gnome-shell crashed in mutter:ERROR:x11/iconcache.c:303:standard_pict_format_for_depth: code should not be reached

[Dan Kegel]

I have a fleet of Dell T7500's, a few Dell 3620's, a Skull Canyon, and a Hades Canyon, and a few other odds and ends, running a mix of ubuntu 16.04 and 17.10.

On one of the T7500 ubuntu 17.10 boxes (nvidia 340 package, Quadro K5000 card),
I did sudo "do-release-upgrade -d". Went fine, but on reboot, the desktop would
come up for about ten seconds, then the system would shut down.

Did
  systemctl set-default multi-user.target
then removed all traces of the proprietary driver with
  sudo apt remove --purge nvidia-340 nvidia-opencl-icd-340 nvidia-settings nvidia-384 nvidia-opencl-icd-384 nvidia-prime libcuda1-340
and rebooted. Logging in to the console and running 'startx' reproduces the problem reliably, and does not shut down the system.

Installing lwm, and a .xinitrc that started an xterm, let startx succeed, and
the system was stable running firefox, so it's not an obvious graphics problem.

/var/log/syslog says

Apr 25 09:59:41 rbb-ubu1710-3 org.gnome.Shell.desktop[3936]: **
Apr 25 09:59:41 rbb-ubu1710-3 org.gnome.Shell.desktop[3936]: mutter:ERROR:x11/iconcache.c:303:standard_pict_format_for_depth: code should not be reached
Apr 25 09:59:41 rbb-ubu1710-3 org.gnome.Shell.desktop[3936]: == Stack trace for context 0x556d30f3c4c0 ==
Apr 25 09:59:41 rbb-ubu1710-3 dbus-daemon[690]: [system] Successfully activated service 'org.freedesktop.fwupd'
Apr 25 09:59:41 rbb-ubu1710-3 systemd[1]: Started Firmware update daemon.
Apr 25 09:59:42 rbb-ubu1710-3 PackageKit: get-updates transaction /2379_acbceaca from uid 1000 finished with success after 1175ms
Apr 25 09:59:42 rbb-ubu1710-3 gnome-session[3605]: gnome-session-binary[3605]: WARNING: Application 'org.gnome.Shell.desktop' killed by signal 6
Apr 25 09:59:42 rbb-ubu1710-3 gnome-session[3605]: gnome-session-binary[3605]: WARNING: App 'org.gnome.Shell.desktop' respawning too quickly
Apr 25 09:59:42 rbb-ubu1710-3 gnome-session[3605]: gnome-session-binary[3605]: CRITICAL: We failed, but the fail whale is dead. Sorry....
Apr 25 09:59:42 rbb-ubu1710-3 gnome-session-binary[3605]: Unrecoverable failure in required component org.gnome.Shell.desktop
Apr 25 09:59:42 rbb-ubu1710-3 gnome-session-binary[3605]: WARNING: Application 'org.gnome.Shell.desktop' killed by signal 6
Apr 25 09:59:42 rbb-ubu1710-3 gnome-session-binary[3605]: WARNING: App 'org.gnome.Shell.desktop' respawning too quickly
Apr 25 09:59:42 rbb-ubu1710-3 gnome-session-binary[3605]: CRITICAL: We failed, but the fail whale is dead. Sorry....

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: gnome-shell 3.28.1-0ubuntu2
ProcVersionSignature: Ubuntu 4.15.0-20.21-generic 4.15.17
Uname: Linux 4.15.0-20-generic x86_64
ApportVersion: 2.20.9-0ubuntu7
Architecture: amd64
Date: Wed Apr 25 10:06:55 2018
DisplayManager:

GsettingsChanges: b'org.gnome.desktop.interface' b'gtk-im-module' b"'gtk-im-context-simple'"
InstallationDate: Installed on 2018-01-04 (111 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Alpha amd64 (20170918)
SourcePackage: gnome-shell
UpgradeStatus: Upgraded to bionic on 2018-04-24 (0 days ago)

[Ian (ian-redhat-bugs)]

