Bug 1638784

Summary: gnome software crash involving strchr and g_param_spec_pool_lookup error: Cannot access memory at address 0xa at gparam.c:1071 in libgobject-2.0.so.0
Product: [Fedora] Fedora Reporter: Matt Fagnani <matt.fagnani>
Component: gnome-softwareAssignee: Richard Hughes <rhughes>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 29CC: klember, kparal, lruzicka, rhughes
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: gnome-software-3.30.3-1.fc29 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-21 15:47:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1517014    
Attachments:
Description Flags
journalctl output from when gnome software started to its crash
none
valgrind log output running on gnome-software
none
valgrind output of gnome-software error messages none

Description Matt Fagnani 2018-10-12 12:51:29 UTC 
Created attachment 1493316 [details]
journalctl output from when gnome software started to its crash

Description of problem:
I started gnome software 3.30.2-1 to test the appstream-0.12.2-2.fc29 appstream-data-29-7.fc29 update https://bodhi.fedoraproject.org/updates/FEDORA-2018-3e4ee09428  After I clicked on Updates and then on the refresh button, gnome software crashed. I installed the gnome-software, glibc, glib2, gtk3, libffi debug packages. I ran coredumpctl debug which gave the following output.

PID: 6807 (gnome-software)
           UID: 1000 (matt)
           GID: 1000 (matt)
        Signal: 11 (SEGV)
     Timestamp: Fri 2018-10-12 07:15:00 EDT (16min ago)
  Command Line: /usr/bin/gnome-software
    Executable: /usr/bin/gnome-software
 Control Group: /user.slice/user-1000.slice/session-2.scope
          Unit: session-2.scope
         Slice: user-1000.slice
       Session: 2
     Owner UID: 1000 (matt)
       Boot ID: 45bf2e8a8f99491ea41d44a42f1e9ebb
    Machine ID: 68c534516091436b931b8f2dd87b8100
      Hostname: dimension
       Storage: /var/lib/systemd/coredump/core.gnome-software.1000.45bf2e8a8f99491ea41d44a42f1e9ebb.6807.1539342900000000.lz4
       Message: Process 6807 (gnome-software) of user 1000 dumped core.
                
                Stack trace of thread 6807:
                #0  0x00000000b6be905b strchr (libc.so.6)
                #1  0x00000000b7e987f2 g_param_spec_pool_lookup (libgobject-2.0.so.0)
                #2  0x00000000b7e935a7 g_object_new_valist (libgobject-2.0.so.0)
                #3  0x00000000b7e93a8d g_object_new (libgobject-2.0.so.0)
                #4  0x0000000000490a25 gs_updates_page_get_new_updates (gnome-software)
                #5  0x00000000b7e8c34c _g_closure_invoke_va (libgobject-2.0.so.0)
                #6  0x00000000b7ea8a6e g_signal_emit_valist (libgobject-2.0.so.0)
                #7  0x00000000b7ea90e9 g_signal_emit (libgobject-2.0.so.0)
                #8  0x00000000b7407b0d gtk_button_clicked (libgtk-3.so.0)
                #9  0x00000000b7407bad n/a (libgtk-3.so.0)
                #10 0x00000000b7407c1a n/a (libgtk-3.so.0)
                #11 0x00000000b7e8c34c _g_closure_invoke_va (libgobject-2.0.so.0)
                #12 0x00000000b7ea8a6e g_signal_emit_valist (libgobject-2.0.so.0)
                #13 0x00000000b7ea90e9 g_signal_emit (libgobject-2.0.so.0)
                #14 0x00000000b7405e9f n/a (libgtk-3.so.0)
                #15 0x00000000b698cf1e ffi_call_SYSV (libffi.so.6)
                #16 0x00000000b698c94e ffi_call (libffi.so.6)
                #17 0x00000000b7e8cf4f g_cclosure_marshal_generic_va (libgobject-2.0.so.0)
                #18 0x00000000b7e8c34c _g_closure_invoke_va (libgobject-2.0.so.0)
                #19 0x00000000b7ea8a6e g_signal_emit_valist (libgobject-2.0.so.0)
                #20 0x00000000b7ea90e9 g_signal_emit (libgobject-2.0.so.0)
                #21 0x00000000b74dae89 n/a (libgtk-3.so.0)
                #22 0x00000000b7e8f1e9 g_cclosure_marshal_VOID__BOXEDv (libgobject-2.0.so.0)
                #23 0x00000000b7e8c34c _g_closure_invoke_va (libgobject-2.0.so.0)
                #24 0x00000000b7ea8a6e g_signal_emit_valist (libgobject-2.0.so.0)
                #25 0x00000000b7ea90e9 g_signal_emit (libgobject-2.0.so.0)
                #26 0x00000000b74d7c89 n/a (libgtk-3.so.0)
                #27 0x00000000b74d93f9 n/a (libgtk-3.so.0)
                #28 0x00000000b74dc778 n/a (libgtk-3.so.0)
                #29 0x00000000b74a0e4f gtk_event_controller_handle_event (libgtk-3.so.0)
                #30 0x00000000b767bdde n/a (libgtk-3.so.0)
                #31 0x00000000b76d744c n/a (libgtk-3.so.0)
                #32 0x00000000b7e8c34c _g_closure_invoke_va (libgobject-2.0.so.0)
                #33 0x00000000b7ea86d4 g_signal_emit_valist (libgobject-2.0.so.0)
                #34 0x00000000b7ea90e9 g_signal_emit (libgobject-2.0.so.0)
                #35 0x00000000b767e3cf n/a (libgtk-3.so.0)
                #36 0x00000000b7526d50 n/a (libgtk-3.so.0)
                #37 0x00000000b75292ca gtk_main_do_event (libgtk-3.so.0)
                #38 0x00000000b71fdb9b n/a (libgdk-3.so.0)
                #39 0x00000000b723263b n/a (libgdk-3.so.0)
                #40 0x00000000b7d8f5c5 g_main_dispatch (libglib-2.0.so.0)
                #41 0x00000000b7d8f9a9 g_main_context_iterate (libglib-2.0.so.0)
                #42 0x00000000b7d8fa5b g_main_context_iteration (libglib-2.0.so.0)
                #43 0x00000000b7bf08b3 g_application_run (libgio-2.0.so.0)
                #44 0x0000000000449cd6 main (gnome-software)
                #45 0x00000000b6b80c09 __libc_start_main (libc.so.6)
                #46 0x0000000000449d9c _start (gnome-software)

