Crash on every logout in `_cogl_texture_2d_gl_free`
Affected version
- Fedora 35
- Gnome 41.rc
- AMD Ryzen 5850u
- Wayland (Xorg crashes as well but has a different trace)
Bug summary
Mutter crashes on every logout. The backtrace looks different from all other logout traces already reported.
Relevant logs, screenshots, screencasts etc.
(gdb) bt full
#0 release_expired_buffers_locked (current_time=17654467693, cache=0x55647c086f60) at ../src/gallium/auxiliary/pipebuffer/pb_cache.c:64
curr = 0x1611
next = <optimized out>
entry = <optimized out>
#1 pb_cache_add_buffer (entry=0x556478975178) at ../src/gallium/auxiliary/pipebuffer/pb_cache.c:96
mgr = 0x5564776ced78
cache = 0x55647c086f60
buf = 0x556478975110
i = 0
current_time = 17654467693
#2 0x00007f1cbd3ac246 in pb_destroy (buf=<optimized out>, winsys=<optimized out>) at ../src/gallium/auxiliary/pipebuffer/pb_buffer.h:259
No locals.
#3 pb_reference_with_winsys (src=<optimized out>, dst=<optimized out>, winsys=<optimized out>) at ../src/gallium/auxiliary/pipebuffer/pb_buffer.h:282
old = 0x44f6
old = <optimized out>
#4 radeon_bo_reference (src=<optimized out>, dst=<optimized out>, rws=<optimized out>) at ../src/gallium/drivers/radeon/radeon_winsys.h:754
No locals.
#5 si_resource_destroy (buf=0x55647925e8b0, screen=0x55647779fe20) at ../src/gallium/drivers/radeonsi/si_buffer.c:235
tex = <optimized out>
sscreen = <optimized out>
buffer = <optimized out>
#6 si_resource_destroy (screen=0x55647779fe20, buf=0x55647925e8b0) at ../src/gallium/drivers/radeonsi/si_buffer.c:221
tex = <optimized out>
tex = <optimized out>
resource = <optimized out>
#7 0x00007f1cbcbe48dc in pipe_resource_destroy (res=<optimized out>) at ../src/gallium/auxiliary/util/u_inlines.h:145
next = 0x0
#8 pipe_resource_reference (src=0x0, dst=0x55647de0e1e0) at ../src/gallium/auxiliary/util/u_inlines.h:162
old_dst = <optimized out>
old_dst = <optimized out>
#9 st_FreeTextureImageBuffer (ctx=<optimized out>, texImage=0x55647de0e190) at ../src/mesa/state_tracker/st_cb_texture.c:227
st = 0x5564778eaec0
stObj = 0x55647df465f0
stImage = <optimized out>
__func__ = {<optimized out> <repeats 26 times>}
#10 0x00007f1cbcd7238e in _mesa_delete_texture_image (ctx=<optimized out>, texImage=0x55647de0e190) at ../src/mesa/main/teximage.c:223
No locals.
#11 0x00007f1cbcd83ac9 in _mesa_delete_texture_object (ctx=0x556477898070, texObj=0x55647df465f0) at ../src/mesa/main/texobj.c:467
i = 0
face = 0
#12 0x00007f1cbcd83be1 in _mesa_reference_texobj_ (ptr=ptr@entry=0x7ffdce04a720, tex=tex@entry=0x0) at ../src/mesa/main/texobj.c:574
ctx = <optimized out>
oldTex = <optimized out>
#13 0x00007f1cbcd8405b in _mesa_reference_texobj (tex=0x0, ptr=0x7ffdce04a720) at ../src/mesa/main/texobj.h:96
No locals.
