GitLab

This is reproducible using the Debian packaging of pipewire 0.3.10 on Endless OS by switching the language in gnome-initial-setup. Internally in g-i-s that causes a libcheese webcam widget to be destroyed (so it can be recreated with the locale changed), which causes various things inside GStreamer to be shutdown/stopped and causes a double-free inside gstpipewiredeviceprovider.c.

I can reproduce it by booting an Endless OS image with the kernel arguments: systemd.debug_shell systemd.setenv=MALLOC_CHECK_=3 systemd.setenv=PIPEWIRE_DEBUG=5. The first is needed so I can debug the problem, the second is needed to cause the double-free to immediately abort, and the third is for debug.

Here’s a journal of the pipewire debug output showing the problem: journal

The crash happens at free(): invalid pointer and involves a double-free of proxy object 0x5620b61f2920, which is a struct pw_registry.

Here’s the output of a gdb session:

Thread 1 "gnome-initial-s" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) t a a bt

Thread 13 (Thread 0x7f39cc8a4700 (LWP 1778)):
#0  syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1  0x00007f39e59a3edf in g_cond_wait_until (cond=cond@entry=0x5620b3f722a8, mutex=mutex@entry=0x5620b3f722a0, end_time=end_time@entry=304864240) at ../../../glib/gthread-posix.c:1588
#2  0x00007f39e5928591 in g_async_queue_pop_intern_unlocked (queue=0x5620b3f722a0, wait=wait@entry=1, end_time=304864240) at ../../../glib/gasyncqueue.c:422
#3  0x00007f39e5928bcd in g_async_queue_timeout_pop_unlocked (queue=<optimized out>, timeout=timeout@entry=500000) at ../../../glib/gasyncqueue.c:574
#4  0x00007f39e59814a2 in g_thread_pool_wait_for_new_task (pool=<optimized out>) at ../../../glib/gthreadpool.c:278
#5  g_thread_pool_thread_proxy (data=<optimized out>) at ../../../glib/gthreadpool.c:343
#6  0x00007f39e5980afd in g_thread_proxy (data=0x5620b577f0c0) at ../../../glib/gthread.c:807
#7  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#8  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 11 (Thread 0x7f397e29c700 (LWP 1162)):
#0  0x00007f39e15967ef in epoll_wait (epfd=34, events=0x7f397e29b520, maxevents=32, timeout=-1) at ../sysdeps/unix/sysv/linux/epoll_wait.c:30
#1  0x00007f39805a0f40 in ?? () from /usr/lib/x86_64-linux-gnu/spa-0.2/support/libspa-support.so
#2  0x00007f398059ed29 in ?? () from /usr/lib/x86_64-linux-gnu/spa-0.2/support/libspa-support.so
#3  0x00007f397efd07d5 in do_loop (user_data=0x5620b610ddc0) at ../src/pipewire/thread-loop.c:240
#4  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#5  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 10 (Thread 0x7f397ee93700 (LWP 1161)):
#0  0x00007f39e15967ef in epoll_wait (epfd=38, events=0x7f397ee924b0, maxevents=32, timeout=-1) at ../sysdeps/unix/sysv/linux/epoll_wait.c:30
#1  0x00007f39805a0f40 in ?? () from /usr/lib/x86_64-linux-gnu/spa-0.2/support/libspa-support.so
#2  0x00007f398059ed29 in ?? () from /usr/lib/x86_64-linux-gnu/spa-0.2/support/libspa-support.so
#3  0x00007f397ef9a158 in do_loop (user_data=0x5620b610f450) at ../src/pipewire/data-loop.c:77
#4  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#5  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 9 (Thread 0x7f397fd0f700 (LWP 1159)):
#0  syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1  0x00007f39e59a3dbf in g_cond_wait (cond=0x7f39e4e2c260, mutex=0x7f39e4e2c250) at ../../../glib/gthread-posix.c:1540
#2  0x00007f39e4df0f53 in ?? () from /lib/x86_64-linux-gnu/libevview3.so.3
#3  0x00007f39e5980afd in g_thread_proxy (data=0x5620b3f8ab00) at ../../../glib/gthread.c:807