...
Core was generated by `/usr/bin/gnome-software'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  strchr () at ../sysdeps/i386/strchr.S:61
61              movb (%eax), %cl        /* load byte in question (we need it twice) */
[Current thread is 1 (Thread 0xb5476980 (LWP 6807))]
...
(gdb) bt
#0  0xb6be905b in strchr () at ../sysdeps/i386/strchr.S:61
#1  0xb7e987f2 in g_param_spec_pool_lookup
    (pool=0x21a2680, param_name=0xa <error: Cannot access memory at address 0xa>, owner_type=0x22c55c0 [GsPluginJob], walk_ancestors=1) at gparam.c:1071
#2  0xb7e935a7 in g_object_new_valist
    (object_type=<optimized out>, first_property_name=<optimized out>, var_args=0xbf8b425c "") at gobject.c:2097
#3  0xb7e93a8d in g_object_new
    (object_type=0x22c55c0 [GsPluginJob], first_property_name=0x4ba01a "action")
    at gobject.c:1648
#4  0x00490a25 in gs_updates_page_get_new_updates (self=0x3d68338 [GsUpdatesPage])
    at ../src/gs-updates-page.c:810
#5  0xb7e8c34c in _g_closure_invoke_va
    (closure=0x3f30540, return_value=0x0, instance=0x3f17900, args=0xbf8b445c "\341z@\267\313z@\267\024\071\264\267", n_params=0, param_types=0x0) at gclosure.c:873
#6  0xb7ea8a6e in g_signal_emit_valist
    (instance=0x3f17900, signal_id=272, detail=0, var_args=0xbf8b445c "\341z@\267\313z@\267\024\071\264\267") at gsignal.c:3300
#7  0xb7ea90e9 in g_signal_emit (instance=0x3f17900, signal_id=272, detail=0)
    at gsignal.c:3447
#8  0xb7407b0d in gtk_button_clicked (button=0x3f17900 [GtkButton])
    at gtkbutton.c:1541
#9  0xb7407bad in gtk_button_do_release
    (button=0x3f17900 [GtkButton], emit_clicked=<optimized out>)
    at gtkbutton.c:1845
#10 0xb7407c1a in gtk_real_button_released (button=0x3f17900 [GtkButton])
    at gtkbutton.c:1963
--Type <RET> for more, q to quit, c to continue without paging--c
#11 0xb7e8c34c in _g_closure_invoke_va (closure=0x3cf2fa0, return_value=0x0, instance=0x3f17900, args=0xbf8b46ac "\220y\f\267", n_params=0, param_types=0x0) at gclosure.c:873
#12 0xb7ea8a6e in g_signal_emit_valist (instance=0x3f17900, signal_id=271, detail=0, var_args=0xbf8b46ac "\220y\f\267") at gsignal.c:3300
#13 0xb7ea90e9 in g_signal_emit (instance=0x3f17900, signal_id=271, detail=0) at gsignal.c:3447
#14 0xb7405e9f in multipress_released_cb (gesture=0x3e8fe30 [GtkGestureMultiPress], n_press=1, x=19, y=16, widget=0x3f17900 [GtkButton]) at gtkbutton.c:666
#15 0xb698cf1e in ffi_call_SYSV () at ../src/x86/sysv.S:65
#16 0xb698c94e in ffi_call (cif=0xbf8b4864, fn=0xb7405e70 <multipress_released_cb>, rvalue=0xbf8b47f0, avalue=0xbf8b47b0) at ../src/x86/ffi.c:382
#17 0xb7e8cf4f in g_cclosure_marshal_generic_va (closure=<optimized out>, return_value=<optimized out>, instance=<optimized out>, args_list=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=<optimized out>) at gclosure.c:1610
#18 0xb7e8c34c in _g_closure_invoke_va (closure=0x3f2e580, return_value=0x0, instance=0x3e8fe30, args=0xbf8b4a5c "\001", n_params=3, param_types=0x325f8f0) at gclosure.c:873
#19 0xb7ea8a6e in g_signal_emit_valist (instance=0x3e8fe30, signal_id=265, detail=0, var_args=0xbf8b4a5c "\001") at gsignal.c:3300
#20 0xb7ea90e9 in g_signal_emit (instance=0x3e8fe30, signal_id=265, detail=0) at gsignal.c:3447
#21 0xb74dae89 in gtk_gesture_multi_press_end (gesture=0x3e8fe30 [GtkGestureMultiPress], sequence=0x0) at gtkgesturemultipress.c:286
#22 0xb7e8f1e9 in g_cclosure_marshal_VOID__BOXEDv (closure=<optimized out>, return_value=0x0, instance=<optimized out>, args=0xbf8b4cac "", marshal_data=0xb74dade0 <gtk_gesture_multi_press_end>, n_params=1, param_types=0x28c4360) at gmarshal.c:1950
#23 0xb7e8c34c in _g_closure_invoke_va (closure=0x3ce2d90, return_value=0x0, instance=0x3e8fe30, args=0xbf8b4cac "", n_params=1, param_types=0x28c4360) at gclosure.c:873
#24 0xb7ea8a6e in g_signal_emit_valist (instance=0x3e8fe30, signal_id=260, detail=0, var_args=0xbf8b4cac "") at gsignal.c:3300
#25 0xb7ea90e9 in g_signal_emit (instance=0x3e8fe30, signal_id=260, detail=0) at gsignal.c:3447
#26 0xb74d7c89 in _gtk_gesture_set_recognized (sequence=0x0, recognized=0, gesture=0x3e8fe30 [GtkGestureMultiPress]) at gtkgesture.c:345
#27 0xb74d7c89 in _gtk_gesture_check_recognized (gesture=gesture@entry=0x3e8fe30 [GtkGestureMultiPress], sequence=sequence@entry=0x0) at gtkgesture.c:386
#28 0xb74d93f9 in gtk_gesture_handle_event (controller=0x3e8fe30 [GtkGestureMultiPress], event=0xb3c89f60) at gtkgesture.c:814
#29 0xb74dc778 in gtk_gesture_single_handle_event (controller=0x3e8fe30 [GtkGestureMultiPress], event=0xb3c89f60) at gtkgesturesingle.c:222
#30 0xb74a0e4f in gtk_event_controller_handle_event (controller=0x3e8fe30 [GtkGestureMultiPress], event=0xb3c89f60) at gtkeventcontroller.c:230
#31 0xb767bdde in _gtk_widget_run_controllers (widget=0x3f17900 [GtkButton], event=0xb3c89f60, phase=GTK_PHASE_BUBBLE) at gtkwidget.c:7379
#32 0xb76d744c in _gtk_marshal_BOOLEAN__BOXEDv (closure=0x21db3e0, return_value=0xbf8b4ef4, instance=<optimized out>, args=0xbf8b4fac "`\237ȳ\330O\213\277`\237ȳ", marshal_data=0xb767be30 <gtk_widget_real_button_event>, n_params=1, param_types=0x21db400) at gtkmarshalers.c:129
#33 0xb7e8c34c in _g_closure_invoke_va (closure=0x21db3e0, return_value=0xbf8b4ef4, instance=0x3f17900, args=0xbf8b4fac "`\237ȳ\330O\213\277`\237ȳ", n_params=1, param_types=0x21db400) at gclosure.c:873
#34 0xb7ea86d4 in g_signal_emit_valist (instance=0x3f17900, signal_id=88, detail=0, var_args=0xbf8b4fac "`\237ȳ\330O\213\277`\237ȳ") at gsignal.c:3300
#35 0xb7ea90e9 in g_signal_emit (instance=0x3f17900, signal_id=88, detail=0) at gsignal.c:3447
#36 0xb767e3cf in gtk_widget_event_internal (widget=widget@entry=0x3f17900 [GtkButton], event=event@entry=0xb3c89f60) at gtkwidget.c:7744
#37 0xb7680661 in gtk_widget_event (widget=0x3f17900 [GtkButton], event=0xb3c89f60) at gtkwidget.c:7314
#38 0xb7526d50 in propagate_event_up (topmost=<optimized out>, event=<optimized out>, widget=0x3f17900 [GtkButton]) at gtkmain.c:2582
#39 0xb7526d50 in propagate_event (widget=<optimized out>, event=0xb3c89f60, captured=<optimized out>, topmost=0x0) at gtkmain.c:2685
#40 0xb75292ca in gtk_main_do_event (event=0xb3c89f60) at gtkmain.c:1915
#41 0xb71fdb9b in _gdk_event_emit (event=0xb3c89f60) at gdkevents.c:73
#42 0xb723263b in gdk_event_source_dispatch (source=0x21bc890, callback=0x0, user_data=0x0) at gdkeventsource.c:367
#43 0xb7d8f5c5 in g_main_dispatch (context=0x21d0c70) at gmain.c:3182
#44 0xb7d8f5c5 in g_main_context_dispatch (context=0x21d0c70) at gmain.c:3847
#45 0xb7d8f9a9 in g_main_context_iterate (context=context@entry=0x21d0c70, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3920
#46 0xb7d8fa5b in g_main_context_iteration (context=0x21d0c70, may_block=1) at gmain.c:3981
#47 0xb7bf08b3 in g_application_run (application=0x21ac8d8 [GsApplication], argc=1, argv=0xbf8b52e4) at gapplication.c:2470
#48 0x00449cd6 in main (argc=1, argv=0xbf8b52e4) at ../src/gs-main.c:53