#14 delete_textures (ctx=0x556477898070, n=<optimized out>, textures=<optimized out>) at ../src/mesa/main/texobj.c:1487
delObj = 0x55647df465f0
i = <optimized out>
__func__ = {<optimized out> <repeats 16 times>}
#15 0x00007f1cc4273ee9 in _cogl_delete_gl_texture (gl_texture=<optimized out>) at ../cogl/cogl/driver/gl/cogl-pipeline-opengl.c:212
i = <optimized out>
ctx = <optimized out>
glctx = <optimized out>
#16 _cogl_texture_2d_gl_free (tex_2d=0x55647d4deeb0) at ../cogl/cogl/driver/gl/cogl-texture-2d-gl.c:66
No locals.
#17 0x00007f1cc4297479 in _cogl_texture_2d_free (tex_2d=0x55647d4deeb0) at ../cogl/cogl/cogl-texture-2d.c:78
ctx = <optimized out>
ctx = <optimized out>
#18 _cogl_object_texture_2d_indirect_free (obj=0x55647d4deeb0) at ../cogl/cogl/cogl-texture-2d.c:60
No locals.
#19 0x00007f1cc428b64b in _cogl_pipeline_layer_free (layer=0x556479f0a400) at ../cogl/cogl/cogl-pipeline-layer.c:706
No locals.
#20 _cogl_object_pipeline_layer_indirect_free (obj=0x556479f0a400) at ../cogl/cogl/cogl-pipeline-layer.c:57
No locals.
#21 0x00007f1cc554b9d0 in g_list_foreach (list=<optimized out>, func=0x7f1cc427d680 <cogl_object_unref>, user_data=0x0) at ../glib/glist.c:1090
next = 0x0
#22 0x00007f1cc554b38f in g_list_free_full (list=0x55647a008ce0, free_func=<optimized out>) at ../glib/glist.c:244
No locals.
#23 0x00007f1cc428b8de in _cogl_pipeline_free (pipeline=0x556477cd7d90) at ../cogl/cogl/cogl-pipeline.c:386
__func__ = {<optimized out> <repeats 20 times>}
#24 _cogl_object_pipeline_indirect_free (obj=0x556477cd7d90) at ../cogl/cogl/cogl-pipeline.c:69
No locals.
#25 0x00007f1cc4abf3c1 in clutter_offscreen_effect_finalize (gobject=0x55647d3abc00) at ../clutter/clutter/clutter-offscreen-effect.c:574
_pp = 0x55647d3abba8
_ptr = <optimized out>
self = <optimized out>
priv = 0x55647d3abba0
#26 0x00007f1cc5657b98 in g_object_unref (_object=<optimized out>) at ../gobject/gobject.c:3587
weak_locations = <optimized out>
object = <optimized out>
old_ref = <optimized out>
retry_atomic_decrement1 = <optimized out>
object = <optimized out>
old_ref = <optimized out>
__func__ = {<optimized out> <repeats 15 times>}
retry_atomic_decrement1 = <optimized out>
retry_atomic_decrement2 = <optimized out>
_g_boolean_var_ = <optimized out>
gaig_temp = <optimized out>
has_toggle_ref = <optimized out>
gaicae_oldval = <optimized out>
weak_locations = <optimized out>
gaig_temp = <optimized out>
weak_ref_location = <optimized out>
gaig_temp = <optimized out>
has_toggle_ref = <optimized out>
gaicae_oldval = <optimized out>
_g_boolean_var_ = <optimized out>
_g_boolean_var_ = <optimized out>
#27 g_object_unref (_object=0x55647d3abc00) at ../gobject/gobject.c:3479
object = 0x55647d3abc00
old_ref = <optimized out>
retry_atomic_decrement1 = <optimized out>
retry_atomic_decrement2 = <optimized out>
__func__ = "g_object_unref"
gaig_temp = <optimized out>
has_toggle_ref = <optimized out>
gaicae_oldval = <optimized out>
weak_locations = <optimized out>
gaig_temp = <optimized out>
weak_ref_location = <optimized out>
gaig_temp = <optimized out>
has_toggle_ref = <optimized out>
gaicae_oldval = <optimized out>
_g_boolean_var_ = <optimized out>
_g_boolean_var_ = <optimized out>
#28 0x00007f1cc4ba874a in ObjectInstance::disassociate_js_gobject (this=0x7f1c9c2c2890) at ../gi/object.cpp:1565
had_toggle_down = <optimized out>
had_toggle_up = <optimized out>
locked_queue = {<No data fields>}
#29 0x00007f1cc4bf7bf3 in std::function<void (ObjectInstance*)>::operator()(ObjectInstance*) const (__args#0=<optimized out>, this=0x7ffdce04a9e0) at /usr/include/c++/11/bits/std_function.h:560
No locals.