#4  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#5  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 8 (Thread 0x7f39816fd700 (LWP 1153)):
#0  0x00007f39e158b819 in __GI___poll (fds=0x5620b45b2000, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f39e59578d6 in g_main_context_poll (priority=<optimized out>, n_fds=1, fds=0x5620b45b2000, timeout=<optimized out>, context=0x5620b45b4ba0) at ../../../glib/gmain.c:4346
#2  g_main_context_iterate (context=0x5620b45b4ba0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4042
#3  0x00007f39e5957c2a in g_main_loop_run (loop=0x5620b45b5800) at ../../../glib/gmain.c:4241
#4  0x00007f39df6691b0 in WTF::RunLoop::run() () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#5  0x00007f39df61a37b in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#6  0x00007f39df66a699 in ?? () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#7  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#8  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 7 (Thread 0x7f3981efe700 (LWP 1152)):
#0  0x00007f39e158b819 in __GI___poll (fds=0x5620b44a5530, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f39e59578d6 in g_main_context_poll (priority=<optimized out>, n_fds=1, fds=0x5620b44a5530, timeout=<optimized out>, context=0x5620b45b34a0) at ../../../glib/gmain.c:4346
#2  g_main_context_iterate (context=0x5620b45b34a0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4042
#3  0x00007f39e5957c2a in g_main_loop_run (loop=0x5620b44a51b0) at ../../../glib/gmain.c:4241
#4  0x00007f39df6691b0 in WTF::RunLoop::run() () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#5  0x00007f39df61a37b in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#6  0x00007f39df66a699 in ?? () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#7  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
--Type <RET> for more, q to quit, c to continue without paging--
#8  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 6 (Thread 0x7f39826ff700 (LWP 1151)):
#0  futex_abstimed_wait_cancelable (private=0, abstime=0x7f39826fe5d0, expected=0, futex_word=0x7f39c2fe5060) at ../sysdeps/unix/sysv/linux/futex-internal.h:205
#1  __pthread_cond_wait_common (abstime=0x7f39826fe5d0, mutex=0x7f39c2fe5010, cond=0x7f39c2fe5038) at pthread_cond_wait.c:539
#2  __pthread_cond_timedwait (cond=0x7f39c2fe5038, mutex=0x7f39c2fe5010, abstime=0x7f39826fe5d0) at pthread_cond_wait.c:667
#3  0x00007f39df66ae1a in WTF::ThreadCondition::timedWait(WTF::Mutex&, WTF::WallTime) () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#4  0x00007f39df6162cb in WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) ()
   from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#5  0x00007f39df61972a in WTF::sleep(WTF::Seconds) () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#6  0x00007f39e2202ab5 in ?? () from /lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37
#7  0x00007f39df61a37b in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#8  0x00007f39df66a699 in ?? () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#9  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#10 0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 5 (Thread 0x7f39c382a700 (LWP 1150)):
#0  futex_wait_cancelable (private=0, expected=0, futex_word=0x7f39df9aa7c8 <bmalloc::StaticPerProcessStorageTraits<bmalloc::Scavenger>::Storage::s_memory+72>) at ../sysdeps/unix/sysv/linux/futex-internal.h:88
#1  __pthread_cond_wait_common (abstime=0x0, mutex=0x5620b45b0db0, cond=0x7f39df9aa7a0 <bmalloc::StaticPerProcessStorageTraits<bmalloc::Scavenger>::Storage::s_memory+32>) at pthread_cond_wait.c:502