The error: Cannot access memory at address 0xa in g_param_spec_pool_lookup at gparam.c:1071 in libgobject-2.0.so.0 might be related to the crash. The journal messages before the crash involve gnome software using libostree to update flatpak repositories for gnome at least some of which I think are from flathub. 
...
Oct 12 07:14:31 dimension PackageKit[6819]: search-file transaction /26426_cbaceacc from uid 1000 finished with success after 294ms
Oct 12 07:14:33 dimension gnome-software[6807]: libostree pull from 'gnome-apps' for appstream2/i386 complete
                                                security: GPG: summary+commit http: TLS
                                                non-delta: meta: 1 content: 0
                                                transfer: secs: 2 size: 313 bytes
Oct 12 07:14:35 dimension gnome-software[6807]: libostree pull from 'gnome-apps' for appstream2/i386 complete
                                                security: GPG: summary+commit http: TLS
                                                non-delta: meta: 1 content: 0
                                                transfer: secs: 1 size: 313 bytes
Oct 12 07:14:39 dimension gnome-software[6807]: libostree pull from 'gnome-apps-nightly' for appstream/i386 complete
                                                security: GPG: summary+commit http: TLS
                                                non-delta: meta: 2 content: 0
                                                transfer: secs: 1 size: 519 bytes
Oct 12 07:14:43 dimension gnome-software[6807]: libostree pull from 'gnome-apps-nightly' for appstream/i386 complete
                                                security: GPG: summary+commit http: TLS
                                                non-delta: meta: 5 content: 7
                                                transfer: secs: 4 size: 704.7 kB
Oct 12 07:15:00 dimension audit[6807]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=6807 comm="gnome-software" exe="/usr/bin/gnome-software" sig=11 res=1
Oct 12 07:15:00 dimension kernel: gnome-software[6807]: segfault at a ip b6be905b sp bf8b4018 error 4 in libc-2.28.so[b6b7f000+124000]
Oct 12 07:15:00 dimension kernel: Code: 64 11 03 8b 44 24 08 5f c3 66 90 66 90 66 90 f3 0f 1e fb 57 8b 44 24 08 8b 54 24 0c 88 d6 89 d1 c1 e2 10 66 89 ca a8 03 74 48 <8a> 08 38 ca 0f 84 40 01 00 00 84 c9 0f 84 0d 01 00 00 40 a8 03 74 
Oct 12 07:15:00 dimension systemd[1]: Started Process Core Dump (PID 7122/UID 0).

I'll attach the journalctl output from when gnome-software started to its crash.
I can provide more information if it would help.

