Bug 2362341

Created attachment 2087244 [details]
File: proc_pid_status

Created attachment 2087245 [details]
File: maps

Created attachment 2087246 [details]
File: limits

Created attachment 2087247 [details]
File: environ

Created attachment 2087248 [details]
File: open_fds

Created attachment 2087249 [details]
File: mountinfo

Created attachment 2087250 [details]
File: os_info

Created attachment 2087251 [details]
File: cpuinfo

Created attachment 2087252 [details]
File: core_backtrace

Created attachment 2087253 [details]
File: dso_list

Created attachment 2087254 [details]
File: backtrace

I cannot reproduce your backtrace. Many X11 applications does not call CloseMessageProc() and I need to know which X11 application you tried when you get your backtrace.
_free_x11_iconn_from_id() works fine in my tests so it might be a timing issue.

(In reply to Ingo Weiss from comment #11)
> Created attachment 2087254 [details]
> File: backtrace

#2  0x00007f8b11751abe in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
        ret = <optimized out>
#3  0x00007f8b117396d0 in __GI_abort () at abort.c:73
        act = {__sigaction_handler = {sa_handler = 0x7fff406e0550, sa_sigaction = 0x7fff406e0550}, sa_mask = {__val = {94647561524016, #8  __GI___libc_free (mem=mem@entry=0x5614da4aaec0) at malloc.c:3476
        ar_ptr = <optimized out>
        p = 0x5614da4aaeb0
        err = 11
#9  0x00007f8b11abbc45 in g_free (mem=0x5614da4aaec0) at ../glib/gmem.c:208
#10 0x00007f8b11d06000 in signal_data_free (signal_data=0x5614da48dc30) at ../gio/gdbusconnection.c:428
#11 remove_signal_data_if_unused (connection=connection@entry=0x5614da4934d0 [GDBusConnection], signal_data=0x5614da48dc30) at ../gio/gdbusconnection.c:4068
        sender_unique_name = <optimized out>
        signal_data_array = <optimized out>
#12 0x00007f8b11d063bb in unsubscribe_id_internal.isra.0 (connection=connection@entry=0x5614da4934d0 [GDBusConnection], subscription_id=subscription_id@entry=26) at ../gio/gdbusconnection.c:4106
        subscriber = <optimized out>
        signal_data = <optimized out>
        n = <optimized out>
        n_removed = 1
#13 0x00007f8b11d06462 in g_dbus_connection_signal_unsubscribe (connection=0x5614da4934d0 [GDBusConnection], subscription_id=26) at ../gio/gdbusconnection.c:4147
        n_subscribers_removed = <optimized out>
#14 g_dbus_connection_signal_unsubscribe (connection=0x5614da4934d0 [GDBusConnection], subscription_id=26) at ../gio/gdbusconnection.c:4138
#15 0x00007f8b11d1983f in g_dbus_proxy_finalize (object=0x5614da4abb40 [IBusInputContext]) at ../glib/gmain.h:920
#16 0x00007f8b11be4f69 in g_object_unref (_object=0x5614da4abb40) at ../gobject/gobject.c:4509
        object = 0x5614da4abb40 [IBusInputContext]
        old_ref = 1
#17 0x00005614b0a8d6a1 in _free_ic (data=0x5614da4a78c0, user_data=<optimized out>) at /usr/src/debug/ibus-1.5.32-1.fc42.x86_64/client/x11/main.c:814
        x11ic = 0x5614da4a78c0
#18 0x00007f8b11ab19d0 in g_list_foreach (list=<optimized out>, list@entry=0x5614da4971a0 = {...}, func=0x5614b0a8d650 <_free_ic>, user_data=user_data@entry=0x0) at ../glib/glist.c:1008
#19 0x00007f8b11ab74e7 in g_list_free_full (list=0x5614da4971a0 = {...}, free_func=<optimized out>) at ../glib/glist.c:162
#20 0x00005614b0a8d723 in _free_x11_iconn_from_id (connect_id=1) at /usr/src/debug/ibus-1.5.32-1.fc42.x86_64/client/x11/main.c:837
#21 0x00005614b0a995a2 in CloseMessageProc (ims=0x5614da46fa20, call_data=0x7fff406e09b0, p=0x5614da43ebf4 "\024V") at ../../util/IMdkit/i18nPtHdr.c:302
#22 _Xi18nMessageHandler (ims=ims@entry=0x5614da46fa20, connect_id=<optimized out>, p=p@entry=0x5614da4aa6d0 " ", delete=delete@entry=0x7fff406e0c14) at ../../util/IMdkit/i18nPtHdr.c:1821

I think I was switching ibus input methods at the time it failed. I don't remember seeing this issue recently and I doubt it's still meaningful after 1.5.32-2.