#2  __pthread_cond_wait (cond=0x7f39df9aa7a0 <bmalloc::StaticPerProcessStorageTraits<bmalloc::Scavenger>::Storage::s_memory+32>, mutex=0x5620b45b0db0) at pthread_cond_wait.c:655
#3  0x00007f39dbd503bc in std::condition_variable::wait(std::unique_lock<std::mutex>&) () from /lib/x86_64-linux-gnu/libstdc++.so.6
#4  0x00007f39df67ab72 in bmalloc::Scavenger::threadRunLoop() () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#5  0x00007f39df67ae39 in bmalloc::Scavenger::threadEntryPoint(bmalloc::Scavenger*) () from /lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18
#6  0x00007f39dbd55b2f in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#7  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#8  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 4 (Thread 0x7f39cb7d2700 (LWP 1144)):
#0  0x00007f39e158b819 in __GI___poll (fds=0x5620b3f9bf70, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f39e59578d6 in g_main_context_poll (priority=<optimized out>, n_fds=1, fds=0x5620b3f9bf70, timeout=<optimized out>, context=0x5620b3f80480) at ../../../glib/gmain.c:4346
#2  g_main_context_iterate (context=context@entry=0x5620b3f80480, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4042
#3  0x00007f39e59579fc in g_main_context_iteration (context=0x5620b3f80480, may_block=1) at ../../../glib/gmain.c:4108
#4  0x00007f39e5db0dcd in ?? () from /usr/lib/x86_64-linux-gnu/gio/modules/libdconfsettings.so
#5  0x00007f39e5980afd in g_thread_proxy (data=0x5620b3f9d0c0) at ../../../glib/gthread.c:807
#6  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#7  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 3 (Thread 0x7f39cbfd3700 (LWP 1143)):
#0  0x00007f39e158b819 in __GI___poll (fds=0x5620b4ff9120, nfds=4, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f39e59578d6 in g_main_context_poll (priority=<optimized out>, n_fds=4, fds=0x5620b4ff9120, timeout=<optimized out>, context=0x5620b3f928f0) at ../../../glib/gmain.c:4346
#2  g_main_context_iterate (context=0x5620b3f928f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4042
#3  0x00007f39e5957c2a in g_main_loop_run (loop=0x5620b3f95040) at ../../../glib/gmain.c:4241
#4  0x00007f39e5ba0d96 in gdbus_shared_thread_func (user_data=0x5620b3f93fb0) at ../../../gio/gdbusprivate.c:279
#5  0x00007f39e5980afd in g_thread_proxy (data=0x5620b3f8aaa0) at ../../../glib/gthread.c:807
#6  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#7  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 2 (Thread 0x7f39cd0a5700 (LWP 1141)):
#0  0x00007f39e158b819 in __GI___poll (fds=0x5620b3f49730, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f39e59578d6 in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x5620b3f49730, timeout=<optimized out>, context=0x5620b3f72460) at ../../../glib/gmain.c:4346
#2  g_main_context_iterate (context=context@entry=0x5620b3f72460, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4042
#3  0x00007f39e59579fc in g_main_context_iteration (context=0x5620b3f72460, may_block=may_block@entry=1) at ../../../glib/gmain.c:4108
#4  0x00007f39e5957a41 in glib_worker_main (data=<optimized out>) at ../../../glib/gmain.c:5996
#5  0x00007f39e5980afd in g_thread_proxy (data=0x5620b3f5f1e0) at ../../../glib/gthread.c:807
#6  0x00007f39e1667fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#7  0x00007f39e15964cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
--Type <RET> for more, q to quit, c to continue without paging--

Thread 1 (Thread 0x7f39da360d00 (LWP 1130)):
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f39e14bf535 in __GI_abort () at abort.c:79