Version-Release number of selected component (if applicable):
gnome-software-0:3.30.2-1.fc29.i686
glib2-0:2.58.1-1.fc29.i686
glibc-0:2.28-9.fc29.i686
gtk3-0:3.24.1-1.fc29.i686
plasma-desktop-0:5.13.5-1.fc29.i686


How reproducible:
This crash occurred one of two times I started gnome software. I got a different crash the first time which I reported in another entry.

Steps to Reproduce:
1. update to appstream-0.12.2-2.fc29 appstream-data-29-7.fc29
2. start gnome software
3. click on Updates
4. click on the refresh button

Actual results:
gnome software crashed when clicking the refresh button in the Updates part.

Expected results:
gnome software doesn't crash

Additional info:
Comment 1 Matt Fagnani 2018-10-14 02:52:07 UTC 
This crash still occurred after I downgraded to appstream-data-29-6 so it is unrelated to the update to appstream-data-29-7. The full trace had the error: Cannot access memory at address 0xa also in the #2 g_object_new_valist function so that might be where the problem started.

(gdb) bt full
#0  0xb6be905b in strchr () at ../sysdeps/i386/strchr.S:61
#1  0xb7e987f2 in g_param_spec_pool_lookup
    (pool=0x21a2680, param_name=0xa <error: Cannot access memory at address 0xa>, owner_type=0x22c55c0 [GsPluginJob], walk_ancestors=1) at gparam.c:1071
        pspec = <optimized out>
        delim = <optimized out>
        __func__ = "g_param_spec_pool_lookup"
#2  0xb7e935a7 in g_object_new_valist
    (object_type=<optimized out>, first_property_name=<optimized out>, var_args=0xbf8b425c "") at gobject.c:2097
        error = 0x0
        pspec = <optimized out>
        stack_params = 
            {{pspec = 0x236ad20 [GParamUInt], value = 0xbf8b40e0}, {pspec = 0x2222120 [GParamUInt64], value = 0xbf8b40c0}, {pspec = 0xb7b43914, value = 0x3d749a0}, {pspec = 0x4c33c7, value = 0xbf8b4218}, {pspec = 0xb7464da5, value = 0xb6d0b7a0 <main_arena>}, {pspec = 0x41, value = 0x0}, {pspec = 0x3f, value = 0xb7464d05 <gtk_css_node_set_property+261>}, {pspec = 0xb7b43914, value = 0x3ed0ad8}, {pspec = 0x978fb500, value = 0x3d749a0}, {pspec = 0x44d, value = 0xb7e916cb <g_object_new_internal+11>}, {pspec = 0xb7ee0cb8, value = 0x0}, {pspec = 0x0, value = 0xbf8b4228}, {pspec = 0xb7e930ec, value = 0x2e9b060}, {pspec = 0x0, value = 0x21e5a30}, {pspec = 0xb7d95055, value = 0x2e9b060}, {pspec = 0x3d68338 [GsUpdatesPage], value = 0x0}}
        params = 0xbf8b417c
        name = 0xa <error: Cannot access memory at address 0xa>
        n_params = 2
        class = <optimized out>
        unref_class = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--c
        object = <optimized out>
        __func__ = "g_object_new_valist"
#3  0xb7e93a8d in g_object_new (object_type=0x22c55c0 [GsPluginJob], first_property_name=0x4ba01a "action") at gobject.c:1648
        object = <optimized out>
        var_args = 0xbf8b4248 "\037"
#4  0x00490a25 in gs_updates_page_get_new_updates (self=0x3d68338 [GsUpdatesPage]) at ../src/gs-updates-page.c:810
        plugin_job = 0x0
#5  0xb7e8c34c in _g_closure_invoke_va (closure=0x3f30540, return_value=0x0, instance=0x3f17900, args=0xbf8b445c "\341z@\267\313z@\267\024\071\264\267", n_params=0, param_types=0x0) at gclosure.c:873
        marshal = 0xb7e8e340 <g_cclosure_marshal_VOID__VOIDv>
        marshal_data = 0x0
        in_marshal = 0
        real_closure = 0x3f30530
        __func__ = "_g_closure_invoke_va"
#6  0xb7ea8a6e in g_signal_emit_valist (instance=0x3f17900, signal_id=272, detail=0, var_args=0xbf8b445c "\341z@\267\313z@\267\024\071\264\267") at gsignal.c:3300
        return_accu = 0x0
        accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        accumulator = <optimized out>
        emission = {next = 0xbf8b45d8, instance = 0x3f17900, ihint = {signal_id = 272, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 0x2cc9df0 [GtkButton/GtkBin/GtkContainer/GtkWidget/GInitiallyUnowned]}
        signal_id = 272
        instance_type = 0x2cc9df0 [GtkButton/GtkBin/GtkContainer/GtkWidget/GInitiallyUnowned]
        emission_return = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = <optimized out>
        static_scope = <optimized out>
        fastpath_handler = <optimized out>
        closure = <optimized out>
        run_type = <optimized out>
        hlist = <optimized out>
        l = <optimized out>
        fastpath = 1
        instance_and_params = <optimized out>
        signal_return_type = <optimized out>
        param_values = <optimized out>
        node = 0x3cf3070
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#7  0xb7ea90e9 in g_signal_emit (instance=0x3f17900, signal_id=272, detail=0) at gsignal.c:3447
        var_args = 0xbf8b445c "\341z@\267\313z@\267\024\071\264\267"
#8  0xb7407b0d in gtk_button_clicked (button=0x3f17900 [GtkButton]) at gtkbutton.c:1541
        __func__ = "gtk_button_clicked"
