Bug 2013245

Summary: After update to RHEL 8.5 gnome-shell on wayland crashes once in an hour
Product: Red Hat Enterprise Linux 8 Reporter: Michael Mráka <mmraka>
Component: mutterAssignee: Jonas Ådahl <jadahl>
Status: CLOSED DUPLICATE QA Contact: Desktop QE <desktop-qa-list>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 8.5CC: fmuellner, jadahl, jkoten, jwboyer, lmiksik, pekopec, sbarcomb, stransky, tlestach, tpelka, tpopela
Target Milestone: rcKeywords: Regression, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-14 11:17:24 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Michael Mráka 2021-10-12 12:45:27 UTC
Description of problem:
After update to RHEL 8.5 wayland crashes once in an hour.

Version-Release number of selected component (if applicable):
gnome-desktop3 3.32.2 1.el8 x86_64
gnome-session 3.28.1 13.el8 x86_64
gnome-session-wayland-session 3.28.1 13.el8 x86_64
gnome-shell 3.32.2 40.el8 x86_64
libwayland-client 1.19.0 1.el8 x86_64
libwayland-cursor 1.19.0 1.el8 x86_64
libwayland-egl 1.19.0 1.el8 x86_64
libwayland-server 1.19.0 1.el8 x86_64
qt5-qtwayland 5.15.2 2.el8 x86_64
xorg-x11-server-Xwayland 21.1.1 6.el8 x86_64


How reproducible:
no exact reproducer

Steps to Reproduce:
1. login into gnome/wayland
2. start firefox
3. after some time it crashes when clicking on a link in firefox
4. sometimes it crashes when trying to rearrange tabs in 'Tree Style Tab' extension

Actual results:
Oct 12 14:11:55 magni org.gnome.Shell.desktop[2840]: **
Oct 12 14:11:55 magni org.gnome.Shell.desktop[2840]: mutter:ERROR:../src/wayland/meta-wayland-surface.c:791:meta_wayland_surface_apply_pending_state: assertion failed: (wl_list_empty (&pending->frame_callback_list
))
Oct 12 14:11:55 magni org.gnome.Shell.desktop[2840]: == Stack trace for context 0x5562fb7ee2d0 ==
Oct 12 14:11:55 magni systemd[1]: Created slice system-systemd\x2dcoredump.slice.
Oct 12 14:11:55 magni systemd[1]: Started Process Core Dump (PID 8918/UID 0).