#2  0x00007f39e1516508 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f39e162128d "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007f39e151cc1a in malloc_printerr (str=str@entry=0x7f39e161f43b "free(): invalid pointer") at malloc.c:5341
#4  0x00007f39e1520b3e in free_check (mem=<optimized out>, caller=<optimized out>) at hooks.c:254
#5  0x00007f397efc2500 in pw_proxy_destroy (proxy=0x5620b61f2920) at ../src/pipewire/proxy.c:259
#6  0x00007f397f03407f in gst_pipewire_device_provider_stop (provider=<optimized out>) at ../src/gst/gstpipewiredeviceprovider.c:664
#7  0x00007f39dfd3ecee in gst_device_provider_stop (provider=0x5620b3f7ac70) at gstdeviceprovider.c:491
#8  0x00007f39dfd3d55a in gst_device_monitor_stop (monitor=0x5620b4ffc860) at gstdevicemonitor.c:571
#9  0x00007f39e1742e0b in ?? () from /lib/x86_64-linux-gnu/libcheese.so.8
#10 0x00007f39e5a460bd in g_object_unref (_object=<optimized out>) at ../../../gobject/gobject.c:3499
#11 g_object_unref (_object=0x5620b45ad930) at ../../../gobject/gobject.c:3391
#12 0x00005620b1e19d61 in um_photo_dialog_dispose (object=0x5620b6100220) at ../gnome-initial-setup/pages/account/um-photo-dialog.c:443
#13 0x00007f39e5a46043 in g_object_unref (_object=<optimized out>) at ../../../gobject/gobject.c:3461
#14 g_object_unref (_object=0x5620b6100220) at ../../../gobject/gobject.c:3391
#15 0x00007f39e5943b9f in g_hash_table_remove_all_nodes (hash_table=hash_table@entry=0x5620b61062a0, notify=notify@entry=1, destruction=destruction@entry=1) at ../../../glib/ghash.c:703
#16 0x00007f39e5944f7f in g_hash_table_remove_all_nodes (destruction=1, notify=1, hash_table=0x5620b61062a0) at ../../../glib/ghash.c:1461
#17 g_hash_table_unref (hash_table=0x5620b61062a0) at ../../../glib/ghash.c:1461
#18 0x00007f39e59380bf in g_datalist_clear (datalist=<optimized out>) at ../../../glib/gdataset.c:273
#19 0x00007f39e5a460bd in g_object_unref (_object=<optimized out>) at ../../../gobject/gobject.c:3499
#20 g_object_unref (_object=0x5620b4fcfce0) at ../../../gobject/gobject.c:3391
#21 0x00007f39e5943bb2 in g_hash_table_remove_all_nodes (hash_table=hash_table@entry=0x5620b60f59e0, notify=notify@entry=1, destruction=destruction@entry=0) at ../../../glib/ghash.c:706
#22 0x00007f39e59457f8 in g_hash_table_remove_all_nodes (destruction=0, notify=1, hash_table=0x5620b60f59e0) at ../../../glib/ghash.c:1883
#23 g_hash_table_remove_all (hash_table=0x5620b60f59e0) at ../../../glib/ghash.c:1883
#24 0x00007f39e594583e in g_hash_table_destroy (hash_table=0x5620b60f59e0) at ../../../glib/ghash.c:1486
#25 0x00007f39e5943bb2 in g_hash_table_remove_all_nodes (hash_table=hash_table@entry=0x5620b60f5980, notify=notify@entry=1, destruction=destruction@entry=0) at ../../../glib/ghash.c:706
#26 0x00007f39e59457f8 in g_hash_table_remove_all_nodes (destruction=0, notify=1, hash_table=0x5620b60f5980) at ../../../glib/ghash.c:1883
#27 g_hash_table_remove_all (hash_table=0x5620b60f5980) at ../../../glib/ghash.c:1883
#28 0x00007f39e594583e in g_hash_table_destroy (hash_table=0x5620b60f5980) at ../../../glib/ghash.c:1486
#29 0x00007f39e5494145 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#30 0x00007f39e5a40ec1 in g_closure_invoke (closure=0x5620b3fcc530, return_value=0x0, n_param_values=1, param_values=0x7ffd1d762eb0, invocation_hint=0x7ffd1d762e30) at ../../../gobject/gclosure.c:810
#31 0x00007f39e5a54c47 in signal_emit_unlocked_R (node=node@entry=0x5620b3fcc070, detail=detail@entry=0, instance=instance@entry=0x5620b3f6a5d0, emission_return=emission_return@entry=0x0, 
    instance_and_params=instance_and_params@entry=0x7ffd1d762eb0) at ../../../gobject/gsignal.c:3858
