Bug 917422

Created attachment 704720 [details]
an output from gdb showing the crash

Description of problem:

On one machine and one account on it I am getting with an absolute repetability the following:


Core was generated by `/usr/bin/gnome-shell'.
Program terminated with signal 11, Segmentation fault.
#0  0x00000030c6437a9c in _cairo_surface_is_image (surface=0x5159f50)
    at cairo-image-surface-inline.h:77
77          return surface->backend && surface->backend->type == CAIRO_SURFACE_TYPE_IMAGE;

To get a reasonable gdb output the following were installed:
gnome-shell-debuginfo.x86_64
cairo-debuginfo.x86_64
glib2-debuginfo.x86_64
clutter-gtk-debuginfo.x86_64
mutter-debuginfo.x86_64

The problems turns out to be like this:

(gdb) p *surface
$1 = {backend = 0x2000000001, device = 0x0, type = CAIRO_SURFACE_TYPE_COGL, 
  content = 0, ref_count = {ref_count = 0}, status = CAIRO_STATUS_SUCCESS, 
  unique_id = 85303152, serial = 0, damage = 0x5159f70, _finishing = 0, 
  finished = 0, is_clear = 0, has_font_options = 0, owns_device = 0, 
  user_data = {size = 3, num_elements = 0, element_size = 0, elements = 0x0}, 
  mime_data = {size = 0, num_elements = 0, element_size = 0, elements = 0x0}, 
  device_transform = {xx = 0, yx = 1, xy = 0, yy = 0, x0 = 0, y0 = 1}, 
  device_transform_inverse = {xx = -nan(0xf000000000000), yx = 
    2.5674283339672213e-316, xy = 2.4330298302178687e-316, yy = 
    9.4860604001519336e-322, x0 = 1.6304166312761136e-322, y0 = 
    -nan(0xbffea91cf91b8)}, device_transform_observers = {next = 0x1081, 
    prev = 0x0}, x_resolution = 1.6304166312761136e-322, y_resolution = 
    -nan(0xbffea91cb5478), x_fallback_resolution = -nan(0xbffea906ebf30), 
  y_fallback_resolution = -nan(0xbffea7e431048), snapshot_of = 0x21, 
  snapshot_detach = 0xfffbffea91cb5478, snapshots = {next = 
    0xfffbffea906ebf30, prev = 0xfffbffea7e429ab0}, snapshot = {next = 0x31, 
    prev = 0xfffbffea91cb51b8}, font_options = {antialias = 2415958152, 
    subpixel_order = 4294705130, lcd_filter = CAIRO_LCD_FILTER_DEFAULT, 
    hint_style = CAIRO_HINT_STYLE_DEFAULT, hint_metrics = 
    CAIRO_HINT_METRICS_DEFAULT, round_glyph_positions = 
    CAIRO_ROUND_GLYPH_POS_DEFAULT}}
(gdb) p *surface->backend
Cannot access memory at address 0x2000000001

... and an attempt to deference a memory at 0x2000000001 is causing a segfault.

A whole backtrace (65 frames), a listing of a few frames and xz compressed core (the original size 184815616 bytes) is attached

Version-Release number of selected component (if applicable):
gnome-shell-3.6.3.1-1.fc18.x86_64 but earlier versions were doing the same

How reproducible:
always in very specific circumstances

Additional info:
This crash happens as follows:
gnome-shell-extension-weather has "Locations" switcher on its display which pops-out after clicking on the icon on a gnome-shell panel.  An attempt to click on those "Locations" is causing an instant segfault.  After the first failure of that sort gnome-shell recovers and restarts but repeating that action will likely cause a total crash of the whole session.

On the same installation another account does not suffer from that problem; also the same setup on other machines seems to work fine.  Only the one specific has this trouble.  It is using a background no other account is using but switching to a different background is not working around the issue.