1. Install xterm

 2. Write a file at /etc/X11/xorg.conf.d/20-bit16.conf containing:

Section "Screen"
    Identifier "Screen0"
    DefaultDepth 16
EndSection

 3. Log in with GNOME desktop

 4. Go to Activities, type 'xt' and see the xterm icon appear

 5. Click on the xterm icon

 6. Boom

This was originally encountered by installing tigervnc-server-module
which comes with a config file specifying DefaultDepth 16 but clearly
the vnc server itself is not required.

gnome-shell outputs the following message before crashing:

mutter:ERROR:x11/iconcache.c:301:standard_pict_format_for_depth: code should not be reached

Analysis of this function shows that it doesn't believe that 16-bit
pixmaps exist.

[Fedora (fedora-redhat-bugs)]

Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

[Ian (ian-redhat-bugs)]

Still crashes on Fedora 24 with the same error message and traceback.

$ rpm -q mutter
mutter-3.20.3-1.fc24.x86_64

[Fedora (fedora-redhat-bugs)]

This message is a reminder that Fedora 24 is nearing its end of life.
Approximately 2 (two) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 24. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora 'version'
of '24'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 24 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

[Ian (ian-redhat-bugs)]

Still crashes

mutter-3.24.4-1.fc26.x86_64

[Dan Kegel (dank)]

apport-retrace -g _usr_bin_gnome-shell.1000.crash

bt

indicates it's an assert in standard_pict_format_for_depth:

(gdb) bt
#0 0x00007f75c68f0727 in raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x000056149221ba6b in dump_gjs_stack_on_signal_handler (signo=6) at ../src/main.c:367
#2 0x00007f75c68f0890 in <signal handler called> () at /lib/x86_64-linux-gnu/libpthread.so.0
#3 0x00007f75c652be97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#4 0x00007f75c652d801 in __GI_abort () at abort.c:79
#5 0x00007f75c868dfa5 in g_assertion_message () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#6 0x00007f75c868e00a in g_assertion_message_expr () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#7 0x00007f75c6bb5fbe in standard_pict_format_for_depth (depth=<optimized out>) at x11/iconcache.c:303
#8 0x00007f75c6bb5fbe in pict_format_for_depth (depth=<optimized out>, xdisplay=0x56149472f000) at x11/iconcache.c:310
#9 0x00007f75c6bb5fbe in surface_from_pixmap (xdisplay=xdisplay@entry=0x56149472f000, xpixmap=xpixmap@entry=31457330, height=<optimized out>, width=<optimized out>)
    at x11/iconcache.c:325
#10 0x00007f75c6bb6117 in try_pixmap_and_mask (display=0x5614949c0200, src_pixmap=src_pixmap@entry=31457330, src_mask=src_mask@entry=31457332, iconp=iconp@entry=0x7fff9d183198) at x11/iconcache.c:345
#11 0x00007f75c6bb65a4 in meta_read_icons (screen=0x56149454bcd0, xwindow=31457316, icon_cache=0x561495d18df8, wm_hints_pixmap=31457330, wm_hints_mask=31457332, iconp=iconp@entry=0x7fff9d183198, ideal_width=96, ideal_height=96, mini_iconp=0x7fff9d1831a0, ideal_mini_width=16, ideal_mini_height=16) at x11/iconcache.c:546
#12 0x00007f75c6bbd3c1 in meta_window_x11_update_icon (window=0x561495d18e30, icon=0x7fff9d183198, mini_icon=0x7fff9d1831a0) at x11/window-x11.c:1472
#13 0x00007f75c6ba2608 in meta_window_update_icon_now (window=window@entry=0x561495d18e30, force=force@entry=1) at core/window.c:5326
#14 0x00007f75c6ba9abd in _meta_window_shared_new (display=display@entry=0x5614949c0200, screen=screen@entry=0x56149454bcd0, client_type=client_type@entry=META_WINDOW_CLIENT_TYPE_X11, surface=surface@entry=0x0, xwindow=xwindow@entry=31457316, existing_wm_state=existing_wm_state@entry=0, effect=<optimized out>, attrs=<optimized out>)
    at core/window.c:1148
#15 0x00007f75c6bbf6a0 in meta_window_x11_new (display=display@entry=0x5614949c0200, xwindow=31457316, must_be_viewable=must_be_viewable@entry=0, effect=effect@entry=META_COMP_EFFECT_CREATE) at x11/window-x11.c:3148
#16 0x00007f75c6bb4554 in handle_other_xevent (display=display@entry=0x5614949c0200, event=event@entry=0x7fff9d183640) at x11/events.c:1372
#17 0x00007f75c6bb4deb in meta_display_handle_xevent (event=0x7fff9d183640, display=0x5614949c0200) at x11/events.c:1791
#18 0x00007f75c6bb4deb in xevent_filter (xevent=0x7fff9d183640, event=<optimized out>, data=0x5614949c0200) at x11/events.c:1830
#19 0x00007f75c5e07edf in () at /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
#20 0x00007f75c5e081c9 in () at /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
#21 0x00007f75c5dd2d70 in gdk_display_get_event () at /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
#22 0x00007f75c5e07f72...