Expected results:
no crash

Additional info:
Even after freshOct 12 14:19:32 magni gnome-shell[2829]: Object Meta.Background (0x55c62c83a980), has been already deallocated — impossible to access it. This might be caused by the object having been destroyed from C code using>
Oct 12 14:19:32 magni gnome-shell[2829]: g_object_run_dispose: assertion 'G_IS_OBJECT (object)' failed
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: == Stack trace for context 0x55c62c172240 ==
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #0   55c62c439778 i   resource:///org/gnome/shell/ui/background.js:707 (7f0939d09790 @ 22)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #1   55c62c4396f0 i   resource:///org/gnome/shell/ui/tweener.js:106 (7f0939fd2dc0 @ 37)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #2   7ffdf0587c00 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:208 (7f0939fda280 @ 54)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #3   7ffdf0587ce0 I   resource:///org/gnome/gjs/modules/tweener/tweener.js:342 (7f0939fda310 @ 1742)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #4   7ffdf0587d90 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:355 (7f0939fda3a0 @ 100)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #5   7ffdf0587e20 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:370 (7f0939fda430 @ 10)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #6   7ffdf0587f10 b   resource:///org/gnome/gjs/modules/signals.js:142 (7f0939fbedc0 @ 386)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #7   7ffdf0587fc0 b   resource:///org/gnome/shell/ui/tweener.js:238 (7f0939fd6820 @ 159)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #8   7ffdf0588060 b   resource:///org/gnome/shell/ui/tweener.js:209 (7f0939fd6700 @ 15)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: == Stack trace for context 0x55c62c172240 ==
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #0   55c62c439778 i   resource:///org/gnome/shell/ui/background.js:707 (7f0939d09790 @ 22)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #1   55c62c4396f0 i   resource:///org/gnome/shell/ui/tweener.js:106 (7f0939fd2dc0 @ 37)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #2   7ffdf0587c00 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:208 (7f0939fda280 @ 54)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #3   7ffdf0587ce0 I   resource:///org/gnome/gjs/modules/tweener/tweener.js:342 (7f0939fda310 @ 1742)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #4   7ffdf0587d90 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:355 (7f0939fda3a0 @ 100)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #5   7ffdf0587e20 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:370 (7f0939fda430 @ 10)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #6   7ffdf0587f10 b   resource:///org/gnome/gjs/modules/signals.js:142 (7f0939fbedc0 @ 386)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #7   7ffdf0587fc0 b   resource:///org/gnome/shell/ui/tweener.js:238 (7f0939fd6820 @ 159)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #8   7ffdf0588060 b   resource:///org/gnome/shell/ui/tweener.js:209 (7f0939fd6700 @ 15)
Oct 12 14:19:32 magni gnome-shell[2829]: Object Meta.Background (0x55c62c83a980), has been already deallocated — impossible to access it. This might be caused by the object having been destroyed from C code using>
Oct 12 14:19:32 magni gnome-shell[2829]: g_object_run_dispose: assertion 'G_IS_OBJECT (object)' failed
Oct 12 14:19:32 magni gnome-shell[2829]: Object Meta.Background (0x55c62c83a980), has been already deallocated — impossible to access it. This might be caused by the object having been destroyed from C code using>
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: == Stack trace for context 0x55c62c172240 ==
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #0   55c62c4396f0 i   resource:///org/gnome/shell/ui/background.js:707 (7f0939d09790 @ 22)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #1   7ffdf0587b90 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:208 (7f0939fda280 @ 54)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #2   7ffdf0587ce0 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:342 (7f0939fda310 @ 1742)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #3   7ffdf0587d90 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:355 (7f0939fda3a0 @ 100)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #4   7ffdf0587e20 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:370 (7f0939fda430 @ 10)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #5   7ffdf0587f10 b   resource:///org/gnome/gjs/modules/signals.js:142 (7f0939fbedc0 @ 386)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #6   7ffdf0587fc0 b   resource:///org/gnome/shell/ui/tweener.js:238 (7f0939fd6820 @ 159)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #7   7ffdf0588060 b   resource:///org/gnome/shell/ui/tweener.js:209 (7f0939fd6700 @ 15)
Oct 12 14:19:32 magni gnome-shell[2829]: g_object_run_dispose: assertion 'G_IS_OBJECT (object)' failed
Oct 12 14:19:32 magni gnome-shell[2829]: Object Meta.Background (0x55c62d1f8930), has been already deallocated — impossible to access it. This might be caused by the object having been destroyed from C code using>
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: == Stack trace for context 0x55c62c172240 ==
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #0   55c62c4396f0 i   resource:///org/gnome/shell/ui/background.js:707 (7f0939d09790 @ 22)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #1   7ffdf0586810 b   resource:///org/gnome/shell/ui/tweener.js:106 (7f0939fd2dc0 @ 37)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #2   7ffdf0587b90 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:208 (7f0939fda280 @ 54)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #3   7ffdf0587ce0 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:342 (7f0939fda310 @ 1742)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #4   7ffdf0587d90 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:355 (7f0939fda3a0 @ 100)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #5   7ffdf0587e20 b   resource:///org/gnome/gjs/modules/tweener/tweener.js:370 (7f0939fda430 @ 10)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #6   7ffdf0587f10 b   resource:///org/gnome/gjs/modules/signals.js:142 (7f0939fbedc0 @ 386)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #7   7ffdf0587fc0 b   resource:///org/gnome/shell/ui/tweener.js:238 (7f0939fd6820 @ 159)
Oct 12 14:19:32 magni org.gnome.Shell.desktop[2829]: #8   7ffdf0588060 b   resource:///org/gnome/shell/ui/tweener.js:209 (7f0939fd6700 @ 15)
Oct 12 14:19:32 magni gnome-shell[2829]: g_object_run_dispose: assertion 'G_IS_OBJECT (object)' failed
 startup I can see this traceback in journal:

Comment 1 Michael Mráka 2021-10-12 13:46:06 UTC
Reproducer:
Moving tabs in tabs in firefox (firefox-91.2.0-4.el8_4.x86_64) with 'Tree Style Tab' extension causes the crash nearly in 100% cases.


