Bug#881301: gnome-shell: intermittent "invalid unclassed pointer in cast to 'ClutterText'" + segfault

[Lucas Dyer]

On Fri, 10 Nov 2017 at 14:03:23 +0000, Simon McVittie wrote:
> Are you using any GNOME Shell extensions? If so, which ones?

The following enabled gnome-shell-extensions and git tracked extensions:

Applications menu: gnome-shell-extensions (= 3.26.2-1)
Dash to dock: <https://github.com/micheleg/dash-to-dock.git> (#e564630)
Native window placement: gnome-shell-extensions (= 3.26.2-1)
Topicons plus: <https://github.com/phocean/TopIcons-plus.git> (#f265f17)
Volume mixer: <https://github.com/aleho/gnome-shell-volume-mixer.git> (#2bb8474)
System-monitor: <https://github.com/paradoxxxzero/gnome-shell-system-monitor-applet.git> (#61b0a60)

> Approximately how often does this crash occur?

Once or twice a day.

> We are very unlikely to be able to solve this without a backtrace. The bug
> appears to be that an invalid pointer is used where a ClutterText object
> is expected (most likely a use-after-free or a null pointer somewhere),
> but that isn't something that can be fixed without knowing where/how it
> happens.

Stack trace of thread 2528:
#0  0x00007fc5bbf35db2 in g_type_check_instance_cast (type_instance=0x55ad84d82970, iface_type=94203710922992) at ../../../../gobject/gtype.c:4057
#1  0x00007fc5b96d67d8 in st_label_set_text (label=0x55ad84d82300 [StLabel], text=0x55ad87c75800 "100") at ../src/st/st-label.c:331
#2  0x00007fc5bbf17a4e in object_set_property (nqueue=0x55ad854cd880, value=<optimized out>, pspec=0x55ad835365f0 [GParamString], object=0x55ad84d82300 [StLabel]) at ../../../../gobject/gobject.c:1439
#3  0x00007fc5bbf17a4e in g_object_setv (object=0x55ad84d82300 [StLabel], n_properties=<optimized out>, names=<optimized out>, values=<optimized out>) at ../../../../gobject/gobject.c:2245
#4  0x00007fc5bbf189de in g_object_set_property (object=<optimized out>, property_name=<optimized out>, value=value at entry=0x7ffdbb82b058) at ../../../../gobject/gobject.c:2529
#5  0x00007fc5bac044b7 in set_g_param_from_prop (priv=0x55ad84cb8030, result=..., value_p=..., was_set=<synthetic pointer>: <optimized out>, name=0x55ad82f75ae0 "text", context=0x55ad82f75ae0) at gi/object.cpp:446
#6  0x00007fc5bac044b7 in object_instance_set_prop(JSContext*, JS::HandleObject, JS::HandleId, JS::MutableHandleValue, JS::ObjectOpResult&) (context=context at entry=0x55ad82eb1000, obj=..., id=..., id at entry=..., value_p=value_p at entry=..., result=...) at gi/object.cpp:521
#7  0x00007fc5b1cb76c6 in js::CallJSSetterOp(JSContext*, bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>, JS::ObjectOpResult&), JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>, JS::ObjectOpResult&) (result=..., vp=..., id=..., obj=..., op=<optimized out>, cx=0x55ad82eb1000) at ./js/src/jscntxtinlines.h:323
#8  0x00007fc5b1cb76c6 in NativeSetExistingDataProperty(JSContext*, js::HandleNativeObject, js::HandleShape, JS::HandleValue, JS::ObjectOpResult&) (cx=cx at entry=0x55ad82eb1000, obj=..., obj at entry=..., shape=..., v=..., v at entry=..., result=..., receiver=...) at ./js/src/vm/NativeObject.cpp:2198
#9  0x00007fc5b1cccfeb in SetExistingProperty (result=..., shape=..., pobj=..., receiver=..., v=..., id=..., obj=..., cx=0x55ad82eb1000) at ./js/src/vm/NativeObject.cpp:2406
#10 0x00007fc5b1cccfeb in js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&) (cx=0x55ad82eb1000, obj=..., id=..., value=..., receiver=..., qualified=qualified at entry=js::Qualified, result=...) at ./js/src/vm/NativeObject.cpp:2469
#11 0x00007fc5b1cd9cbe in js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) (cx=<optimized out>, obj=..., id=..., v=..., receiver=..., result=...) at ./js/src/vm/NativeObject.h:1540
#12 0x00007fc5b1cbd8f1 in SetPropertyOperation (rval=..., id=..., lval=..., op=<optimized out>, cx=<optimized out>) at ./js/src/vm/Interpreter.cpp:259
#13 0x00007fc5b1cbd8f1 in Interpret(JSContext*, js::RunState&) (cx=0x55ad82eb1000, state=...) at ./js/src/vm/Interpreter.cpp:2715
#14 0x00007fc5b1cc8846 in js::RunScript(JSContext*, js::RunState&) (cx=cx at entry=0x55ad82eb1000, state=...) at ./js/src/vm/Interpreter.cpp:405
#15 0x00007fc5b1cc8e1f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=cx at entry=0x55ad82eb1000, args=..., construct=construct at entry=js::NO_CONSTRUCT) at ./js/src/vm/Interpreter.cpp:477
#16 0x00007fc5b1cc9099 in InternalCall(JSContext*, js::AnyInvokeArgs const&) (cx=cx at entry=0x55ad82eb1000, args=...) at ./js/src/vm/Interpreter.cpp:504
#17 0x00007fc5b1cc90f9 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) (cx=cx at entry=0x55ad82eb1000, fval=..., fval at entry=..., thisv=..., thisv at entry=..., args=..., rval=rval at entry=...) at ./js/src/vm/Interpreter.cpp:523
#18 0x00007fc5b1abb079 in js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject*>, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) (cx=0x55ad82eb1000, obj=..., constructing=<optimized out>, argc=<optimized out>, argv=0x7ffdbb82bc10, rval=...) at ./js/src/jit/VMFunctions.cpp:114
#19 0x00002d2f6b08d3c6 in  ()
#20 0x0000000000000000 in  ()

Regards,
LD