#1109135 gnome-shell: segmentation fault in mozjs rooting API on resume from suspend

Package:
gnome-shell
Source:
gnome-shell
Description:
graphical shell for the GNOME desktop
Submitter:
Luca Boccassi
Date:
2025-07-12 11:19:02 UTC
Severity:
normal
Tags:
#1109135#5
Date:
2025-07-12 09:12:53 UTC
From:
To:
Dear Maintainer(s),

Last week gnome-shell crashed on resume from suspend. I do not
remember anything particular about that session, and cannot reproduce
it either. I can provide the full core file on demand if needed.

Backtrace:

#0  std::__atomic_base<unsigned int>::load (this=0x10,
__m=std::memory_order_relaxed) at
/usr/include/c++/14/bits/atomic_base.h:499
        __b = std::memory_order_relaxed
#1  mozilla::detail::IntrinsicMemoryOps<unsigned int,
(mozilla::MemoryOrdering)0>::load (aPtr=<error reading variable:
Cannot access memory at address 0x10>) at
/usr/include/x86_64-linux-gnu/mozjs-128/mozilla/Atomics.h:194
#2  mozilla::detail::AtomicBaseIncDec<unsigned int,
(mozilla::MemoryOrdering)0>::operator unsigned int (this=0x10) at
/usr/include/x86_64-linux-gnu/mozjs-128/mozilla/Atomics.h:339
#3  JS::shadow::Zone::needsIncrementalBarrier (this=0x0) at
/usr/include/x86_64-linux-gnu/mozjs-128/js/shadow/Zone.h:58
#4  js::gc::ExposeGCThingToActiveJS (thing=...) at
/usr/include/x86_64-linux-gnu/mozjs-128/js/HeapAPI.h:816
        cell = 0x3daa8be10dd0
        zone = 0x0
        cell = <optimized out>
        zone = <optimized out>
#5  JS::ExposeObjectToActiveJS (obj=0x3daa8be10dd0) at
/usr/include/x86_64-linux-gnu/mozjs-128/js/HeapAPI.h:877
#6  js::BarrierMethods<JSObject*, void>::exposeToJS
(obj=0x3daa8be10dd0) at
/usr/include/x86_64-linux-gnu/mozjs-128/js/RootingAPI.h:802
#7  JS::Heap<JSObject*>::exposeToActiveJS (this=0x55e6f1a6ae40) at
/usr/include/x86_64-linux-gnu/mozjs-128/js/RootingAPI.h:348
#8  JS::Heap<JSObject*>::get (this=0x55e6f1a6ae40) at
/usr/include/x86_64-linux-gnu/mozjs-128/js/RootingAPI.h:351
#9  JS::Heap<JSObject*>::operator JSObject* const&
(this=0x55e6f1a6ae40) at
/usr/include/x86_64-linux-gnu/mozjs-128/js/RootingAPI.h:343
#10 JS::Rooted<JSObject*>::Rooted<JSContext*, JS::Heap<JSObject*>&>
(this=0x7ffdaf80a160, cx=<synthetic pointer>: <optimized out>,
initial=...) at
/usr/include/x86_64-linux-gnu/mozjs-128/js/RootingAPI.h:1182
#11 GjsMaybeOwned::switch_to_rooted (this=0x55e6f1a6ae40,
cx=0x55e6e004dc20) at ../gjs/jsapi-util-root.h:181
        thing = {<js::TypedRootedGCThingBase<js::StackRootedBase,
JSObject*>> = {<js::StackRootedBase> = {stack = 0x55e6e004dc38, prev =
0x7ffdaf80a580}, <No data fields>}, <js::RootedOperations<JSObject*,
JS::Rooted<JSObject*> >> =
{<js::MutableWrappedPtrOperations<JSObject*, JS::Rooted<JSObject*> >>
= {<js::WrappedPtrOperations<JSObject*, JS::Rooted<JSObject*>, void>>
= {<No data fields>}, <No data fields>}, <No data fields>}, ptr =
0x456da0b3740}
#12 0x00007f5f261c70b7 in ToggleQueue::handle_toggle
(this=0x7f5f262afe60
<ToggleQueue::get_default_unlocked()::the_singleton>,
handler=0x7f5f261ac2a0 <toggle_handler(ObjectInstance*,
ToggleQueue::Direction)>) at
./obj-x86_64-linux-gnu/../gi/toggle.cpp:135
        item = <optimized out>
#13 0x00007f5f261c71bb in ToggleQueue::handle_all_toggles
(this=0x7f5f262afe60
<ToggleQueue::get_default_unlocked()::the_singleton>,
handler=0x7f5f261ac2a0 <toggle_handler(ObjectInstance*,
ToggleQueue::Direction)>) at
./obj-x86_64-linux-gnu/../gi/toggle.cpp:69
#14 0x00007f5f261c722b in ToggleQueue::idle_handle_toggle
(data=<optimized out>) at ../gi/toggle.h:83
        self = {<No data fields>}
#15 0x00007f5f2630c345 in ??? ()
#16 0x00058ea77800ead9 in ??? ()
#17 0x000055e6e0026ae0 in ??? ()
#18 0x000055e6f0cd3a00 in ??? ()
#19 0x0000000100000001 in ??? ()
#20 0x0000000000000000 in ??? ()

