.patch
    - debian/patches/workspaceThumbnail-initialize-porthole-based-on-workArea.patch
    - debian/patches/workspaceThumbnail-only-update-_porthole-if-the-overview-.patch
    - debian/patches/workspaceThumbnail-rebuild-thumbnails-if-workareas-size-c.patch

  [ Andrea Azzarone ]
  * debian/patches/ubuntu_lock_on_suspend.patch: inhibit suspend until the
    screen is locked also in the case where automatic screen lock is disabled
    and screen lock on suspend is enabled (LP: #1768786)

  [ Marco Trevisan (Treviño) ]
  * Cherry pick upstream patches:
    - debian/patches/st-label-Unset-clutter-text-instance-on-disposal.patch (LP: #1714989)
  * debian/patches/st-texture-cache-Don-t-add-NULL-textures-to-cache.patch:
    - Cherry pick updated version from upstream, splitted in:
    + debian/patches/st-texture-cache-Don-t-add-NULL-textures-to-cache.patch
    + debian/patches/st-texture-cache-Save-cairo-surfaces-to-a-different-map.patch
  * debian/patches/authPrompt-Do-not-enable-sensitivity-if-retries-are-disal.patch
    debian/patches/authPrompt-Unset-preemptiveAnswer-on-reset.patch
    debian/patches/gdm-util-Always-allow-to-retry-login-in-unlock-mode.patch:
    - GDM gnome-shell greeter fix to fix unneeded login attempts (LP: #1777956)
  * debian/patches/series:
    - reorder to apply upstream cherry-picks before the others

  [ Daniel van Vugt ]
  * debian/patches/magnifier.js-Fix-zoom-juddering.patch:
    - magnifier.js: Fix zoom juddering (LP: #1691675)

 -- Marco Trevisan <email address hidden> Tue, 21 Jun 2018 01:45:42 +0200

Changed in gnome-shell (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Steve Langasek (vorlon) wrote : Update Released

The verification of the Stable Release Update for gnome-shell has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.