#32 0x00007f39e5a5ec73 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffd1d763060) at ../../../gobject/gsignal.c:3498
#33 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#34 0x00007f39e549c20c in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#35 0x00007f39e5a47898 in g_object_run_dispose (object=0x5620b3f6a5d0) at ../../../gobject/gobject.c:1226
#36 0x00007f39e53f33b0 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#37 0x00007f39e52868a6 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#38 0x00007f39e5a40ec1 in g_closure_invoke (closure=0x5620b3fcc530, return_value=0x0, n_param_values=1, param_values=0x7ffd1d763370, invocation_hint=0x7ffd1d7632f0) at ../../../gobject/gclosure.c:810
#39 0x00007f39e5a54c47 in signal_emit_unlocked_R (node=node@entry=0x5620b3fcc070, detail=detail@entry=0, instance=instance@entry=0x5620b3f5df20, emission_return=emission_return@entry=0x0, 
    instance_and_params=instance_and_params@entry=0x7ffd1d763370) at ../../../gobject/gsignal.c:3858
#40 0x00007f39e5a5ec73 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffd1d763520) at ../../../gobject/gsignal.c:3498
#41 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#42 0x00007f39e549c20c in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#43 0x00007f39e5a47898 in g_object_run_dispose (object=0x5620b3f5df20) at ../../../gobject/gobject.c:1226
#44 0x00007f39e523b8f0 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#45 0x00007f39e52868a6 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#46 0x00007f39e5a40ec1 in g_closure_invoke (closure=0x5620b3fcc530, return_value=0x0, n_param_values=1, param_values=0x7ffd1d763840, invocation_hint=0x7ffd1d7637c0) at ../../../gobject/gclosure.c:810
#47 0x00007f39e5a54c47 in signal_emit_unlocked_R (node=node@entry=0x5620b3fcc070, detail=detail@entry=0, instance=instance@entry=0x5620b609ccd0, emission_return=emission_return@entry=0x0, 
    instance_and_params=instance_and_params@entry=0x7ffd1d763840) at ../../../gobject/gsignal.c:3858
#48 0x00007f39e5a5ec73 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffd1d7639f0) at ../../../gobject/gsignal.c:3498
#49 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#50 0x00007f39e549c20c in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
--Type <RET> for more, q to quit, c to continue without paging--
#51 0x00007f39e5a47898 in g_object_run_dispose (object=0x5620b609ccd0) at ../../../gobject/gobject.c:1226
#52 0x00007f39e52868a6 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#53 0x00007f39e5a40fad in g_closure_invoke (closure=0x5620b3fcc530, return_value=0x0, n_param_values=1, param_values=0x7ffd1d763ce0, invocation_hint=0x7ffd1d763c60) at ../../../gobject/gclosure.c:810
#54 0x00007f39e5a54c47 in signal_emit_unlocked_R (node=node@entry=0x5620b3fcc070, detail=detail@entry=0, instance=instance@entry=0x5620b4fcfb10, emission_return=emission_return@entry=0x0, 
    instance_and_params=instance_and_params@entry=0x7ffd1d763ce0) at ../../../gobject/gsignal.c:3858
#55 0x00007f39e5a5ec73 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffd1d763e90) at ../../../gobject/gsignal.c:3498
#56 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#57 0x00007f39e549c20c in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#58 0x00007f39e5a47898 in g_object_run_dispose (object=0x5620b4fcfb10) at ../../../gobject/gobject.c:1226
#59 0x00005620b1e33c4a in destroy_pages_after (page=0x5620b3f5d790, assistant=<optimized out>) at ../gnome-initial-setup/gnome-initial-setup.c:187
#60 rebuild_pages_cb (driver=0x5620b3f5d200) at ../gnome-initial-setup/gnome-initial-setup.c:209