#9  0xb7407bad in gtk_button_do_release (button=0x3f17900 [GtkButton], emit_clicked=<optimized out>) at gtkbutton.c:1845
        emit_clicked = <optimized out>
        button = 0x3f17900 [GtkButton]
        priv = 0x3f17800
#10 0xb7407c1a in gtk_real_button_released (button=0x3f17900 [GtkButton]) at gtkbutton.c:1963
#11 0xb7e8c34c in _g_closure_invoke_va (closure=0x3cf2fa0, return_value=0x0, instance=0x3f17900, args=0xbf8b46ac "\220y\f\267", n_params=0, param_types=0x0) at gclosure.c:873
        marshal = 0xb7e8a760 <g_type_class_meta_marshalv>
        marshal_data = 0x1fc
        in_marshal = 0
        real_closure = 0x3cf2f90
        __func__ = "_g_closure_invoke_va"
#12 0xb7ea8a6e in g_signal_emit_valist (instance=0x3f17900, signal_id=271, detail=0, var_args=0xbf8b46ac "\220y\f\267") at gsignal.c:3300
        return_accu = 0x0
        accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        accumulator = <optimized out>
        emission = {next = 0xbf8b4988, instance = 0x3f17900, ihint = {signal_id = 271, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 0x2cc9df0 [GtkButton/GtkBin/GtkContainer/GtkWidget/GInitiallyUnowned]}
        signal_id = 271
        instance_type = 0x2cc9df0 [GtkButton/GtkBin/GtkContainer/GtkWidget/GInitiallyUnowned]
        emission_return = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = <optimized out>
        static_scope = <optimized out>
        fastpath_handler = <optimized out>
        closure = <optimized out>
        run_type = <optimized out>
        hlist = <optimized out>
        l = <optimized out>
        fastpath = 1
        instance_and_params = <optimized out>
        signal_return_type = <optimized out>
        param_values = <optimized out>
        node = 0x3cf2fe0
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#13 0xb7ea90e9 in g_signal_emit (instance=0x3f17900, signal_id=271, detail=0) at gsignal.c:3447
        var_args = 0xbf8b46ac "\220y\f\267"
#14 0xb7405e9f in multipress_released_cb (gesture=0x3e8fe30 [GtkGestureMultiPress], n_press=1, x=19, y=16, widget=0x3f17900 [GtkButton]) at gtkbutton.c:666
        button = 0x3f17900 [GtkButton]
        priv = 0x3f17800
        sequence = <optimized out>
#15 0xb698cf1e in ffi_call_SYSV () at ../src/x86/sysv.S:65
#16 0xb698c94e in ffi_call (cif=0xbf8b4864, fn=0xb7405e70 <multipress_released_cb>, rvalue=0xbf8b47f0, avalue=0xbf8b47b0) at ../src/x86/ffi.c:382
        ecif = {cif = 0xbf8b4864, rvalue = 0xbf8b47f0, avalue = 0xbf8b47b0}
#17 0xb7e8cf4f in g_cclosure_marshal_generic_va (closure=<optimized out>, return_value=<optimized out>, instance=<optimized out>, args_list=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=<optimized out>) at gclosure.c:1610
        rtype = <optimized out>
        rvalue = 0xbf8b47f0
        n_args = <optimized out>
        atypes = <optimized out>
        args = <optimized out>
        storage = <optimized out>
        i = <optimized out>
        cif = {abi = FFI_SYSV, nargs = 5, arg_types = 0xbf8b47d0, rtype = 0xb698e090 <ffi_type_void>, bytes = 32, flags = 0}
        cc = <optimized out>
        enum_tmpval = <optimized out>
        tmpval_used = 0
        args_copy = 0xbf8b4a70 "ȘS\257\002"
#18 0xb7e8c34c in _g_closure_invoke_va (closure=0x3f2e580, return_value=0x0, instance=0x3e8fe30, args=0xbf8b4a5c "\001", n_params=3, param_types=0x325f8f0) at gclosure.c:873
        marshal = 0xb7e8cbc0 <g_cclosure_marshal_generic_va>
        marshal_data = 0x0
        in_marshal = 0
        real_closure = 0x3f2e570
        __func__ = "_g_closure_invoke_va"
#19 0xb7ea8a6e in g_signal_emit_valist (instance=0x3e8fe30, signal_id=265, detail=0, var_args=0xbf8b4a5c "\001") at gsignal.c:3300
        return_accu = 0x0
        accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        accumulator = <optimized out>
        emission = {next = 0xbf8b4bd8, instance = 0x3e8fe30, ihint = {signal_id = 265, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 0x28b0110 [GtkGestureMultiPress/GtkGestureSingle/GtkGesture/GtkEventController]}
        signal_id = 265
        instance_type = 0x28b0110 [GtkGestureMultiPress/GtkGestureSingle/GtkGesture/GtkEventController]
        emission_return = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = <optimized out>
        static_scope = <optimized out>
        fastpath_handler = <optimized out>
        closure = <optimized out>
        run_type = <optimized out>
        hlist = <optimized out>
        l = <optimized out>
        fastpath = 1
        instance_and_params = <optimized out>
        signal_return_type = <optimized out>
        param_values = <optimized out>
        node = 0x3296370
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#20 0xb7ea90e9 in g_signal_emit (instance=0x3e8fe30, signal_id=265, detail=0) at gsignal.c:3447
        var_args = 0xbf8b4a5c "\001"
