minimize to tray causes gnome-shell to crash in certain scenarios

[SoMuchForSubtlety]

gnome shell 3.38.3 using XOrg
minimize to tray v6

I can reliably trigger the crash using the following methods:

• I click on the "open containing folder" firefox download dialog with no existing nautilus window open
• take a screenshot with flameshot and select "upload to imgur"

coredumpctl output

❯ coredumpctl gdb 24534
           PID: 24534 (gnome-shell)
           UID: 1000 (jakob)
           GID: 1000 (jakob)
        Signal: 11 (SEGV)
     Timestamp: Sat 2021-03-13 15:28:06 CET (1min 1s ago)
  Command Line: /usr/bin/gnome-shell
    Executable: /usr/bin/gnome-shell
 Control Group: /user.slice/user-1000.slice/[email protected]/session.slice/[email protected]
          Unit: [email protected]
     User Unit: [email protected]
         Slice: user-1000.slice
     Owner UID: 1000 (jakob)
       Boot ID: 50a73028abea4ea1a149600b0075e16e
    Machine ID: a194d5eccb5645908ffd0439fcb72f62
      Hostname: honestmistake
       Storage: /var/lib/systemd/coredump/core.gnome-shell.1000.50a73028abea4ea1a149600b0075e16e.24534.1615645686000000.zst
       Message: Process 24534 (gnome-shell) of user 1000 dumped core.
                