#61 0x00007f39e5a411e6 in _g_closure_invoke_va (closure=0x5620b45ae9e0, return_value=0x0, instance=0x5620b3f5d200, args=0x7ffd1d764220, n_params=0, param_types=0x0) at ../../../gobject/gclosure.c:873
#62 0x00007f39e5a5f0f0 in g_signal_emit_valist (instance=0x5620b3f5d200, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffd1d764220) at ../../../gobject/gsignal.c:3407
#63 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=detail@entry=0) at ../../../gobject/gsignal.c:3554
#64 0x00005620b1e374a0 in rebuild_pages (driver=driver@entry=0x5620b3f5d200) at ../gnome-initial-setup/gis-driver.c:323
#65 0x00005620b1e374c7 in gis_driver_real_locale_changed (driver=0x5620b3f5d200) at ../gnome-initial-setup/gis-driver.c:342
#66 0x00007f39e5a411e6 in _g_closure_invoke_va (closure=0x5620b3f5a360, return_value=0x0, instance=0x5620b3f5d200, args=0x7ffd1d764540, n_params=0, param_types=0x0) at ../../../gobject/gclosure.c:873
#67 0x00007f39e5a5f0f0 in g_signal_emit_valist (instance=0x5620b3f5d200, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffd1d764540) at ../../../gobject/gsignal.c:3407
#68 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=detail@entry=0) at ../../../gobject/gsignal.c:3554
#69 0x00005620b1e381d2 in gis_driver_locale_changed (driver=0x5620b3f5d200) at ../gnome-initial-setup/gis-driver.c:377
#70 gis_driver_set_user_language (driver=driver@entry=0x5620b3f5d200, lang_id=<optimized out>, update_locale=update_locale@entry=1) at ../gnome-initial-setup/gis-driver.c:377
#71 0x00005620b1e20f6f in language_changed (chooser=<optimized out>, pspec=<optimized out>, page=0x5620b3f5d790) at ../gnome-initial-setup/pages/language/gis-language-page.c:203
#72 0x00007f39e5a40fad in g_closure_invoke (closure=0x5620b46a3780, return_value=0x0, n_param_values=2, param_values=0x7ffd1d764800, invocation_hint=0x7ffd1d764780) at ../../../gobject/gclosure.c:810
#73 0x00007f39e5a54935 in signal_emit_unlocked_R (node=node@entry=0x5620b3f55600, detail=detail@entry=3294, instance=instance@entry=0x5620b4bd51d0, emission_return=emission_return@entry=0x0, 
    instance_and_params=instance_and_params@entry=0x7ffd1d764800) at ../../../gobject/gsignal.c:3742
#74 0x00007f39e5a5ec73 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffd1d7649d0) at ../../../gobject/gsignal.c:3498
#75 0x00007f39e5a5f6cf in g_signal_emit (instance=instance@entry=0x5620b4bd51d0, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#76 0x00007f39e5a45644 in g_object_dispatch_properties_changed (object=0x5620b4bd51d0, n_pspecs=<optimized out>, pspecs=<optimized out>) at ../../../gobject/gobject.c:1206
#77 0x00007f39e5a47bc1 in g_object_notify_by_spec_internal (pspec=<optimized out>, object=0x5620b4bd51d0) at ../../../gobject/gobject.c:1299
#78 g_object_notify_by_pspec (object=0x5620b4bd51d0, pspec=<optimized out>) at ../../../gobject/gobject.c:1409
#79 0x00007f39e5a4431f in g_cclosure_marshal_VOID__OBJECTv (closure=0x5620b4c42120, return_value=<optimized out>, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, 
    param_types=0x5620b4bd4880) at ../../../gobject/gmarshal.c:1910
#80 0x00007f39e5a411e6 in _g_closure_invoke_va (closure=0x5620b4c42120, return_value=0x0, instance=0x5620b4c203a0, args=0x7ffd1d764d80, n_params=1, param_types=0x5620b4bd4880) at ../../../gobject/gclosure.c:873
#81 0x00007f39e5a5f0f0 in g_signal_emit_valist (instance=0x5620b4c203a0, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffd1d764d80) at ../../../gobject/gsignal.c:3407