#30 operator() (link=0x7f1c9c2c2890, __closure=0x7ffdce04a9c0) at ../gi/object.cpp:1120
action = {<std::_Maybe_unary_or_binary_function<void, ObjectInstance*>> = {<std::unary_function<ObjectInstance*, void>> = {<No data fields>}, <No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x7f1cc4ba86d0 <ObjectInstance::disassociate_js_gobject()>, _M_const_object = 0x7f1cc4ba86d0 <ObjectInstance::disassociate_js_gobject()>, _M_function_pointer = 0x7f1cc4ba86d0 <ObjectInstance::disassociate_js_gobject()>, _M_member_pointer = (void (std::_Undefined_class::*)(std::_Undefined_class * const)) 0x7f1cc4ba86d0 <ObjectInstance::disassociate_js_gobject()>}, _M_pod_data = "І\272\304\034\177\000\000\000\000\000\000\000\000\000"}, _M_manager = 0x7f1cc4bae410 <std::_Function_handler<void (ObjectInstance*), std::_Mem_fn<void (ObjectInstance::*)()> >::_M_manager(std::_Any_data&, std::_Any_data const&, std::_Manager_operation)>}, _M_invoker = 0x7f1cc4bae3f0 <std::_Function_handler<void (ObjectInstance*), std::_Mem_fn<void (ObjectInstance::*)()> >::_M_invoke(std::_Any_data const&, ObjectInstance*&&)>}
predicate = {<std::_Maybe_unary_or_binary_function<bool, ObjectInstance*>> = {<std::unary_function<ObjectInstance*, bool>> = {<No data fields>}, <No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x7f1cc4b9e930 <ObjectInstance::weak_pointer_was_finalized()>, _M_const_object = 0x7f1cc4b9e930 <ObjectInstance::weak_pointer_was_finalized()>, _M_function_pointer = 0x7f1cc4b9e930 <ObjectInstance::weak_pointer_was_finalized()>, _M_member_pointer = (void (std::_Undefined_class::*)(std::_Undefined_class * const)) 0x7f1cc4b9e930 <ObjectInstance::weak_pointer_was_finalized()>}, _M_pod_data = "0\351\271\304\034\177\000\000\000\000\000\000\000\000\000"}, _M_manager = 0x7f1cc4bae370 <std::_Function_handler<bool (ObjectInstance*), std::_Mem_fn<bool (ObjectInstance::*)()> >::_M_manager(std::_Any_data&, std::_Any_data const&, std::_Manager_operation)>}, _M_invoker = 0x7f1cc4bae330 <std::_Function_handler<bool (ObjectInstance*), std::_Mem_fn<bool (ObjectInstance::*)()> >::_M_invoke(std::_Any_data const&, ObjectInstance*&&)>}
action = {<std::_Maybe_unary_or_binary_function<void, ObjectInstance*>> = {<std::unary_function<ObjectInstance*, void>> = {<No data fields>}, <No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = <optimized out>, _M_const_object = <optimized out>, _M_function_pointer = <optimized out>, _M_member_pointer = <optimized out>}, _M_pod_data = {<optimized out> <repeats 16 times>}}, _M_manager = <optimized out>}, _M_invoker = <optimized out>}
predicate = {<std::_Maybe_unary_or_binary_function<bool, ObjectInstance*>> = {<std::unary_function<ObjectInstance*, bool>> = {<No data fields>}, <No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = <optimized out>, _M_const_object = <optimized out>, _M_function_pointer = <optimized out>, _M_member_pointer = <optimized out>}, _M_pod_data = {<optimized out> <repeats 16 times>}}, _M_manager = <optimized out>}, _M_invoker = <optimized out>}
#31 __gnu_cxx::__ops::_Iter_pred<ObjectInstance::remove_wrapped_gobjects_if(const Predicate&, const Action&)::<lambda(ObjectInstance*)> >::operator()<__gnu_cxx::__normal_iterator<ObjectInstance**, std::vector<ObjectInstance*> > > (__it=..., this=0x7ffdce04a9c0) at /usr/include/c++/11/bits/predefined_ops.h:318
No locals.