[Dan Kegel (dank)]

Ah, that assert is in mutter.

$ mkdir ~/xsrc
$ cd ~/xsrc
$ apt-get source libmutter-2-0
$ cd ~
$ apport-retrace -g _usr_bin_gnome-shell.1000.crash
(gdb) bt
...
(gdb) frame 7
#7 0x00007f75c6bb5fbe in standard_pict_format_for_depth (depth=<optimized out>) at x11/iconcache.c:303
303 x11/iconcache.c: No such file or directory.
(gdb) directory xsrc/mutter-3.28.1/src
(gdb) list 291
291 static int
292 standard_pict_format_for_depth (int depth)
293 {
294 switch (depth)
295 {
296 case 1:
297 return PictStandardA1;
298 case 24:
299 return PictStandardRGB24;
300 case 32:
301 return PictStandardARGB32;
302 default:
303 g_assert_not_reached ();
304 }

FWIW, that code was added in https://gitlab.gnome.org/GNOME/mutter/commit/9b903e93e3cd0601b436c55b7cea1fbecf29895f

So... uh... maybe some icon on my system is making it unhappy?

I gather gtk-update-icon-cache is involved?

buildbot@rbb-ubu1804-3:~$ ls -l /usr/share/icons/*/*.cache
-rw-r--r-- 1 root root 35776 Apr 24 14:57 /usr/share/icons/Adwaita/icon-theme.cache
-rw-r--r-- 1 root root 20312 Apr 25 09:40 /usr/share/icons/hicolor/icon-theme.cache
-rw-r--r-- 1 root root 49808 Apr 24 14:39 /usr/share/icons/HighContrast/icon-theme.cache
-rw-r--r-- 1 root root 26816 Apr 24 14:57 /usr/share/icons/Humanity-Dark/icon-theme.cache
-rw-r--r-- 1 root root 327184 Apr 24 14:57 /usr/share/icons/Humanity/icon-theme.cache
-rw-r--r-- 1 root root 628 Apr 24 14:57 /usr/share/icons/LoginIcons/icon-theme.cache
-rw-r--r-- 1 root root 54104 Apr 24 14:57 /usr/share/icons/ubuntu-mono-dark/icon-theme.cache
-rw-r--r-- 1 root root 55040 Apr 24 14:57 /usr/share/icons/ubuntu-mono-light/icon-theme.cache

But now I can't get it to crash anymore.
so maybe I accidentally fixed it by installing some package that updated the icon caches...?

$ grep hicolor /var/log/dpkg.log
...
2018-04-24 14:42:29 status installed hicolor-icon-theme:all 0.17-2
...
2018-04-24 15:33:00 status installed hicolor-icon-theme:all 0.17-2
...
2018-04-25 09:40:43 status installed hicolor-icon-theme:all 0.17-2

Hrmf. My uneducated theory is that an icon cache was corrupt, but is fine now.
Who knows?

