Bug 1436604

from the stacktrace I am unable to understand the cause for this crash.
I don't know how to solve this.

@Beniamino, assign to you, maybe you have an idea. Otherwise, let's close as INSUFFICIENT_DATA.

 #0 g_type_check_instance_is_fundamentally_a (type_instance=type_instance@entry=0x7f024c01bab0, fundamental_type=fundamental_type@entry=80) at gtype.c:4032
 #1 g_object_ref (_object=_object@entry=0x7f024c01bab0) at gobject.c:3045
 #2 signal_cb (connection=<optimized out>, sender_name=0x7f0250094fa0 ":1.6646", object_path=<optimized out>, interface_name=0x7f02500975a0 "org.freedesktop.NetworkManager.Device.Statistics"
 #3 emit_signal_instance_in_idle_cb (data=0x7f0250097c70) at gdbusconnection.c:3701
 #4 g_main_context_dispatch (context=0x7f0269356c00) at gmain.c:3152
 #5 g_main_context_dispatch (context=context@entry=0x7f0269356c00) at gmain.c:3767
 #6 g_main_context_iterate (context=0x7f0269356c00, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3838
 #7 g_main_loop_run (loop=0x7f026934d1b0) at gmain.c:4032
 #8 main (argc=<optimized out>, argv=<optimized out>) at clients/cli/nmcli.c:600

*** Bug 1452642 has been marked as a duplicate of this bug. ***

http://faf.lab.eng.brq.redhat.com/faf/reports/2924/
NetworkManager-1.8.0-2.el7-ccpp-2017-05-16-05-07-21-73051.tar.gz

In signal_cb() (frame 2)

   │981     static void
   │982     signal_cb (GDBusConnection *connection,
   │983                const gchar     *sender_name,
   │984                const gchar     *object_path,
   │985                const gchar     *interface_name,
   │986                const gchar     *signal_name,
   │987                GVariant        *parameters,
   │988                gpointer         user_data)
   │989     {
   │990       GDBusObjectManagerClient *manager = G_DBUS_OBJECT_MANAGER_CLIENT (user_data);
   │991       GDBusObjectProxy *
   │992       GDBusInterface *interface;
   │993
   │994       g_mutex_lock (&manager->priv->lock);
   │995       object_proxy = g_hash_table_lookup (manager->priv->map_object_path_to_object_proxy, object_path);
   │996       if (object_proxy == NULL)
   │997         {
   │998           g_mutex_unlock (&manager->priv->lock);
   │999           goto out;
   │1000        }
  >│1001      g_object_ref (object_proxy);
   │1002      g_mutex_unlock (&manager->priv->lock);

manager->priv->map_object_path_to_object_proxy only contains one
element:

  addr=0x3fff9c0325a0
  {parent_instance = {g_type_instance = {g_class = 0x3fff9c0412b0}, ref_count = 1, qdata = 0x3fff9c041470}, priv = 0x3fff9c032580}
  interfaces:
   - 0x3fff9c040400 "org.freedesktop.NetworkManager.Device"
   - 0x3fff9c040480 "org.freedesktop.NetworkManager.Device.Bridge"
   - 0x3fff9c041190 "org.freedesktop.NetworkManager.Device.Statistics"

so object_proxy returned by the hash lookup must be this element (the
actual value is optimized out in the core dump).  However, the object
passed to g_type_check_instance_is_fundamentally_a() (frame 0) is
different:

 (GTypeInstance *) 0x3fff9c046800
 $ p *(GDBusObjectProxy *)0x3fff9c046800
 $125 = {parent_instance = {g_type_instance = {g_class = 0x2f6f72672f667265}, ref_count = 1701078387, qdata = 0x2f4e6574776f726b}, priv = 0x4d616e616765722f}

and contains garbage. At the moment it's not clear to me how this can
ever happen.

*** Bug 1457167 has been marked as a duplicate of this bug. ***

The stack trace is quite similar to the one in bug 1450075, and both suggest a race condition in the object manager initialization. I'm closing this as duplicate.

*** This bug has been marked as a duplicate of bug 1450075 ***