#32 std::__remove_if<__gnu_cxx::__normal_iterator<ObjectInstance**, std::vector<ObjectInstance*> >, __gnu_cxx::__ops::_Iter_pred<ObjectInstance::remove_wrapped_gobjects_if(const Predicate&, const Action&)::<lambda(ObjectInstance*)> > > (__pred=..., __last=0x55647c4dd830, __first=0x7f1c9c2c2890) at /usr/include/c++/11/bits/stl_algo.h:822
__result = 0x556479bc8d50
__result = Python Exception <class 'gdb.error'> value has been optimized out:
#33 std::remove_if<__gnu_cxx::__normal_iterator<ObjectInstance**, std::vector<ObjectInstance*> >, ObjectInstance::remove_wrapped_gobjects_if(const Predicate&, const Action&)::<lambda(ObjectInstance*)> > (__pred=..., __last=..., __first=...) at /usr/include/c++/11/bits/stl_algo.h:894
No locals.
#34 ObjectInstance::remove_wrapped_gobjects_if(std::function<bool (ObjectInstance*)> const&, std::function<void (ObjectInstance*)> const&) [clone .constprop.0] (predicate=..., action=...) at ../gi/object.cpp:1116
No locals.
#35 0x00007f1cc4b9e5d2 in ObjectInstance::update_heap_wrapper_weak_pointers () at ../gi/object.cpp:1412
locked_queue = {<No data fields>}
#36 0x00007f1cc208392a in js::gc::GCRuntime::beginSweepingSweepGroup (this=0x5564779a84f8, fop=0x7ffdce04b180, budget=...) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/gc/GC.cpp:1641
zone = {current = <optimized out>, selector = <optimized out>}
comp = {zone = <optimized out>, it = <optimized out>}
ap2 = {stats = <optimized out>, phaseKind = js::gcstats::PhaseKind::WEAK_COMPARTMENT_CALLBACK, enabled = true}
ap = {stats = <optimized out>, phaseKind = js::gcstats::PhaseKind::FINALIZE_START, enabled = true}
scc = {stats = <optimized out>, scc = 1, start = {mValue = {mUsedCanonicalNow = <optimized out>, mTimeStamp = 17654466579515}}}
sweepingAtoms = <optimized out>
threadIsSweeping = {<js::gc::AutoSetThreadGCUse> = {<No data fields>}, <No data fields>}
#37 0x00007f1cc207b4ce in sweepaction::SweepActionSequence::run (this=0x55647794dba0, args=...) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/gc/GC.cpp:5981
iter = {maybeIter = @0x55647794dbc0}
#38 0x00007f1cc209432a in sweepaction::SweepActionForEach<js::gc::SweepGroupsIter, JSRuntime*>::run (this=0x55647794d410, args=...) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/gc/GC.cpp:6016
iter = {maybeIter = @0x55647794d430}
clearElem = {mExitFunction = {__this = 0x55647794d410}, mExecuteOnDestruction = true}
#39 0x00007f1cc208aa40 in js::gc::GCRuntime::performSweepActions (budget=..., this=<optimized out>) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/dist/include/mozilla/UniquePtr.h:287
ap = {stats = <optimized out>, phaseKind = <optimized out>, enabled = <optimized out>}
fop = {runtime_ = 0x5564779a8000, freeLaterList = {<js::SystemAllocPolicy> = {<js::AllocPolicyBase> = {<No data fields>}, <No data fields>}, static kElemIsPod = true, static kInlineCapacity = 0, mBegin = 0x8, mLength = 0, mTail = {<mozilla::Vector<void*, 0, js::SystemAllocPolicy>::CapacityAndReserved> = {mCapacity = 0}, <No data fields>}}, jitPoisonRanges = {<js::SystemAllocPolicy> = {<js::AllocPolicyBase> = {<No data fields>}, <No data fields>}, static kElemIsPod = false, static kInlineCapacity = 0, mBegin = 0x18, mLength = 0, mTail = {<mozilla::Vector<js::jit::JitPoisonRange, 0, js::SystemAllocPolicy>::CapacityAndReserved> = {mCapacity = 0}, <No data fields>}}, isDefault = false, isCollecting_ = true}