If you tell me which packages own the bottom of the stack there I can
re-decode the core.

Filtered journal immediately before/after crash:

[1564223.199070] kernel: Freezing user space processes
[1564223.197620] systemd-logind[1068]: Lid opened.
[1564223.199754] kernel: Freezing user space processes completed
(elapsed 0.002 seconds)
[1564223.200063] kernel: OOM killer disabled.
[1564223.200084] kernel: Freezing remaining freezable tasks
[1564223.200107] kernel: Freezing remaining freezable tasks completed
(elapsed 0.001 seconds)
[1564223.200124] kernel: printk: Suspending console(s) (use
no_console_suspend to debug)
[1564223.200157] kernel: ACPI: EC: interrupt blocked
[1564223.200184] kernel: ACPI: EC: interrupt unblocked
[1564223.200204] kernel: [drm] PCIE GART of 512M enabled (table at
0x0000008000900000).
[1564223.200221] kernel: amdgpu 0000:64:00.0: amdgpu: SMU is resuming...
[1564223.200420] kernel: amdgpu 0000:64:00.0: amdgpu: SMU is resumed
successfully!
[1564223.200552] kernel: nvme nvme0: D3 entry latency set to 10 seconds
[1564223.200662] kernel: [drm] Skip DMUB HPD IRQ callback in suspend/resume
[1564223.200682] kernel: [drm] Skip DMUB HPD IRQ callback in suspend/resume
[1564223.200698] kernel: nvme nvme0: 16/0/0 default/read/poll queues
[1564223.200806] kernel: [drm] DM_MST: Differing MST start on
aconnector: 00000000addb7771 [id: 128]
[1564223.200823] kernel: amdgpu 0000:64:00.0: amdgpu: ring gfx_0.0.0
uses VM inv eng 0 on hub 0
[1564223.200949] kernel: amdgpu 0000:64:00.0: amdgpu: ring comp_1.0.0
uses VM inv eng 1 on hub 0
[1564223.201073] kernel: amdgpu 0000:64:00.0: amdgpu: ring comp_1.1.0
uses VM inv eng 4 on hub 0
[1564223.201208] kernel: amdgpu 0000:64:00.0: amdgpu: ring comp_1.2.0
uses VM inv eng 6 on hub 0
[1564223.201337] kernel: amdgpu 0000:64:00.0: amdgpu: ring comp_1.3.0
uses VM inv eng 7 on hub 0
[1564223.201465] kernel: amdgpu 0000:64:00.0: amdgpu: ring comp_1.0.1
uses VM inv eng 8 on hub 0
[1564223.201591] kernel: amdgpu 0000:64:00.0: amdgpu: ring comp_1.1.1
uses VM inv eng 9 on hub 0
[1564223.201710] kernel: amdgpu 0000:64:00.0: amdgpu: ring comp_1.2.1
uses VM inv eng 10 on hub 0
[1564223.201832] kernel: amdgpu 0000:64:00.0: amdgpu: ring comp_1.3.1
uses VM inv eng 11 on hub 0
[1564223.201958] kernel: amdgpu 0000:64:00.0: amdgpu: ring sdma0 uses
VM inv eng 12 on hub 0
[1564223.202082] kernel: amdgpu 0000:64:00.0: amdgpu: ring
vcn_unified_0 uses VM inv eng 0 on hub 8
[1564223.202208] kernel: amdgpu 0000:64:00.0: amdgpu: ring jpeg_dec
uses VM inv eng 1 on hub 8
[1564223.202340] kernel: amdgpu 0000:64:00.0: amdgpu: ring
mes_kiq_3.1.0 uses VM inv eng 13 on hub 0
[1564223.202463] kernel: [drm] DMUB HPD RX IRQ callback: link_index=6
[1564223.202483] kernel: [drm] ring gfx_32792.1.1 was added
[1564223.202504] kernel: [drm] ring compute_32792.2.2 was added
[1564223.202529] kernel: [drm] ring sdma_32792.3.3 was added
[1564223.202545] kernel: [drm] ring gfx_32792.1.1 ib test pass
[1564223.202557] kernel: [drm] ring compute_32792.2.2 ib test pass
[1564223.202574] kernel: [drm] ring sdma_32792.3.3 ib test pass
[1564223.202589] kernel: [drm] DMUB HPD RX IRQ callback: link_index=6
[1564223.202603] kernel: [drm] DMUB HPD RX IRQ callback: link_index=6
[1564223.202614] kernel: [drm] DMUB HPD RX IRQ callback: link_index=6
[1564223.202633] kernel: [drm] DMUB HPD RX IRQ callback: link_index=6
[1564223.202647] kernel: r8152 12-1:1.0 enx0050b6b7bd60: carrier on
[1564223.202821] kernel: usb 11-2: reset high-speed USB device number
19 using xhci_hcd
[1564223.202989] kernel: usb 12-2: reset SuperSpeed USB device number
7 using xhci_hcd