#82 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#83 0x00007f39e534d9b0 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#84 0x00007f39e54ecd8d in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#85 0x00007f39e5a411e6 in _g_closure_invoke_va (closure=0x5620b4c22d40, return_value=0x0, instance=0x5620b45e8d30, args=0x7ffd1d7650f0, n_params=3, param_types=0x5620b45d40f0) at ../../../gobject/gclosure.c:873
#86 0x00007f39e5a5f0f0 in g_signal_emit_valist (instance=0x5620b45e8d30, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffd1d7650f0) at ../../../gobject/gsignal.c:3407
#87 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#88 0x00007f39e530c494 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#89 0x00007f39e5a44022 in g_cclosure_marshal_VOID__BOXEDv (closure=0x5620b45d2d80, return_value=<optimized out>, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, 
    param_types=0x5620b45d2db0) at ../../../gobject/gmarshal.c:1686
#90 0x00007f39e5a411e6 in _g_closure_invoke_va (closure=0x5620b45d2d80, return_value=0x0, instance=0x5620b45e8d30, args=0x7ffd1d7654a0, n_params=1, param_types=0x5620b45d2db0) at ../../../gobject/gclosure.c:873
#91 0x00007f39e5a5f0f0 in g_signal_emit_valist (instance=0x5620b45e8d30, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffd1d7654a0) at ../../../gobject/gsignal.c:3407
#92 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#93 0x00007f39e53095b2 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#94 0x00007f39e530abbb in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#95 0x00007f39e530da66 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#96 0x00007f39e52d5e6c in gtk_event_controller_handle_event () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#97 0x00007f39e5490f0b in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#98 0x00007f39e54e6b14 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#99 0x00007f39e5a411e6 in _g_closure_invoke_va (closure=0x5620b3fd4dc0, return_value=0x7ffd1d765840, instance=0x5620b4c203a0, args=0x7ffd1d765910, n_params=1, param_types=0x5620b3fd4f30) at ../../../gobject/gclosure.c:873
#100 0x00007f39e5a5e473 in g_signal_emit_valist (instance=0x5620b4c203a0, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffd1d765910) at ../../../gobject/gsignal.c:3407
#101 0x00007f39e5a5f6cf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3554
#102 0x00007f39e54925a4 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
--Type <RET> for more, q to quit, c to continue without paging--
#103 0x00007f39e53530a6 in ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#104 0x00007f39e53551cb in gtk_main_do_event () from /lib/x86_64-linux-gnu/libgtk-3.so.0
#105 0x00007f39e5051715 in ?? () from /lib/x86_64-linux-gnu/libgdk-3.so.0
#106 0x00007f39e50ae822 in ?? () from /lib/x86_64-linux-gnu/libgdk-3.so.0
#107 0x00007f39e59576cd in g_main_dispatch (context=0x5620b3f74020) at ../../../glib/gmain.c:3309
#108 g_main_context_dispatch (context=context@entry=0x5620b3f74020) at ../../../glib/gmain.c:3974
#109 0x00007f39e5957968 in g_main_context_iterate (context=context@entry=0x5620b3f74020, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4047
#110 0x00007f39e59579fc in g_main_context_iteration (context=context@entry=0x5620b3f74020, may_block=may_block@entry=1) at ../../../glib/gmain.c:4108
#111 0x00007f39e5b6641d in g_application_run (application=0x5620b3f5d200, argc=<optimized out>, argv=0x7ffd1d765e28) at ../../../gio/gapplication.c:2559
#112 0x00005620b1e022ff in main (argc=<optimized out>, argv=<optimized out>) at ../gnome-initial-setup/gnome-initial-setup.c:361
(gdb) 
(gdb) frame 6
#6  0x00007f397f03407f in gst_pipewire_device_provider_stop (provider=<optimized out>) at ../src/gst/gstpipewiredeviceprovider.c:664
664	../src/gst/gstpipewiredeviceprovider.c: No such file or directory.