args = {gc = 0x5564779a84f8, fop = 0x7ffdce04b180, budget = @0x7ffdce04b610}
progress = <optimized out>
ap = {stats = <optimized out>, phaseKind = <optimized out>, enabled = <optimized out>}
fop = {runtime_ = <optimized out>, freeLaterList = {<js::SystemAllocPolicy> = {<js::AllocPolicyBase> = {<No data fields>}, <No data fields>}, static kElemIsPod = true, static kInlineCapacity = 0, mBegin = <optimized out>, mLength = <optimized out>, mTail = {<mozilla::Vector<void*, 0, js::SystemAllocPolicy>::CapacityAndReserved> = {mCapacity = <optimized out>}, <No data fields>}}, jitPoisonRanges = {<js::SystemAllocPolicy> = {<js::AllocPolicyBase> = {<No data fields>}, <No data fields>}, static kElemIsPod = false, static kInlineCapacity = 0, mBegin = <optimized out>, mLength = <optimized out>, mTail = {<mozilla::Vector<js::jit::JitPoisonRange, 0, js::SystemAllocPolicy>::CapacityAndReserved> = {mCapacity = <optimized out>}, <No data fields>}}, isDefault = <optimized out>, isCollecting_ = <optimized out>}
args = {gc = <optimized out>, fop = <optimized out>, budget = <optimized out>}
progress = <optimized out>
lock = {<js::LockGuard<js::Mutex>> = {lock = <optimized out>}, <No data fields>}
ap = {stats = <optimized out>, phaseKind = <optimized out>, enabled = <optimized out>}
#40 js::gc::GCRuntime::incrementalSlice (this=<optimized out>, budget=..., gckind=..., reason=JS::GCReason::COMPONENT_UTILS, session=...) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/gc/GC.cpp:6694
disableBarriers = {gc = 0x5564779a84f8}
performingGC = {cx = 0x5564779a6400}
destroyingRuntime = false
useZeal = false
#41 0x00007f1cc209a859 in js::gc::GCRuntime::gcCycle (this=<optimized out>, nonincrementalByAPI=<optimized out>, budget=..., gckind=..., reason=JS::GCReason::COMPONENT_UTILS) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/gc/GC.cpp:7104
callCallbacks = {gc_ = <optimized out>, reason_ = <optimized out>}
agc = {stats = @0x5564779a8550}
result = <optimized out>
session = {<js::gc::AutoHeapSession> = {gc = 0x5564779a84f8, prevState = JS::HeapState::Idle, profilingStackFrame = {profiler_ = 0x0}}, maybeCheckAtomsAccess = {<mozilla::detail::MaybeStorage<js::gc::AutoCheckCanAccessAtomsDuringGC, true>> = {mStorage = {val = {<No data fields>}, dummy = 0 '\000'}, mIsSome = 1 '\001'}, <mozilla::detail::Maybe_CopyMove_Enabler<js::gc::AutoCheckCanAccessAtomsDuringGC, true, true, true>> = {<No data fields>}, <No data fields>}}
#42 0x00007f1cc209c602 in js::gc::GCRuntime::collect (this=0x5564779a84f8, nonincrementalByAPI=<optimized out>, budget=..., gckindArg=..., reason=JS::GCReason::COMPONENT_UTILS) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/gc/GC.cpp:7314
cycleResult = <optimized out>
gckind = {<mozilla::detail::MaybeStorage<JSGCInvocationKind, true>> = {mStorage = {val = GC_NORMAL, dummy = 0 '\000'}, mIsSome = 1 '\001'}, <mozilla::detail::Maybe_CopyMove_Enabler<JSGCInvocationKind, true, true, true>> = {<No data fields>}, <No data fields>}
logGC = {<No data fields>}
av = {<No data fields>}
aept = {gc_ = <optimized out>}
leaveAtomsZone = {cx_ = <optimized out>, wasInAtomsZone_ = <optimized out>}
sliceThresholds = {gc = <optimized out>}
repeat = <optimized out>
#43 0x00007f1cc1cd4471 in js::gc::GCRuntime::gc (reason=JS::GCReason::COMPONENT_UTILS, gckind=GC_NORMAL, this=0x5564779a84f8) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/dist/include/js/SliceBudget.h:60
No locals.