                Stack trace of thread 24534:
                #0  0x00007f99c9863b7b meta_window_actor_get_meta_window (libmutter-7.so.0 + 0xa5b7b)
                #1  0x00007f99c8cfab10 ffi_call_unix64 (libffi.so.6 + 0x6b10)
                #2  0x00007f99c8cfa0a3 ffi_call (libffi.so.6 + 0x60a3)
                #3  0x00007f99c9b272ab gjs_invoke_c_function (libgjs.so.0 + 0x3e2ab)
                #4  0x00007f99c9b2775a function_call (libgjs.so.0 + 0x3e75a)
                #5  0x00007f99c6c0737e _ZN2js23InternalCallOrConstructEP9JSContextRKN2JS8CallArgsENS_14MaybeConstructENS_10CallReasonE (libmozjs-78.so.0 + 0x14e37e)
                #6  0x00007f99c70d895b _ZN2js3jit14DoCallFallbackEP9JSContextPNS0_13BaselineFrameEPNS0_15ICCall_FallbackEjPN2JS5ValueENS7_13MutableHandleIS8_EE (libmozjs-78.so.0 + 0x61f95b)
                #7  0x0000349d62720cb8 n/a (n/a + 0x0)
                #8  0x000055816ea4fb38 n/a (n/a + 0x0)
                #9  0x0000349d6271e69f n/a (n/a + 0x0)
                #10 0x00007f99c6c06588 _ZL9InterpretP9JSContextRN2js8RunStateE (libmozjs-78.so.0 + 0x14d588)
                #11 0x00007f99c6c06be9 _ZN2js9RunScriptEP9JSContextRNS_8RunStateE (libmozjs-78.so.0 + 0x14dbe9)
                #12 0x00007f99c6c07064 _ZN2js23InternalCallOrConstructEP9JSContextRKN2JS8CallArgsENS_14MaybeConstructENS_10CallReasonE (libmozjs-78.so.0 + 0x14e064)
                #13 0x00007f99c6c076a2 _ZN2js4CallEP9JSContextN2JS6HandleINS2_5ValueEEES5_RKNS_13AnyInvokeArgsENS2_13MutableHandleIS4_EENS_10CallReasonE (libmozjs-78.so.0 + 0x14e6a2)
                #14 0x00007f99c6e12979 _ZN2js22CallSelfHostedFunctionEP9JSContextN2JS6HandleIPNS_12PropertyNameEEENS3_INS2_5ValueEEERKNS_13AnyInvokeArgsENS2_13MutableHandleIS7_EE (libmozjs-78.so.0 + 0x359979)
                #15 0x00007f99c7105929 _ZN2js3jit15InterpretResumeEP9JSContextN2JS6HandleIP8JSObjectEEPNS3_5ValueENS3_13MutableHandleIS8_EE (libmozjs-78.so.0 + 0x64c929)
                #16 0x0000349d62721b90 n/a (n/a + 0x0)
                #17 0x0000349d6271e69f n/a (n/a + 0x0)
                #18 0x00007f99c723090d _ZL8EnterJitP9JSContextRN2js8RunStateEPh (libmozjs-78.so.0 + 0x77790d)
                #19 0x00007f99c6c06c42 _ZN2js9RunScriptEP9JSContextRNS_8RunStateE (libmozjs-78.so.0 + 0x14dc42)
                #20 0x00007f99c6c07064 _ZN2js23InternalCallOrConstructEP9JSContextRKN2JS8CallArgsENS_14MaybeConstructENS_10CallReasonE (libmozjs-78.so.0 + 0x14e064)
                #21 0x00007f99c6c076a2 _ZN2js4CallEP9JSContextN2JS6HandleINS2_5ValueEEES5_RKNS_13AnyInvokeArgsENS2_13MutableHandleIS4_EENS_10CallReasonE (libmozjs-78.so.0 + 0x14e6a2)
                #22 0x00007f99c6e12979 _ZN2js22CallSelfHostedFunctionEP9JSContextN2JS6HandleIPNS_12PropertyNameEEENS3_INS2_5ValueEEERKNS_13AnyInvokeArgsENS2_13MutableHandleIS7_EE (libmozjs-78.so.0 + 0x359979)
                #23 0x00007f99c6cd9151 _ZL19AsyncFunctionResumeP9JSContextN2JS6HandleIPN2js28AsyncFunctionGeneratorObjectEEE10ResumeKindNS2_INS1_5ValueEEE.lto_priv.0 (libmozjs-78.so.0 + 0x220151)
                #24 0x00007f99c6d1f982 _ZL18PromiseReactionJobP9JSContextjPN2JS5ValueE (libmozjs-78.so.0 + 0x266982)
                #25 0x00007f99c6c07238 _ZN2js23InternalCallOrConstructEP9JSContextRKN2JS8CallArgsENS_14MaybeConstructENS_10CallReasonE (libmozjs-78.so.0 + 0x14e238)
                #26 0x00007f99c6c076a2 _ZN2js4CallEP9JSContextN2JS6HandleINS2_5ValueEEES5_RKNS_13AnyInvokeArgsENS2_13MutableHandleIS4_EENS_10CallReasonE (libmozjs-78.so.0 + 0x14e6a2)
                #27 0x00007f99c6c7ecd0 _ZN2JS4CallEP9JSContextNS_6HandleINS_5ValueEEES4_RKNS_16HandleValueArrayENS_13MutableHandleIS3_EE (libmozjs-78.so.0 + 0x1c5cd0)
                #28 0x00007f99c9b47926 _ZN17GjsContextPrivate17run_jobs_fallibleEv (libgjs.so.0 + 0x5e926)
                #29 0x00007f99c9b47ac8 _ZN17GjsContextPrivate7runJobsEP9JSContext (libgjs.so.0 + 0x5eac8)
                #30 0x00007f99c9b3e4e2 _ZN17GjsContextPrivate28drain_job_queue_idle_handlerEPv (libgjs.so.0 + 0x554e2)
                #31 0x00007f99ca437b5b g_idle_dispatch (libglib-2.0.so.0 + 0x52b5b)
                #32 0x00007f99ca438a9f g_main_context_dispatch (libglib-2.0.so.0 + 0x53a9f)
                #33 0x00007f99ca48aa98 g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa5a98)
                #34 0x00007f99ca438163 g_main_loop_run (libglib-2.0.so.0 + 0x53163)
                #35 0x00007f99c9887dba meta_run (libmutter-7.so.0 + 0xc9dba)
                #36 0x0000558169cc3c9c main (gnome-shell + 0x2c9c)
                #37 0x00007f99c96191e2 __libc_start_main (libc.so.6 + 0x281e2)
                #38 0x0000558169cc3e7e _start (gnome-shell + 0x2e7e)
                