[Dan Kegel (dank)]

Doesn't sound like a release blocker offhand, but sheesh. Boot loops are no fun.

[Daniel van Vugt (vanvugt)]

Hi Dan,

I can't seem to find any other reports of that crash. But to ensure it's been retraced accurately and correctly classified, please use this command to upload the crash file:

  ubuntu-bug /var/crash/YOURFILE.crash

And then mention here the ID of the new bug created.

[Dan Kegel (dank)]

Sure, sorry for uploading it wrong in the first place.
The new bug is ... uh... it didn't create one, it just went into the ether, in a cloud of dots.

[Daniel van Vugt (vanvugt)]

If you're coming from a 17.10 or older system then you will need to apply the workaround from bug 994921 first.

[Dan Kegel (dank)]

Too late! The world has moved on, and I can no longer upload this bug:

You have some obsolete package versions installed. Please upgrade the following packages and check if the problem still occurs:

libdb5.3, libplist3, libssl1.1, openssl

I guess if it happens on another machine, I'll upload it properly and add a link here.

I still have the .crash file if you want it.

[Daniel van Vugt (vanvugt)]

That's annoying. We should be able to retrace any crash from any package versions. Seems like we've made reporting crashes more difficult than it should be.

[Daniel van Vugt (vanvugt)]

I would be curious to see the value of 'depth' in:
standard_pict_format_for_depth (int depth)

Maybe it's a valid but unusual value. Or maybe it's junk, so your theory about memory corruption sounds plausible...

[Dan Kegel (dank)]

optimized out, alas. But:

(gdb) frame 9
#9 surface_from_pixmap (xdisplay=xdisplay@entry=0x56149472f000,
    xpixmap=xpixmap@entry=31457330, height=<optimized out>,
    width=<optimized out>) at x11/iconcache.c:325
325 return cairo_xlib_surface_create_with_xrender_format (xdisplay, xpixmap, DefaultScreenOfDisplay (xdisplay),
(gdb) list
320
321 if (!XGetGeometry (xdisplay, xpixmap, &root_return,
322 &x_ret, &y_ret, &w_ret, &h_ret, &bw_ret, &depth_ret))
323 return NULL;
324
325 return cairo_xlib_surface_create_with_xrender_format (xdisplay, xpixmap, DefaultScreenOfDisplay (xdisplay),
326 pict_format_for_depth (xdisplay, depth_ret), w_ret, h_ret);
327 }
328
329 static gboolean
(gdb) print depth_ret
$2 = 16

So, not corrupt, just not handled?

FWIW, see also https://bugzilla.redhat.com/show_bug.cgi?id=1239129

I'm having a little trouble believing my screen was using 16 bit mode, could one of the cached icons have been 16 bits?

[Daniel van Vugt (vanvugt)]

Yes it's possible one of your icons uses 16-bit colour, and explains why we don't see other/many reports of this crash.

In theory we should hit this problem more often, given that we have:
  /usr/share/icons/hicolor/
and "high color" means 16-bit (or 15-bit). But apparently most icons in there are "true colour" instead.

[Fedora (fedora-redhat-bugs)]

This message is a reminder that Fedora 26 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 26. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora 'version'
of '26'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 26 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

[Fedora (fedora-redhat-bugs)]

Fedora 26 changed to end-of-life (EOL) status on 2018-05-29. Fedora 26
is no longer maintained, which means that it will not receive any
further security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

[Daniel van Vugt (vanvugt)]

I can't find any other reports of this crash. Is it still happening?

[Dan Kegel (dank)]

I no longer have access to the system in question, and haven't seen it anywhere else, may as well close as abandoned.

[Nicholas Andre (nicholas-man)]

I'm seeing this crash on a brand new Ubuntu 18.04 install running on KVM (the host itself is on 16.04). When I connect via KVM's VNC and try to open settings app, I get a 100% crash. It's weird because I haven't installed any additional software.

