Bug#1102513: gnome-shell: crash on desktop lock (super + L)

Wed Apr 9 21:15:41 BST 2025

Package: gnome-shell
Version: 48.0-1

Dear Maintainer(s),

Starting today, gnome-shell has started crashing with a segfault when
I lock the desktop with super + L. I can reproduce consistently.
Decoded backtrace:

Core was generated by `/usr/bin/gnome-shell'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f838b901456 in gst_device_provider_device_remove
(provider=0x56221e0e98d0, device=0x7f8378029c00) at
../gst/gstdeviceprovider.c:673

warning: 673 ../gst/gstdeviceprovider.c: No such file or directory
[Current thread is 1 (Thread 0x7f8447814e40 (LWP 31367))]
(gdb) bt
#0  0x00007f838b901456 in gst_device_provider_device_remove
(provider=0x56221e0e98d0, device=0x7f8378029c00) at
../gst/gstdeviceprovider.c:673
#1  0x00007f838fe3033a in destroy_node (data=0x7f837801ca38) at
../src/gst/gstpipewiredeviceprovider.c:487
#2  0x00007f844bb21078 in pw_proxy_destroy (proxy=0x7f837801c9c0) at
../src/pipewire/proxy.c:233
#3  0x00007f844bb212a8 in pw_proxy_remove (proxy=0x7f837801c9c0) at
../src/pipewire/proxy.c:257
#4  0x00007f844bac1f99 in remove_proxy (object=<optimized out>,
data=0x56221df2b9f0) at ../src/pipewire/core.c:185
#5  pw_map_for_each (map=0x56221df2baf0, func=<optimized out>,
data=0x56221df2b9f0) at ../src/pipewire/map.h:222
#6  proxy_core_removed (data=0x56221df2b9f0) at ../src/pipewire/core.c:224
#7  proxy_core_removed (data=0x56221df2b9f0) at ../src/pipewire/core.c:205
#8  0x00007f844bb212a8 in pw_proxy_remove (proxy=0x56221df2b9f0) at
../src/pipewire/proxy.c:257
#9  0x00007f844bac3468 in pw_core_disconnect (core=0x56221df2b9f0) at
../src/pipewire/core.c:515
#10 0x00007f838fe0dc38 in gst_pipewire_core_release
(core=0x56221e31d450) at ../src/gst/gstpipewirecore.c:192
#11 0x00007f838b900f9e in gst_device_provider_stop
(provider=0x56221e0e98d0) at ../gst/gstdeviceprovider.c:535
#12 0x00007f838b91383b in gst_device_monitor_stop
(monitor=0x56221e1bd2f0) at ../gst/gstdevicemonitor.c:585
#13 0x00007f844b67560e in ffi_call_unix64 () at ../src/x86/unix64.S:104
#14 0x00007f844b674980 in ffi_call_int (cif=cif at entry=0x56221bc17010,
fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>,
closure=closure at entry=0x0) at ../src/x86/ffi64.c:676
#15 0x00007f844b6750eb in ffi_call (cif=0x56221bc17010, fn=<optimized
out>, rvalue=<optimized out>, avalue=<optimized out>) at
../src/x86/ffi64.c:713
#16 0x00007f844c7a4dfe in Gjs::Function::invoke (this=0x56221bc16ff0,
context=0x562219a0ccf0, args=<optimized out>, this_obj=...,
r_value=<optimized out>) at
./obj-x86_64-linux-gnu/../gi/function.cpp:1050
#17 0x00007f844c7a532e in Gjs::Function::call (context=0x562219a0ccf0,
js_argc=<optimized out>, vp=<optimized out>) at
./obj-x86_64-linux-gnu/../gi/function.cpp:1232
#18 0x00007f844938d52f in CallJSNative (cx=0x562219a0ccf0,
native=0x7f844c7a5260 <Gjs::Function::call(JSContext*, unsigned int,
JS::Value*)>, reason=js::CallReason::Call, args=...) at
./js/src/vm/Interpreter.cpp:481
#19 js::InternalCallOrConstruct (cx=0x562219a0ccf0, args=...,
construct=<optimized out>, reason=js::CallReason::Call) at
./js/src/vm/Interpreter.cpp:561
#20 0x00007f844937f1a0 in InternalCall (cx=<optimized out>,
args=<optimized out>, reason=<optimized out>) at
./js/src/vm/Interpreter.cpp:642
#21 js::CallFromStack (cx=<optimized out>, args=<optimized out>,
reason=<optimized out>) at ./js/src/vm/Interpreter.cpp:647
#22 js::Interpret (cx=0x562219a0ccf0, state=...) at
./js/src/vm/Interpreter.cpp:3190
#23 0x00007f844938d28b in MaybeEnterInterpreterTrampoline
(cx=0x562219a0ccf0, state=...) at ./js/src/vm/Interpreter.cpp:395
#24 js::RunScript (cx=cx at entry=0x562219a0ccf0, state=...) at
./js/src/vm/Interpreter.cpp:453
#25 0x00007f844938d7f0 in js::InternalCallOrConstruct
(cx=cx at entry=0x562219a0ccf0, args=...,
construct=construct at entry=js::NO_CONSTRUCT,
