Bug 1506706

Summary:	GNOME Shell 3.26.1 crash upon notifications with full-screen apps
Product:	[Fedora] Fedora	Reporter:	Anass Ahmed <anass.1430>
Component:	gnome-shell	Assignee:	Owen Taylor <otaylor>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	27	CC:	awilliam, berend, fmuellner, gnome-sig, joe, otaylor
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-06 17:19:32 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Anass Ahmed 2017-10-26 15:26:15 UTC

Description of problem:
This bug appears to affect GNOME Shell when there's an app in full-screen mode, and a notification is created in the background.

I use PushBullet to receive my Android phone notifications on Firefox. Everytime my phone chimes when it receives a notification, and I'm using a full-screen app (Videos, for example), the whole gnome-shell crashes, but the core-dump doesn't stay around in ABRT.

I only caught this line from `dmesg -w` that it happened to be open while the crash happened and the tmux session running it survived the crash:

[ 8245.324798] gnome-shell[1860]: segfault at 4b0 ip 00007fdef5a7549f sp 00007fff43dd7a78 error 4 in libgobject-2.0.so.0.5400.1[7fdef5a40000+51000]


Version-Release number of selected component (if applicable):
gnome-shell-3.26.1-2.fc27.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Open a full-screen app.
2. Trigger any notifications.
3.

Actual results:
GNOME Shell crashes.

Expected results:
GNOME Shell keeps the notification in the notification drawer.

Additional info:
I don't know how to use coredumpctl and I don't have enough space on my disk to install the debuginfo packages to analyze the core-dump locally if I happened to have it.

Comment 1 Anass Ahmed 2017-10-26 21:35:25 UTC

I just read `coredumpctl --help` and I did `coredumpctl dump $GNOME_SHELL_PID > gnome-shell.dump`. This generated a 1.3 GB file!!

I don't know where to upload such a big file, but here's the result of `coredumpctl info $GNOME_SHELL_PID`:

           PID: 31130 (gnome-shell)
           UID: 1000 (anass)
           GID: 1000 (anass)
        Signal: 11 (SEGV)
     Timestamp: Thu 2017-10-26 22:59:56 EET (33min ago)
  Command Line: /usr/bin/gnome-shell
    Executable: /usr/bin/gnome-shell
 Control Group: /user.slice/user-1000.slice/session-12.scope
          Unit: session-12.scope
         Slice: user-1000.slice
       Session: 12
     Owner UID: 1000 (anass)
       Boot ID: e64852d18d6e497ba8eb2f0530a323bd
    Machine ID: fe5660cf957c4ac6bd8d3ab170ec772b
      Hostname: anass-galago
       Storage: /var/lib/systemd/coredump/core.gnome-shell.1000.e64852d18d6e497ba8eb2f0530a323bd.31130.1509051596000000.lz4
       Message: Process 31130 (gnome-shell) of user 1000 dumped core.
                
                Stack trace of thread 31130:
                #0  0x00007f6809ad749f g_type_check_instance_is_fundamentally_a (libgobject-2.0.so.0)
                #1  0x00007f6809abb68e g_value_set_object (libgobject-2.0.so.0)
                #2  0x00007f6809aba3e2 g_object_get_property (libgobject-2.0.so.0)
                #3  0x00007f68087a71db n/a (libgjs.so.0)
                #4  0x00007f6800090a9a _ZL22GetNonexistentPropertyP9JSContextN2JS6HandleIPN2js12NativeObjectEEENS2_I4jsidEENS2_INS1_5ValueEEE12IsNameLookupNS1_13MutableHandleIS9_EE.isra.673 (libmozjs-52.so.0)
                #5  0x00007f68000b990b _ZN2js17NativeGetPropertyEP9JSContextN2JS6HandleIPNS_12NativeObjectEEENS3_INS2_5ValueEEENS3_I4jsidEENS2_13MutableHandleIS7_EE (libmozjs-52.so.0)
                #6  0x00007f68000bb12f _ZN2js11GetPropertyEP9JSContextN2JS6HandleINS2_5ValueEEENS3_IPNS_12PropertyNameEEENS2_13MutableHandleIS4_EE (libmozjs-52.so.0)
                #7  0x00007f67ffe6ae61 _ZN2js3jitL20ComputeGetPropResultEP9JSContextPNS0_13BaselineFrameE4JSOpN2JS6HandleIPNS_12PropertyNameEEENS6_13MutableHandleINS6_5ValueEEESD_ (libmozjs-52.so.0)
                #8  0x00007f67ffe835be _ZN2js3jitL17DoGetPropFallbackEP9JSContextPvPNS0_18ICGetProp_FallbackEN2JS13MutableHandleINS6_5ValueEEES9_ (libmozjs-52.so.0)
                #9  0x000006eaef8b0702 n/a (n/a)
                #10 0x000006eaefac5905 n/a (n/a)
                #11 0x0000559d2ad99c70 n/a (n/a)
                #12 0x000006eaefac5905 n/a (n/a)

I've disabled all GNOME extensions, and I stopped an app that was appearing as core-dumped just before GNOME Shell in the `coredumpctl` list which also happens to use systray icons too.

Comment 2 Anass Ahmed 2017-10-26 22:31:07 UTC

I compressed the dump file with gzip and it got surprisingly small: 86 MBs, and I uploaded it on Dropbox: https://www.dropbox.com/s/td7eh63ot66s91a/gnome-shell.dump.gz?dl=0

During the upload, another crash happened and ABRT could catch this time and tried to upload core-dump file to be analyzed then found a similar bug 1494586, but it couldn't add to this bug because the "backtrace isn't usable". The circumstances of this crash is different from the ones I observed before, but the crashes now are more frequent. The correlation between "full-screen apps" and "notifications" is maybe wrong.

Comment 3 Adam Williamson 2017-11-06 17:19:32 UTC

backtrace looks the same as 1494586 , yes.

*** This bug has been marked as a duplicate of bug 1494586 ***