Crash in gjs_typecheck_boxed - needsPostBarrier

[clefebvre]

https://bugzilla.gnome.org/show_bug.cgi?id=783935

Thread 1 "cinnamon" received signal SIGSEGV, Segmentation fault.

Thread 12 (Thread 0x7f67c169f700 (LWP 9116)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007f67c8d436c0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#2  0x00007f67cec25eb1 in ?? () from /usr/lib/x86_64-linux-gnu/libjs.so.0
#3  0x00007f67c8d490a8 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#4  0x00007f67d70d46ba in start_thread (arg=0x7f67c169f700) at pthread_create.c:333
#5  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 11 (Thread 0x7f67c1720700 (LWP 9115)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007f67c8d436c0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#2  0x00007f67cec25eb1 in ?? () from /usr/lib/x86_64-linux-gnu/libjs.so.0
#3  0x00007f67c8d490a8 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#4  0x00007f67d70d46ba in start_thread (arg=0x7f67c1720700) at pthread_create.c:333
#5  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 10 (Thread 0x7f67c17a1700 (LWP 9114)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007f67c8d436c0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#2  0x00007f67cec25eb1 in ?? () from /usr/lib/x86_64-linux-gnu/libjs.so.0
#3  0x00007f67c8d490a8 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#4  0x00007f67d70d46ba in start_thread (arg=0x7f67c17a1700) at pthread_create.c:333
#5  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 9 (Thread 0x7f67c1822700 (LWP 9113)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007f67c8d436c0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#2  0x00007f67cec25eb1 in ?? () from /usr/lib/x86_64-linux-gnu/libjs.so.0
#3  0x00007f67c8d490a8 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#4  0x00007f67d70d46ba in start_thread (arg=0x7f67c1822700) at pthread_create.c:333
#5  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 8 (Thread 0x7f67c18a3700 (LWP 9112)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007f67c8d436c0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#2  0x00007f67cec25eb1 in ?? () from /usr/lib/x86_64-linux-gnu/libjs.so.0
#3  0x00007f67c8d490a8 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#4  0x00007f67d70d46ba in start_thread (arg=0x7f67c18a3700) at pthread_create.c:333
#5  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 7 (Thread 0x7f67c1924700 (LWP 9111)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007f67c8d436c0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#2  0x00007f67cec25eb1 in ?? () from /usr/lib/x86_64-linux-gnu/libjs.so.0
#3  0x00007f67c8d490a8 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#4  0x00007f67d70d46ba in start_thread (arg=0x7f67c1924700) at pthread_create.c:333
#5  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 6 (Thread 0x7f67c19a5700 (LWP 9110)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007f67c8d436c0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#2  0x00007f67cec25eb1 in ?? () from /usr/lib/x86_64-linux-gnu/libjs.so.0
#3  0x00007f67c8d490a8 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#4  0x00007f67d70d46ba in start_thread (arg=0x7f67c19a5700) at pthread_create.c:333
#5  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 5 (Thread 0x7f67c1a26700 (LWP 9109)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007f67c8d436c0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#2  0x00007f67cec25eb1 in ?? () from /usr/lib/x86_64-linux-gnu/libjs.so.0
#3  0x00007f67c8d490a8 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#4  0x00007f67d70d46ba in start_thread (arg=0x7f67c1a26700) at pthread_create.c:333
#5  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 4 (Thread 0x7f67c2227700 (LWP 9108)):
#0  0x00007f67d6dfe70d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007f67d733438c in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f67d733449c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f67c222f28d in ?? () from /usr/lib/x86_64-linux-gnu/gio/modules/libdconfsettings.so
#4  0x00007f67d735abb5 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007f67d70d46ba in start_thread (arg=0x7f67c2227700) at pthread_create.c:333
#6  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 3 (Thread 0x7f67c3ff9700 (LWP 9107)):
#0  0x00007f67d6dfe70d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007f67d733438c in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f67d7334712 in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f67d79329d6 in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#4  0x00007f67d735abb5 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007f67d70d46ba in start_thread (arg=0x7f67c3ff9700) at pthread_create.c:333
#6  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 2 (Thread 0x7f67c47fa700 (LWP 9106)):
#0  0x00007f67d6dfe70d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007f67d733438c in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f67d733449c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f67d73344d9 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007f67d735abb5 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007f67d70d46ba in start_thread (arg=0x7f67c47fa700) at pthread_create.c:333
#6  0x00007f67d6e0a3dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 1 (Thread 0x7f67d8d2eac0 (LWP 9105)):
#0  js::GCMethods<JSObject*>::needsPostBarrier (v=0x7f6784e42780) at /usr/include/mozjs-38/js/RootingAPI.h:663
#1  JS::Heap<JSObject*>::set (newPtr=0x0, this=0x56001d3a7848) at /usr/include/mozjs-38/js/RootingAPI.h:296
#2  JS::Heap<JSObject*>::operator= (p=<optimised out>, this=0x56001d3a7848) at /usr/include/mozjs-38/js/RootingAPI.h:266
#3  GjsMaybeOwned<JSObject*>::reset (this=0x56001d3a7838) at ./cjs/jsapi-util-root.h:267
#4  closure_clear_idle (data=0x56001d3a7810) at gi/closure.cpp:131
#5  0x00007f67d733404a in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#6  0x00007f67d73343f0 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#7  0x00007f67d7334712 in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#8  0x00007f67d8718988 in meta_run () from /usr/lib/x86_64-linux-gnu/libmuffin.so.0
#9  0x000056001ca31992 in ?? ()
#10 0x00007f67d6d23830 in __libc_start_main (main=0x56001ca31540, argc=2, argv=0x7fffd8dfef78, init=<optimised out>, fini=<optimised out>, rtld_fini=<optimised out>, stack_end=0x7fffd8dfef68) at ../csu/libc-start.c:291
#11 0x000056001ca31a89 in ?? ()

[clefebvre]

Bug report: https://bugzilla.gnome.org/show_bug.cgi?id=783935
Helps but doesn't completely solve the issue.
Commits:

• 4a28170 in CJS 3.4.3
• 0753ba7 in CJS 3.4.4

Bug report: https://bugzilla.gnome.org/show_bug.cgi?id=785657
Three commits, one doesn't apply to CJS and the other two are covered by PR #55

• closure: Remove pointer to runtime (1.67 KB, patch) 2017-08-23 18:20 UTC
• Revert freeing closures in idle handler (7.41 KB, patch) 2017-08-23 18:20 UTC
• closure: Prevent collection of invalidated closure (1.02 KB, patch) 2017-08-23 18:21 UTC

Bug report: https://bugzilla.gnome.org/show_bug.cgi?id=786668
Tackles the same issue as bug 785657, but with whereas 785657 provides a simple solution for GJS 1.48 (GNOME 3.24), the commits in bug 786668 provide a more in-depth refactor for GJS 1.50 (GNOME 3.26), possibly more effective but also more risky.

• arg: Fix memory leaks (3.53 KB, patch) 2017-08-23 06:17 UTC
• object: Remove unused argument (1.82 KB, patch) 2017-08-23 06:17 UTC
• Revert freeing closures in idle handler (7.37 KB, patch) 2017-08-23 06:18 UTC
• closure: Debug message on invalidate signal (885 bytes, patch) 2017-08-23 06:18 UTC
• object: Refactor out ConnectData (3.78 KB, patch) 2017-08-23 06:18 UTC
• closure: Prevent collection of invalidated closure (2.97 KB, patch) 2017-08-23 06:18 UTC

[clefebvre]

Closing this for now since we moved to mozjs52.