reason=js::CallReason::Call) at ./js/src/vm/Interpreter.cpp:607
#26 0x00007f844938da69 in InternalCall (cx=0x562219a0ccf0, args=...,
reason=<optimized out>) at ./js/src/vm/Interpreter.cpp:642
#27 js::Call (cx=cx at entry=0x562219a0ccf0, fval=..., fval at entry=...,
thisv=..., thisv at entry=..., args=..., rval=rval at entry=...,
reason=reason at entry=js::CallReason::Call) at
./js/src/vm/Interpreter.cpp:674
#28 0x00007f8449a6845f in js::jit::InvokeFunction (cx=0x562219a0ccf0,
obj=..., obj at entry=..., constructing=<optimized out>,
ignoresReturnValue=ignoresReturnValue at entry=false, argc=1,
argv=0x7fff29f19240, rval=...) at ./js/src/jit/VMFunctions.cpp:546
#29 0x00007f8449a6878b in js::jit::InvokeFromInterpreterStub
(cx=<optimized out>, frame=0x7fff29f19218) at
./js/src/jit/VMFunctions.cpp:570
#30 0x00002d24b8e4de95 in ??? ()
#31 0x00007fff29f192e0 in ??? ()
#32 0x00007fff29f19218 in ??? ()
#33 0x0000562219a0cd58 in ??? ()
#34 0x000000000000000a in ??? ()
#35 0x00007fff29f19260 in ??? ()
#36 0x00002d24b9c1bf6e in ??? ()
#37 0x0000000000000022 in ??? ()
#38 0x000008ac7ca1f3f8 in ??? ()
#39 0xfffe1ef6cf7424a0 in ??? ()
#40 0xfffb3dd8d24e78f8 in ??? ()
#41 0x0000000000000002 in ??? ()
#42 0x0000562219ade830 in ??? ()
#43 0x00007fff29f19310 in ??? ()
#44 0x00002d24b8e56de1 in ??? ()
#45 0x0000000000000001 in ??? ()
#46 0xfffb3dd8d24e78f8 in ??? ()
#47 0xfffe1ef6cf7424a0 in ??? ()
#48 0xfffe08ac7ca1f3f8 in ??? ()
#49 0xfffb3dd8d24e78f8 in ??? ()
#50 0xfffe1ef7174c0900 in ??? ()
#51 0xfffe212cf8567970 in ??? ()
#52 0xfff9800000000000 in ??? ()
#53 0xfffb3dd8d24e78f8 in ??? ()
#54 0xfffe08ac7ca98d40 in ??? ()
#55 0xfffe1ef7174c0cb8 in ??? ()
#56 0x00003dd8d24f0290 in ??? ()
#57 0x000056221b874274 in ??? ()
#58 0x000056221f221db0 in ??? ()
#59 0x00001ef7174c08c8 in ??? ()
#60 0x000056221f221b88 in ??? ()
#61 0x00007fff29f19890 in ??? ()
#62 0x00002d24b8e50bef in ??? ()
#63 0xfffe091000000006 in ??? ()
#64 0x00000000000000a4 in ??? ()
#65 0x00007fff29f193a0 in ??? ()
#66 0x00002d24b9c084cc in ??? ()
#67 0x0000000000000011 in ??? ()
#68 0x000008ac7ca1f7e8 in ??? ()
#69 0xfff9800000000000 in ??? ()
#70 0xfff8800000000000 in ??? ()
#71 0xfff9800000000000 in ??? ()
#72 0xfffe08ac7ca98d98 in ??? ()
#73 0xfffe08ac7ca98d98 in ??? ()
#74 0x000056221bc509f0 in ??? ()
#75 0x0000562219a0cd08 in ??? ()
#76 0x00007f844c81acce in gjs_log_exception_uncaught
(cx=0x2d24b8e4de60) at /usr/include/mozjs-128/js/RootingAPI.h:1228
#77 0x00002d24b8e4d4e6 in ??? ()
#78 0x0000000000000033 in ??? ()
#79 0x000008ac7ca2aa10 in ??? ()
#80 0xfffe08ac7ca98d98 in ??? ()
#81 0xfff9800000000000 in ??? ()
#82 0x00007fff29f19470 in ??? ()
#83 0x00007fff29f19480 in ??? ()
#84 0x00007fff29f19660 in ??? ()
#85 0x00007fff29f19890 in ??? ()
#86 0x00002d24b9c08360 in ??? ()
#87 0x0000562219a0ccf0 in ??? ()
#88 0x00007fff29f195c0 in ??? ()
#89 0x00007f8449bdec0a in EnterJit (cx=0x7f8400000000, state=...,
code=0x7fff29f19400 "\300\225\361)\377\177") at
./js/src/jit/Jit.cpp:115

The crash is at this line:

g_return_if_fail (GST_IS_DEVICE (device));

https://sources.debian.org/src/gstreamer1.0/1.26.0-3/gst/gstdeviceprovider.c/?hl=666#L673

device seems to be borked:

(gdb) p *device
$2 = {parent = {object = {g_type_instance = {g_class = <error reading
variable: Cannot access memory at address 0x732d6d756964656d>},
ref_count = 1868721529, qdata = 0x6f762d6f69647561}, lock = {p =
0x6d79732d656d756c, i = {1701672300, 1836675885}},
    name = 0x75612063696c6f62 <error: Cannot access memory at address
0x75612063696c6f62>, parent = 0x626d79732d6f6964, flags = 1667853423,
control_bindings = 0x6d756c6f762d6f69 = {<error reading variable:
Cannot access memory at address 0x6d756c6f762d6f69>,
  priv = 0x657a69732c6f6964, _gst_reserved = {0x6c6163732c36313d,
0x6c7974732c313d65, 0x6f6c6f632c303d65, 0x66626661663d7372}}

I can provide the core file if needed. The hardware is a laptop with
AMD CPU/GPU running Debian testing.