gnome-shell segfaults when external monitor attached or detached

[Russell Neches]

I recently updated to Ubuntu 18.10, and I seem to have hit a new bug with gnome-shell/wayland.

When an external monitor is attached or detached, gnome-shell crashes with a segmentation fault and falls back to a gdm session. This appears in dmesg :

[97490.001835] gnome-shell[9151]: segfault at fffffffffffffbc8 ip 00007fdd607f7ea8 sp 00007ffd8cf7b270 error 5 in libst-1.0.so[7fdd607d1000+2b000]
[97490.001841] Code: 00 00 48 8d 3d 77 78 00 00 e9 54 9c fd ff 0f 1f 40 00 41 57 41 56 41 55 41 54 55 53 48 83 ec 28 48 63 1d fb 74 01 00 48 01 fb <48> 8b 6b 08 48 85 ed 74 17 48 83 c4 28 48 89 e8 5b 5d 41 5c 41 5d

I've also attached the syslog file, starting from where the monitor was plugged in. Here are some of the highlights. First, the monitor is attached, and gnome-shell reaches for St.Bin and finds it already deallocated :

Oct 24 12:37:00 evenedric kernel: [97488.486851] [drm] Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.
Oct 24 12:37:01 evenedric gnome-shell[9151]: Object St.Bin (0x5619b14d30e0), has been already deallocated — impossible to set any property on it. This might be caused by the object having been destroyed from C code using something such as destroy(), dispose(), or remove() vfuncs.
Oct 24 12:37:01 evenedric gnome-shell[9151]: Object St.Bin (0x5619b14d30e0), has been already deallocated — impossible to set any property on it. This might be caused by the object having been destroyed from C code using something such as destroy(), dispose(), or remove() vfuncs.
Oct 24 12:37:01 evenedric org.gnome.Shell.desktop[9151]: == Stack trace for context 0x5619aee531c0 ==
Oct 24 12:37:01 evenedric org.gnome.Shell.desktop[9151]: #0 5619b71b1ff0 i resource:///org/gnome/shell/ui/userWidget.js:56 (7fdd27a55a60 @ 155)
Oct 24 12:37:01 evenedric org.gnome.Shell.desktop[9151]: #1 7ffd8cf7d990 b resource:///org/gnome/gjs/modules/_legacy.js:82 (7fdd27cb0b80 @ 71)
Oct 24 12:37:01 evenedric org.gnome.Shell.desktop[9151]: #2 7ffd8cf7e5c0 b self-hosted:979 (7fdd27cf01f0 @ 440)

This repeats several times with a few variations as the js interpreter in gnome-shell falls apart. Then the gnome-shell process is killed :

Oct 24 12:37:01 evenedric kernel: [97490.001835] gnome-shell[9151]: segfault at fffffffffffffbc8 ip 00007fdd607f7ea8 sp 00007ffd8cf7b270 error 5 in libst-1.0.so[7fdd607d1000+2b000]
Oct 24 12:37:01 evenedric kernel: [97490.001841] Code: 00 00 48 8d 3d 77 78 00 00 e9 54 9c fd ff 0f 1f 40 00 41 57 41 56 41 55 41 54 55 53 48 83 ec 28 48 63 1d fb 74 01 00 48 01 fb <48> 8b 6b 08 48 85 ed 74 17 48 83 c4 28 48 89 e8 5b 5d 41 5c 41 5d

This is then followed by the teardown for the whole session, eventually culminating in bringing up a new gdm login session. If you read through the attached syslog file, you can see the whole mess unfold. At about 12:37:05, I plug in an external mouse. Then colord makes a ton of noise for some reason, possibly related to the external monitor. Then I fire up my Bluetooth keyboard and log into a new session.

This appears to be a regression. I've used this exact configuration (gdm3 and gnome-shell running in Wayland, with an external monitor that I use while I'm at work) for several Ubuntu, Gnome and Wayland releases. This appears to be a new issue.

[Russell Neches (ubuntu-vort)]

Oops. Browser gremlins autofilled the wrong package name while I was filing the bug.

[Daniel van Vugt (vanvugt)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. It sounds like some part of the system has crashed. To help us find the cause of the crash please follow these steps:

1. Look in /var/crash for crash files and if found run:
    ubuntu-bug YOURFILE.crash
Then tell us the ID of the newly-created bug.

2. If step 1 failed then look at https://errors.ubuntu.com/user/ID where ID is the content of file /var/lib/whoopsie/whoopsie-id on the machine. Do you find any links to recent problems on that page? If so then please send the links to us.

3. If step 2 also failed then apply the workaround from bug 994921, reboot, reproduce the crash, and retry step 1.

Please take care to avoid attaching .crash files to bugs as we are unable to process them as file attachments. It would also be a security risk for yourself.

[Russell Neches (ubuntu-vort)]

Following step 3, I was able to file a crash report as bug 1800027.

[Launchpad Janitor (janitor)]

[Expired for gnome-shell (Ubuntu) because there has been no activity for 60 days.]