#21 0xb74dae89 in gtk_gesture_multi_press_end (gesture=0x3e8fe30 [GtkGestureMultiPress], sequence=0x0) at gtkgesturemultipress.c:286
        multi_press = 0x3e8fe30 [GtkGestureMultiPress]
        priv = 0x3e8fdb8
        current = 0x0
        x = 19
        y = 16
        interpreted = <optimized out>
        state = <optimized out>
#22 0xb7e8f1e9 in g_cclosure_marshal_VOID__BOXEDv (closure=<optimized out>, return_value=0x0, instance=<optimized out>, args=0xbf8b4cac "", marshal_data=0xb74dade0 <gtk_gesture_multi_press_end>, n_params=1, param_types=0x28c4360) at gmarshal.c:1950
        cc = 0x3ce2d90
        data1 = 0x3e8fe30
        data2 = <optimized out>
        callback = 0xb74dade0 <gtk_gesture_multi_press_end>
        arg0 = 0x0
        args_copy = 0xbf8b4cb0 "{~M\267\024\071\264\267\r|M\267\024\071\264\267\060\376\350\003`\237ȳ"
#23 0xb7e8c34c in _g_closure_invoke_va (closure=0x3ce2d90, return_value=0x0, instance=0x3e8fe30, args=0xbf8b4cac "", n_params=1, param_types=0x28c4360) at gclosure.c:873
        marshal = 0xb7e8a760 <g_type_class_meta_marshalv>
        marshal_data = 0x84
        in_marshal = 0
        real_closure = 0x3ce2d80
        __func__ = "_g_closure_invoke_va"
#24 0xb7ea8a6e in g_signal_emit_valist (instance=0x3e8fe30, signal_id=260, detail=0, var_args=0xbf8b4cac "") at gsignal.c:3300
        return_accu = 0x0
        accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        accumulator = <optimized out>
        emission = {next = 0xbf8b4ed8, instance = 0x3e8fe30, ihint = {signal_id = 260, detail = 0, run_type = G_SIGNAL_RUN_LAST}, state = EMISSION_RUN, chain_type = 0x28b0110 [GtkGestureMultiPress/GtkGestureSingle/GtkGesture/GtkEventController]}
        signal_id = 260
        instance_type = 0x28b0110 [GtkGestureMultiPress/GtkGestureSingle/GtkGesture/GtkEventController]
        emission_return = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = <optimized out>
        static_scope = <optimized out>
        fastpath_handler = <optimized out>
        closure = <optimized out>
        run_type = <optimized out>
        hlist = <optimized out>
        l = <optimized out>
        fastpath = 1
        instance_and_params = <optimized out>
        signal_return_type = <optimized out>
        param_values = <optimized out>
        node = 0x3b8af40
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#25 0xb7ea90e9 in g_signal_emit (instance=0x3e8fe30, signal_id=260, detail=0) at gsignal.c:3447
        var_args = 0xbf8b4cac ""
#26 0xb74d7c89 in _gtk_gesture_set_recognized (sequence=0x0, recognized=0, gesture=0x3e8fe30 [GtkGestureMultiPress]) at gtkgesture.c:345
        priv = <optimized out>
        priv = 0x3e8fe00
        has_matching_touchpoints = <optimized out>
#27 0xb74d7c89 in _gtk_gesture_check_recognized (gesture=gesture@entry=0x3e8fe30 [GtkGestureMultiPress], sequence=sequence@entry=0x0) at gtkgesture.c:386
        priv = 0x3e8fe00
        has_matching_touchpoints = <optimized out>
#28 0xb74d93f9 in gtk_gesture_handle_event (controller=0x3e8fe30 [GtkGestureMultiPress], event=0xb3c89f60) at gtkgesture.c:814
        was_recognized = 1
        sequence = 0x0
        priv = <optimized out>
        controller = 0x3e8fe30 [GtkGestureMultiPress]
        event = 0xb3c89f60
        gesture = 0x3e8fe30 [GtkGestureMultiPress]
        source_device = <optimized out>
#29 0xb74dc778 in gtk_gesture_single_handle_event (controller=0x3e8fe30 [GtkGestureMultiPress], event=0xb3c89f60) at gtkgesturesingle.c:222
        sequence = <optimized out>
        source_device = <optimized out>
        source = <optimized out>
        button = <optimized out>
        i = <optimized out>
        retval = <optimized out>
        test_touchscreen = <optimized out>
#30 0xb74a0e4f in gtk_event_controller_handle_event (controller=0x3e8fe30 [GtkGestureMultiPress], event=0xb3c89f60) at gtkeventcontroller.c:230
        controller_class = 0x3c9bc50
        retval = 0
        __func__ = "gtk_event_controller_handle_event"
#31 0xb767bdde in _gtk_widget_run_controllers (widget=0x3f17900 [GtkButton], event=0xb3c89f60, phase=GTK_PHASE_BUBBLE) at gtkwidget.c:7379
        controller_phase = <optimized out>
        next = 0x0
        data = 0x3f2ae10
        handled = 0
        priv = 0x3f17850
        l = <optimized out>
#32 0xb76d744c in _gtk_marshal_BOOLEAN__BOXEDv (closure=0x21db3e0, return_value=0xbf8b4ef4, instance=<optimized out>, args=0xbf8b4fac "`\237ȳ\330O\213\277`\237ȳ", marshal_data=0xb767be30 <gtk_widget_real_button_event>, n_params=1, param_types=0x21db400) at gtkmarshalers.c:129
        cc = 0x21db3e0
        data1 = 0x3f17900
        data2 = <optimized out>
        callback = 0xb767be30 <gtk_widget_real_button_event>
        v_return = <optimized out>
        arg0 = 0xb3c89f60
        args_copy = 0xbf8b4fb0 "\330O\213\277`\237ȳ"
        __func__ = "_gtk_marshal_BOOLEAN__BOXEDv"