#44 JS_GC (cx=0x5564779a6400, reason=reason@entry=JS::GCReason::COMPONENT_UTILS) at /usr/src/debug/mozjs78-78.13.0-1.fc35.x86_64/jsapi.cpp:1360
No locals.
#45 0x00007f1cc4bc3735 in GjsContextPrivate::dispose (this=0x5564779a7070) at ../gjs/context.cpp:426
No locals.
#46 GjsContextPrivate::dispose (this=0x5564779a7070) at ../gjs/context.cpp:405
destroy_notify = <optimized out>
__for_range = <optimized out>
__for_begin = Python Exception <class 'gdb.error'> value has been optimized out:
__for_end = Python Exception <class 'gdb.error'> value has been optimized out:
#47 gjs_context_dispose (object=<optimized out>) at ../gjs/context.cpp:385
gjs = 0x5564779a7070
__PRETTY_FUNCTION__ = {<optimized out> <repeats 35 times>}
#48 0x00007f1cc5657b14 in g_object_unref (_object=<optimized out>) at ../gobject/gobject.c:3549
weak_locations = 0x0
object = <optimized out>
old_ref = <optimized out>
retry_atomic_decrement1 = <optimized out>
object = <optimized out>
old_ref = <optimized out>
__func__ = {<optimized out> <repeats 15 times>}
retry_atomic_decrement1 = <optimized out>
retry_atomic_decrement2 = <optimized out>
_g_boolean_var_ = <optimized out>
gaig_temp = <optimized out>
has_toggle_ref = <optimized out>
gaicae_oldval = <optimized out>
weak_locations = <optimized out>
gaig_temp = <optimized out>
weak_ref_location = <optimized out>
gaig_temp = <optimized out>
has_toggle_ref = <optimized out>
gaicae_oldval = <optimized out>
_g_boolean_var_ = <optimized out>
_g_boolean_var_ = <optimized out>
#49 g_object_unref (_object=0x5564779a71d0) at ../gobject/gobject.c:3479
object = 0x5564779a71d0
old_ref = <optimized out>
retry_atomic_decrement1 = <optimized out>
retry_atomic_decrement2 = <optimized out>
__func__ = "g_object_unref"
gaig_temp = <optimized out>
has_toggle_ref = <optimized out>
gaicae_oldval = <optimized out>
weak_locations = <optimized out>
gaig_temp = <optimized out>
weak_ref_location = <optimized out>
gaig_temp = <optimized out>
has_toggle_ref = <optimized out>
gaicae_oldval = <optimized out>
_g_boolean_var_ = <optimized out>
_g_boolean_var_ = <optimized out>
#50 0x0000556476c0de64 in main (argc=<optimized out>, argv=<optimized out>) at ../src/main.c:574
context = 0x0
error = 0x0
ecode = 0
Edited by Björn Daase