Downgrade to gnome-shell-3.32.2-30.el8.x86_64 does not fix the issue.

Comment 2 Michael Mráka 2021-10-12 14:02:00 UTC
Reproducer update:
1. install firefox (firefox-91.2.0-4.el8_4.x86_64)
2. create new firefox profile (fresh, clean, without any extension)
3. open 2 tabs, move the last tab before the first tab (to the right)
4. whole desktop crashes

Comment 3 Tomas Pelka 2021-10-12 20:59:58 UTC
Can you please check with https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=1750609 it is a build created in 8.5 buildroot not 8.4 like the one you are using.

Comment 4 Tomas Popela 2021-10-13 05:51:45 UTC
Based on:

"Oct 12 14:11:55 magni org.gnome.Shell.desktop[2840]: mutter:ERROR:../src/wayland/meta-wayland-surface.c:791:meta_wayland_surface_apply_pending_state: assertion failed: (wl_list_empty (&pending->frame_callback_list":

and as Firefox is involved, let me add Martin to the CC as he has done some drag and drop fixes in Firefox recently. What's actually your Firefox version? Wasn't Firefox updated at the same time from 78.x to 91.x?

Comment 5 Michael Mráka 2021-10-13 07:42:34 UTC
> Can you please check with https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=1750609 it is
> a build created in 8.5 buildroot not 8.4 like the one you are using.

This build does not make any change.

> What's actually your Firefox version? Wasn't Firefox updated at the same time from 78.x to 91.x?

firefox.x86_64 91.2.0-4.el8_4
The issue is reproducible even with firefox.x86_64 78.14.0-1.el8_4.
Firefox has been upgraded before the RHEL 8.5 beta upgrade.

--

Actually I was able to track the issue down to mutter.
After downgrade to mutter-3.32.2-57.el8.x86_64 tabs in firefox don't cause crash anymore.

On the other hand it causes a different issue when firefox window is not refreshed.
E.g. when you scroll down mouse wheel the window still displays old content not scrolled one. After leaving window and moving back content is refreshed.

This actually makes firefox on 8.5 Beta unusable and I'm marking the bug as blocker.

Comment 8 Tomas Popela 2021-10-13 08:45:56 UTC
(In reply to Michael Mráka from comment #5)
> > Can you please check with https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=1750609 it is
> > a build created in 8.5 buildroot not 8.4 like the one you are using.
> 
> This build does not make any change.
> 
> > What's actually your Firefox version? Wasn't Firefox updated at the same time from 78.x to 91.x?
> 
> firefox.x86_64 91.2.0-4.el8_4
> The issue is reproducible even with firefox.x86_64 78.14.0-1.el8_4.
> Firefox has been upgraded before the RHEL 8.5 beta upgrade.
> 
> --
> 
> Actually I was able to track the issue down to mutter.
> After downgrade to mutter-3.32.2-57.el8.x86_64 tabs in firefox don't cause
> crash anymore.

Just to be sure - installing https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=1654047 aka mutter-3.32.2-58.el8 (this particular build and not any newer one) breaks it again?

* Mon Jul 05 2021 Jonas Ådahl <jadahl> - 3.32.2-58
- Backport xauth and xhost patches
  Resolves: #1949176

Comment 9 Michael Mráka 2021-10-13 11:07:31 UTC
Current situation is following:

mutter-3.32.2-57.el8.x86_64 (RHEL 8.4) - no crash but firefox doesn't refresh window
mutter-3.32.2-58.el8.x86_64 (brew) - no crash but firefox doesn't refresh window
mutter-3.32.2-59.el8.x86_64 (RHEL 8.5 Beta) - moving tabs in firefox crashes whole desktop