#33 0xb7e8c34c in _g_closure_invoke_va (closure=0x21db3e0, return_value=0xbf8b4ef4, instance=0x3f17900, args=0xbf8b4fac "`\237ȳ\330O\213\277`\237ȳ", n_params=1, param_types=0x21db400) at gclosure.c:873
        marshal = 0xb7e8a760 <g_type_class_meta_marshalv>
        marshal_data = 0xc4
        in_marshal = 0
        real_closure = 0x21db3d0
        __func__ = "_g_closure_invoke_va"
#34 0xb7ea86d4 in g_signal_emit_valist (instance=0x3f17900, signal_id=88, detail=0, var_args=0xbf8b4fac "`\237ȳ\330O\213\277`\237ȳ") at gsignal.c:3300
        return_accu = 0xbf8b4ef4
        accu = {g_type = 0x14 [gboolean], data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        accumulator = <optimized out>
        emission = {next = 0x0, instance = 0x3f17900, ihint = {signal_id = 88, detail = 0, run_type = G_SIGNAL_RUN_LAST}, state = EMISSION_RUN, chain_type = 0x2cc9df0 [GtkButton/GtkBin/GtkContainer/GtkWidget/GInitiallyUnowned]}
        signal_id = 88
        instance_type = 0x2cc9df0 [GtkButton/GtkBin/GtkContainer/GtkWidget/GInitiallyUnowned]
        emission_return = {g_type = 0x14 [gboolean], data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = <optimized out>
        static_scope = <optimized out>
        fastpath_handler = <optimized out>
        closure = <optimized out>
        run_type = <optimized out>
        hlist = <optimized out>
        l = <optimized out>
        fastpath = 1
        instance_and_params = <optimized out>
        signal_return_type = <optimized out>
        param_values = <optimized out>
        node = 0x21db410
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#35 0xb7ea90e9 in g_signal_emit (instance=0x3f17900, signal_id=88, detail=0) at gsignal.c:3447
        var_args = 0xbf8b4fac "`\237ȳ\330O\213\277`\237ȳ"
#36 0xb767e3cf in gtk_widget_event_internal (widget=widget@entry=0x3f17900 [GtkButton], event=event@entry=0xb3c89f60) at gtkwidget.c:7744
        signal_num = <optimized out>
        return_val = <optimized out>
        handled = 0
        __func__ = "gtk_widget_event_internal"
#37 0xb7680661 in gtk_widget_event (widget=0x3f17900 [GtkButton], event=0xb3c89f60) at gtkwidget.c:7314
        __func__ = "gtk_widget_event"
#38 0xb7526d50 in propagate_event_up (topmost=<optimized out>, event=<optimized out>, widget=0x3f17900 [GtkButton]) at gtkmain.c:2582
        tmp = <optimized out>
        handled_event = <optimized out>
        handled_event = 0
#39 0xb7526d50 in propagate_event (widget=<optimized out>, event=0xb3c89f60, captured=<optimized out>, topmost=0x0) at gtkmain.c:2685
        handled_event = 0
#40 0xb75292ca in gtk_main_do_event (event=0xb3c89f60) at gtkmain.c:1915
        grab_widget = 0x3f17900 [GtkButton]
        window_group = <optimized out>
        rewritten_event = <optimized out>
        device = 0x2221818 [GdkX11DeviceCore]
        tmp_list = <optimized out>
        event_widget = <optimized out>
        topmost_widget = <optimized out>
        event = <optimized out>
        __func__ = "gtk_main_do_event"
        __func__ = "gtk_main_do_event"
#41 0xb71fdb9b in _gdk_event_emit (event=0xb3c89f60) at gdkevents.c:73
#42 0xb723263b in gdk_event_source_dispatch (source=0x21bc890, callback=0x0, user_data=0x0) at gdkeventsource.c:367
        display = <optimized out>
        event = 0xb3c89f60
#43 0xb7d8f5c5 in g_main_dispatch (context=0x21d0c70) at gmain.c:3182
        dispatch = <optimized out>
        prev_source = 0x0
        was_in_call = 0
        user_data = 0x0
        callback = 0x0
        cb_funcs = 0x0
        cb_data = 0x0
        need_destroy = <optimized out>
        source = 0x21bc890
        current = 0x21bdba8
        i = 0
        __func__ = "g_main_dispatch"
#44 0xb7d8f5c5 in g_main_context_dispatch (context=0x21d0c70) at gmain.c:3847
#45 0xb7d8f9a9 in g_main_context_iterate (context=context@entry=0x21d0c70, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3920
        max_priority = 2147483647
        timeout = 16
        some_ready = 1
        nfds = 4
        allocated_nfds = <optimized out>
        fds = <optimized out>
#46 0xb7d8fa5b in g_main_context_iteration (context=0x21d0c70, may_block=1) at gmain.c:3981
        retval = <optimized out>
#47 0xb7bf08b3 in g_application_run (application=0x21ac8d8 [GsApplication], argc=1, argv=0xbf8b52e4) at gapplication.c:2470
        arguments = 0x21dd1e0
        status = 0
        context = 0x21d0c70
        acquired_context = <optimized out>
        __func__ = "g_application_run"
#48 0x00449cd6 in main (argc=1, argv=0xbf8b52e4) at ../src/gs-main.c:53
        status = 0
        appinfo = 0x21d4c28
        application = 0x21ac8d8
        debug = 0x21a2800
Comment 2 Kalev Lember 2018-10-17 19:57:42 UTC 
Hm, both this and the other crash may be memory corruption. I can't see how else they could happen. Any chance you could run gnome-software under valgrind and see if it reports any invalid reads or writes?