Mar 18 22:42:11 riv18 org.gnome.Shell.desktop[2561]: **
Mar 18 22:42:11 riv18 org.gnome.Shell.desktop[2561]: mutter:ERROR:x11/iconcache.c:303:standard_pict_format_for_depth: code should not be reached
Mar 18 22:42:11 riv18 org.gnome.Shell.desktop[2561]: == Stack trace for context 0x55663fe03320 ==
Mar 18 22:42:11 riv18 gnome-session[2482]: gnome-session-binary[2482]: WARNING: Application 'org.gnome.Shell.desktop' killed by signal 6
Mar 18 22:42:11 riv18 gnome-session-binary[2482]: WARNING: Application 'org.gnome.Shell.desktop' killed by signal 6
Mar 18 22:42:12 riv18 gsd-media-keys[2649]: g_variant_get_va: assertion 'value != NULL' failed
Mar 18 22:42:12 riv18 gsd-media-keys[2649]: g_variant_unref: assertion 'value != NULL' failed
Mar 18 22:42:12 riv18 org.gnome.Shell.desktop[2942]: current session already has an ibus-daemon.
Mar 18 22:42:12 riv18 dbus-daemon[445]: [system] Activating via systemd: service name='org.freedesktop.GeoClue2' unit='geoclue.service' requested by ':1.178' (uid=1000 pid=2942 comm="/usr/bin/gnome-shell " label="unconfined")
Mar 18 22:42:12 riv18 systemd[1]: Starting Location Lookup Service...
Mar 18 22:42:13 riv18 dbus-daemon[445]: [system] Successfully activated service 'org.freedesktop.GeoClue2'
Mar 18 22:42:13 riv18 systemd[1]: Started Location Lookup Service.
Mar 18 22:42:13 riv18 gnome-shell[2942]: Telepathy is not available, chat integration will be disabled.
Mar 18 22:42:13 riv18 gsd-media-keys[2649]: g_variant_get_va: assertion 'value != NULL' failed
Mar 18 22:42:13 riv18 gsd-media-keys[2649]: g_variant_unref: assertion 'value != NULL' failed
Mar 18 22:42:13 riv18 gnome-shell[2942]: JS WARNING: [/<email address hidden>/appIcons.js 1028]: unreachable code after return statement
Mar 18 22:42:13 riv18 org.gnome.Shell.desktop[2942]: **
Mar 18 22:42:13 riv18 org.gnome.Shell.desktop[2942]: mutter:ERROR:x11/iconcache.c:303:standard_pict_format_for_depth: code should not be reached

[Nicholas Andre (nicholas-man)]

I've attached the full logs I see. Can anyone tell me where to look for more details?

[Nicholas Andre (nicholas-man)]

I get this error which the internet suggests means a problem getting a core dump. Upping the limits didn't in apport didn't seem to help. I attached the file in /var/crash

$ ubuntu-bug /var/crash/_usr_bin_gnome-shell.1000.crash

*** Error: Problem in gnome-shell

Sorry, the program "gnome-shell" closed unexpectedly

Your computer does not have enough free memory to automatically analyze the problem and send a report to the developers.

Press any key to continue...

[Daniel van Vugt (vanvugt)]

It appears the crashing function was removed in mutter 3.34 onward. That means this is "fixed" for Ubuntu 20.04 and later.

[Nicholas Andre (nicholas-man)]

For any poor saps that encounter this in the future in a similar situation, replacing the graphics driver with 'virtio' in the KVM/qemu config fixes this:

<video>
      <model type='virtio' vram='16384' heads='1'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
    </video>

Instead of the default 'cirrus' or whatever. Found this in my age-old notes from the last time I encountered this problem a year ago. I'm not sure whether this triggered a cache clear or whether the bit depth is different or what...

[Daniel van Vugt (vanvugt)]

Yeah it's just a missing/unsupported bit depth in old versions of mutter:

static int
standard_pict_format_for_depth (int depth)
{
  switch (depth)
    {
    case 1:
      return PictStandardA1;
    case 24:
      return PictStandardRGB24;
    case 32:
      return PictStandardARGB32;
    default:
      g_assert_not_reached ();
    }
}