[1564223.203146] kernel: usb 11-2.2: reset full-speed USB device
number 21 using xhci_hcd
[1564223.203295] kernel: usb 11-2.4: reset full-speed USB device
number 22 using xhci_hcd
[1564223.203452] kernel: usb 11-2.1: reset full-speed USB device
number 20 using xhci_hcd
[1564223.203607] kernel: OOM killer enabled.
[1564223.203626] kernel: Restarting tasks ... done.
[1564223.203645] kernel: random: crng reseeded on system resumption
[1564223.227634] systemd-sleep[1911957]: System returned from sleep
operation 'suspend'.
[1564223.228066] kernel: PM: suspend exit
[1564223.234749] systemd[1]: Starting apt-daily-upgrade.service -
Daily apt upgrade and clean activities...
[1564223.235895] systemd[1]: Starting cron-daily-google-chrome.service
- [Cron] /etc/cron.daily/google-chrome...
[1564223.236786] systemd[1]: Starting cron-daily-keybase.service -
[Cron] /etc/cron.daily/keybase...
[1564223.237565] systemd[1]: Starting
cron-daily-popularity-contest.service - [Cron]
/etc/cron.daily/popularity-contest...
[1564223.238317] systemd[1]: Starting cron-daily-quota.service -
[Cron] /etc/cron.daily/quota...
[1564223.277777] systemd[1]: Starting dpkg-db-backup.service - Daily
dpkg database backup service...
[1564223.289533] systemd[1]: Starting e2scrub_all.service - Online
ext4 Metadata Check for All Filesystems...
[1564223.290378] systemd[1]: Starting fwupd-refresh.service - Refresh
fwupd metadata and update motd...
[1564223.302513] systemd[1]: Starting logrotate.service - Rotate log files...
[1564223.304029] kernel: audit: type=1334 audit(1751795159.144:26641):
prog-id=6991 op=LOAD
[1564223.315390] systemd[1]: Starting man-db.service - Daily man-db
regeneration...
[1564223.316019] kernel: audit: type=1334 audit(1751795159.156:26642):
prog-id=6992 op=LOAD
[1564223.317632] systemd[1]: cron-daily-google-chrome.service:
Deactivated successfully.
[1564223.317820] systemd[1]: Finished cron-daily-google-chrome.service
- [Cron] /etc/cron.daily/google-chrome.
[1564223.318159] systemd[1]: cron-daily-popularity-contest.service:
Deactivated successfully.
[1564223.318314] systemd[1]: Finished
cron-daily-popularity-contest.service - [Cron]
/etc/cron.daily/popularity-contest.
[1564223.318594] systemd[1]: cron-daily-quota.service: Deactivated successfully.
[1564223.318740] systemd[1]: Finished cron-daily-quota.service -
[Cron] /etc/cron.daily/quota.
[1564223.319103] systemd[1]: e2scrub_all.service: Deactivated successfully.
[1564223.319240] systemd[1]: Finished e2scrub_all.service - Online
ext4 Metadata Check for All Filesystems.
[1564223.320018] kernel: audit: type=1130 audit(1751795159.159:26643):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined
msg='unit=cron-daily-google-chrome comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
[1564223.320059] kernel: audit: type=1131 audit(1751795159.159:26644):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined
msg='unit=cron-daily-google-chrome comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
[1564223.320087] kernel: audit: type=1130 audit(1751795159.159:26645):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined
msg='unit=cron-daily-popularity-contest comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
[1564223.320103] kernel: audit: type=1131 audit(1751795159.159:26646):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined
msg='unit=cron-daily-popularity-contest comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
[1564223.320120] kernel: audit: type=1130 audit(1751795159.159:26647):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined
msg='unit=cron-daily-quota comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