I see you're running a 32 bit Fedora, which I suspect may be behind this somehow. We've only been testing gnome-software on 64 bits lately and something may have regressed on 32 bits.
Comment 3 Matt Fagnani 2018-10-18 02:24:54 UTC 
Created attachment 1495019 [details]
valgrind log output running on gnome-software
Comment 4 Matt Fagnani 2018-10-18 02:28:08 UTC 
The 0xa address in the error: Cannot access memory at address 0xa seems too short to be valid. The lowest I could see that error in the full trace was at #2 g_object_new_valist at gobject.c:2097 in libgobject-2.0.so.0 of glib so the source of the error might have been glib.

I hadn't run valgrind before tonight. I ran valgrind --leak-check=yes --log-file=valgrind-gnome-software-1.txt gnome-software based on reading the Valgrind Quick Start Guide and man valgrind. I reproduced the crash by clicking on the refresh button in the Updates screen. The error is an invalid read of size 1 byte 0xA.  The part of the valgrind log occurring when the crash happened was 

==3912== Invalid read of size 1
==3912==    at 0x483843E: index (vg_replace_strmem.c:251)
==3912==    by 0x49367F1: g_param_spec_pool_lookup (gparam.c:1071)
==3912==    by 0x49315A6: g_object_new_valist (gobject.c:2097)
==3912==    by 0x4931A8C: g_object_new (gobject.c:1648)
==3912==    by 0x173A24: gs_updates_page_get_new_updates (gs-updates-page.c:810)
==3912==    by 0x492A34B: _g_closure_invoke_va (gclosure.c:873)
==3912==    by 0x4946A6D: g_signal_emit_valist (gsignal.c:3300)
==3912==    by 0x49470E8: g_signal_emit (gsignal.c:3447)
==3912==    by 0x4DD8B0C: gtk_button_clicked (gtkbutton.c:1541)
==3912==    by 0x4DD8BAC: gtk_button_do_release (gtkbutton.c:1845)
==3912==    by 0x4DD8C19: gtk_real_button_released (gtkbutton.c:1963)
==3912==    by 0x492A34B: _g_closure_invoke_va (gclosure.c:873)
==3912==  Address 0xa is not stack'd, malloc'd or (recently) free'd
==3912== 
==3912== 
==3912== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==3912==  Access not within mapped region at address 0xA
==3912==    at 0x483843E: index (vg_replace_strmem.c:251)
==3912==    by 0x49367F1: g_param_spec_pool_lookup (gparam.c:1071)
==3912==    by 0x49315A6: g_object_new_valist (gobject.c:2097)
==3912==    by 0x4931A8C: g_object_new (gobject.c:1648)
==3912==    by 0x173A24: gs_updates_page_get_new_updates (gs-updates-page.c:810)
==3912==    by 0x492A34B: _g_closure_invoke_va (gclosure.c:873)
==3912==    by 0x4946A6D: g_signal_emit_valist (gsignal.c:3300)
==3912==    by 0x49470E8: g_signal_emit (gsignal.c:3447)
==3912==    by 0x4DD8B0C: gtk_button_clicked (gtkbutton.c:1541)
==3912==    by 0x4DD8BAC: gtk_button_do_release (gtkbutton.c:1845)
==3912==    by 0x4DD8C19: gtk_real_button_released (gtkbutton.c:1963)
==3912==    by 0x492A34B: _g_closure_invoke_va (gclosure.c:873)
==3912==  If you believe this happened as a result of a stack
==3912==  overflow in your program's main thread (unlikely but
==3912==  possible), you can try to increase the size of the
==3912==  main thread stack using the --main-stacksize= flag.
==3912==  The main thread stack size used in this run was 8388608.

Memory leaks were found as shown in the log file I'll attach. There were some additional error messages from gnome software output which I'll attach in another file. I can run valgrind with different options you might suggest if that would help. I'm running the i686 builds because my computer has a 32-bit Pentium 4 CPU. The error might have been 32-bit specific. I also have some additional flatpak repositories added some of which I added several months ago, and I'm not sure if they are all still working.

flatpak remotes
Name                                 Options          
flathub                              user             
gnome                                user             
gnome-apps                           user             
gnome-apps-nightly                   user             
gnome-nightly                        user             
kdeapps                              user             
kderuntime                           user             
org.mozilla.FirefoxRepo              user             
org.mozilla.FirefoxDevEdition-origin user,no-enumerate
Comment 5 Matt Fagnani 2018-10-18 02:30:11 UTC 
Created attachment 1495020 [details]
valgrind output of gnome-software error messages
Comment 6 Kalev Lember 2018-10-18 06:16:56 UTC 
I suspect https://gitlab.gnome.org/GNOME/gnome-software/merge_requests/126 fixes this, let me do a test build for you
Comment 7 Kalev Lember 2018-10-18 06:26:04 UTC 
Can you try if https://koji.fedoraproject.org/koji/taskinfo?taskID=30304350 helps? (And thanks so much for all the help with debugging this!)
Comment 8 Kalev Lember 2018-10-18 06:29:53 UTC 
Proposing as a Final Freeze Exception for F29 as gnome-software is super crashy right now on i386. This would be a blocker, except that i386 is no longer a blocking arch.
Comment 9 Kamil Páral 2018-10-18 12:33:18 UTC 
+1 FE
Kalev, can you please submit a new build to Bodhi ASAP? Thanks.
Comment 10 Fedora Update System 2018-10-18 13:57:33 UTC 
gnome-software-3.30.3-1.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-447d45de07
Comment 11 Matt Fagnani 2018-10-18 16:47:21 UTC 
I ran sudo dnf upgrade https://kojipkgs.fedoraproject.org//work/tasks/4354/30304354/gnome-software-3.30.2-1.fc29.mr125.i686.rpm https://kojipkgs.fedoraproject.org//work/tasks/4354/30304354/gnome-software-debuginfo-3.30.2-1.fc29.mr125.i686.rpm https://kojipkgs.fedoraproject.org//work/tasks/4354/30304354/gnome-software-debugsource-3.30.2-1.fc29.mr125.i686.rpm

After that upgrade, I clicked on the refresh button in the updates screen, and the crash didn't happen. "Looking for new updates... (this might take a while)" alternating with "Downloading new updates... (this might take a while)" was shown with a spinning circle, followed by "Unable to get list of updates: failed to get updates for refresh: Timeout was reached" in a pop-up box. "Software is up to date" was shown after a few minutes. The second time I clicked refresh the above happened and OS Updates and Problem Reporting showed up. So the crash was resolved in gnome-software-3.30.2-1.fc29.mr125.i686.rpm 

The crashes I noted in #1638767 didn't occur with the test build when I clicked on the Audio & Video and Productivity categories or more... buttons on the main screen and those screens showed up correctly. I clicked on Communication & News Graphics & Photography, and Add-ons, but those screens were not loaded.

I ran sudo dnf upgrade https://kojipkgs.fedoraproject.org//packages/gnome-software/3.30.3/1.fc29/i686/gnome-software-3.30.3-1.fc29.i686.rpm https://kojipkgs.fedoraproject.org//packages/gnome-software/3.30.3/1.fc29/i686/gnome-software-debuginfo-3.30.3-1.fc29.i686.rpm https://kojipkgs.fedoraproject.org//packages/gnome-software/3.30.3/1.fc29/i686/gnome-software-debugsource-3.30.3-1.fc29.i686.rpm

3.30.3 first showed "No application data found" and a pop-up box stating that it needed to be restarted to use new plugins which I did. When I clicked on the refresh button in the updates screen in 3.30.3, it showed checking... and "Downloading new updates... (this might take a while)" with no crashes. The OS Update and Problem reporting updates showed the versions involved and the update sizes which I didn't see with the test build. Clicking on all of the categories and the more... button showed those screens correctly. I didn't get any crashes of 3.30.3. Thanks for your help and the updates.
Comment 12 Kalev Lember 2018-10-18 18:01:33 UTC 
No problem!
Comment 13 Lukas Ruzicka 2018-10-19 08:11:15 UTC 
The update received enough Karma in Bodhi and according to Bodhi users messages, it solves the problem and works fine. I believe, we can verify this bug.
Comment 14 Fedora Update System 2018-10-20 19:23:08 UTC 
gnome-software-3.30.3-1.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-447d45de07
Comment 15 Fedora Update System 2018-10-21 15:47:08 UTC 
gnome-software-3.30.3-1.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.