				[...]

journalctl logs

[...]
Jan 16 23:04:55 honestmistake systemd[1]: Starting Hostname Service...
Jan 16 23:04:55 honestmistake gnome-shell[555444]: [mtt] [window-listener] new window opened for class: 3731117891/org.gnome.Nautilus
Jan 16 23:04:55 honestmistake gnome-shell[555444]: Object .MetaWindowActorX11 (0x55b619142d40), has been already deallocated — impossible to access it. This might be caused by the object having been destroyed from C code using something such as destroy(), dispose(), or remove() vfuncs.
Jan 16 23:04:55 honestmistake gnome-shell[555444]: == Stack trace for context 0x55b6142c42e0 ==
Jan 16 23:04:55 honestmistake gnome-shell[555444]: #0   7ffd22a5f550 b   /home/jakob/.local/share/gnome-shell/extensions/[email protected]/extension.js:250 (c3ba76d5880 @ 121)
Jan 16 23:04:55 honestmistake gnome-shell[555444]: #1   55b6195522b8 i   self-hosted:1158 (c3ba76d6a10 @ 30)
Jan 16 23:04:55 honestmistake gnome-shell[555444]: #2   7ffd22a5fed0 b   self-hosted:693 (c3ba76d69c0 @ 15)
Jan 16 23:04:55 honestmistake audit[555444]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=555444 comm="gnome-shell" exe=2F7573722F62696E2F676E6F6D652D7368656C6C202864656C6574656429 sig=11 res=1
Jan 16 23:04:55 honestmistake kernel: gnome-shell[555444]: segfault at fffffffffffffc80 ip 00007f5a2bc6c66b sp 00007ffd22a5f0b8 error 5 in libmutter-7.so.0.0.0 (deleted)[7f5a2bc0d000+119000]
Jan 16 23:04:55 honestmistake kernel: Code: 83 c4 08 48 8d 15 4c 74 0c 00 48 8d 35 9e 7e 0c 00 5b 48 8d 3d ce 3c 0c 00 5d e9 20 b1 fa ff f3 0f 1e fa 48 63 05 65 7f 13 00 <48> 8b 04 07 c3 f3 0f 1e fa 48 63 05 55 7f 13 00 48 8b 44 38 10 48
Jan 16 23:04:55 honestmistake audit: BPF prog-id=209 op=LOAD
Jan 16 23:04:55 honestmistake audit: BPF prog-id=210 op=LOAD
Jan 16 23:04:55 honestmistake systemd[1]: Started Process Core Dump (PID 594432/UID 0).
[...]

Original gnome-shell bug report

[ghost]

Same for me. I have Ubuntu 20.04 with xorg and newest minimize to tray v6 and shell version 3.36.7.
When I have minimize to tray activated for any program like evolution or keepassxc (Firefox is Not set to be minimized to tray) and I download any picture or file in Firefox and click on the button to open download folder in Firefox, Gnome session crashes, but than restores itself again like nothing has happened.
Though when I use zoom (zoom is again Not set in minimize to tray) and I minimize an active zoom call normally and than I try to maximize the zoom call again, gnome crashes again but than zoom crashes too and does not restore like nothing happened. As soon as I disabled minimize to tray in general, all the bugs with gnome crashing where gone.

[faaizajaz]

This also happens with Sublime Text (also not set to be minimized on tray). I can reproduce the issue every time by dragging a tab out of a window into its own window, but only if I'm dragging onto another monitor. Took me an hour to narrow down the issue to this extension. Seems unlikely this will ever be fixed.