[1564223.320153] kernel: audit: type=1131 audit(1751795159.159:26648):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined
msg='unit=cron-daily-quota comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'
[1564223.320176] kernel: audit: type=1130 audit(1751795159.159:26649):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined
msg='unit=e2scrub_all comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=success'
[1564223.328505] systemd[1]: user.slice: Unit now thawed.
[1564223.328774] systemd-sleep[1911957]: Successfully thawed unit 'user.slice'.
[1564223.330215] systemd[1]: systemd-suspend.service: Deactivated successfully.
[1564223.330475] systemd[1]: Finished systemd-suspend.service - System Suspend.
[1564223.335363] systemd[1]: Stopped target sleep.target - Sleep.
[1564223.335449] systemd[1]: Reached target suspend.target - Suspend.
[1564223.335537] systemd-logind[1068]: Operation 'suspend' finished.
[1564223.335580] systemd[1]: Stopped target suspend.target - Suspend.
[1564223.361079] systemd[1]: cron-daily-keybase.service: Deactivated
successfully.
[1564223.361416] systemd[1]: Finished cron-daily-keybase.service -
[Cron] /etc/cron.daily/keybase.
[1564223.469826] systemd[1]: modprobe@sd_mod.service - Load Kernel
Module sd_mod was skipped because of an unmet condition check
(ConditionKernelModuleLoaded=!sd_mod).
[1564223.500168] kernel: Generic FE-GE Realtek PHY r8169-0-100:00:
attached PHY driver (mii_bus:phy_addr=r8169-0-100:00, irq=MAC)
[1564223.991606] kernel: r8169 0000:01:00.0 enp1s0f0: Link is Down
[1564223.992190] kernel: r8152 12-1:1.0 enx0050b6b7bd60: carrier on
[1564223.992201] systemd[1]: Starting fwupd.service - Firmware update daemon...
[1564224.029263] systemd[1]: Starting packagekit.service - PackageKit Daemon...
[1564224.506168] gnome-shell[2555]: XWAYLAND: mode -1x-1 is not available
[1564224.780978] systemd[1]: Started packagekit.service - PackageKit Daemon.
[1564224.784021] kernel: kauditd_printk_skb: 6 callbacks suppressed
[1564224.784098] kernel: audit: type=1130 audit(1751795160.622:26656):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined
msg='unit=packagekit comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=success'
[1564224.808033] kernel: gnome-shell[2398]: segfault at 10 ip
00007f5f261bcd5b sp 00007ffdaf80a160 error 4 in
libgjs.so.0.0.0[6ed5b,7f5f2616f000+b2000] likely on CPU 3 (core 1,
socket 0)
[1564224.808162] kernel: Code: 48 89 d1 48 c1 e9 06 48 83 e9 20 48 8b
0c c8 48 0f a3 d1 0f 82 a0 fe ff ff 48 89 f9 48 81 e1 00 f0 ff ff 48
83 c9 08 48 8b 09 <8b> 71 10 85 f6 0f 85 9a 00 00 00 83 79 14 01 0f 84
7a fe ff ff 48
[1564224.808200] kernel: audit: type=1701 audit(1751795160.645:26657):
auid=1000 uid=1000 gid=1000 ses=3 subj=unconfined pid=2398
comm="gnome-shell"
exe=2F7573722F62696E2F676E6F6D652D7368656C6C202864656C6574656429
sig=11 res=1

#1109135#10
Date:
2025-07-12 11:16:40 UTC
From:
To:
Control: retitle -1 gnome-shell: segmentation fault in mozjs rooting API on resume from suspend
Control: tags -1 + unreproducible

Marking as unreproducible accordingly, and adjusting the title to try to
avoid "me too" comments if someone is seeing an unrelated segfault
during resume that would be better reported separately.

If there's no information available in gdb, then I suspect it might be
JIT'd code generated by mozjs128, which we are unlikely to be able to
debug. I also can't see anything obviously useful in the quoted Journal
entries.

This might be a gjs or mozjs128 issue rather than gnome-shell itself,
but it's hard to tell either way.

     smcv