(gdb) print self->registry
$1 = (struct pw_registry *) 0x5620b61f2920
(gdb) print *$1
$2 = <incomplete type>
(gdb) print *self
$3 = {parent = {parent = {object = {g_type_instance = {g_class = 0x5620b612db00}, ref_count = 3, qdata = 0x0}, lock = {p = 0x0, i = {0, 0}}, name = 0x5620b6149ca0 "pipewiredeviceprovider0", parent = 0x0, flags = 0, 
      control_bindings = 0x0, control_rate = 100000000, last_sync = 18446744073709551615, _gst_reserved = 0x0}, devices = 0x5620b41eb8c0, priv = 0x5620b3f7ac50, _gst_reserved = {0x0, 0x0, 0x0, 0x0}}, 
  client_name = 0x5620b612df10 "pool-gnome-init", loop = 0x5620b610ddc0, context = 0x5620b610e870, core = 0x5620b61df860, pending = {next = 0x5620b3f7ad18, prev = 0x5620b3f7ad18}, seq = 1073741837, registry = 0x5620b61f2920, error = 0, 
  end = 1, list_only = 0, devices = 0x0}
(gdb) print self->core
$4 = (struct pw_core *) 0x5620b61df860
(gdb) print *$4
$5 = {proxy = {impl = {type = 0x7f397e67f922 "PipeWire:Interface:Core", version = 3, cb = {funcs = 0x7f397e68a9c0, data = 0x5620b61df860}}, core = 0x5620b61df860, id = 0, type = 0x7f397e67f922 "PipeWire:Interface:Core", version = 3, 
    bound_id = 4294967295, refcount = 1, zombie = 0, removed = 0, destroyed = 0, in_map = 1, listener_list = {list = {next = 0x5620b61df938, prev = 0x5620b61df938}}, object_listener_list = {list = {next = 0x5620b61df908, 
        prev = 0x5620b610eb88}}, marshal = 0x7f397e68a820, user_data = 0x0}, context = 0x5620b610e870, link = {next = 0x5620b610e8f8, prev = 0x5620b610e8f8}, properties = 0x5620b61df9f0, pool = 0x5620b61e0200, core = 0x5620b61df860, 
  core_listener = {link = {next = 0x5620b610eb88, prev = 0x5620b61df8b8}, cb = {funcs = 0x7f397eff1f20 <core_events>, data = 0x5620b61df860}, removed = 0x0, priv = 0x0}, proxy_core_listener = {link = {next = 0x5620b61df8a8, 
      prev = 0x5620b61df8a8}, cb = {funcs = 0x7f397eff1ee0 <proxy_core_events>, data = 0x5620b61df860}, removed = 0x0, priv = 0x0}, objects = {items = {data = 0x5620b61e0490, size = 56, alloc = 512, extend = 32}, free_list = 5}, 
  client = 0x5620b61f2890, stream_list = {next = 0x5620b61df998, prev = 0x5620b61df998}, filter_list = {next = 0x5620b61df9a8, prev = 0x5620b61df9a8}, conn = 0x5620b61e06a0, recv_seq = 56, send_seq = 1073741838, removed = 0, 
  destroyed = 0, user_data = 0x0}
(gdb) frame 5
#5  0x00007f397efc2500 in pw_proxy_destroy (proxy=0x5620b61f2920) at ../src/pipewire/proxy.c:259
259	../src/pipewire/proxy.c: No such file or directory.
(gdb) print *proxy
$6 = {impl = {type = 0x5620b61f97f0 "\017", version = 3781528736, cb = {funcs = 0x7f397e68a800, data = 0x5620b61f2920}}, core = 0x5620b61df860, id = 2, type = 0x7f397e67f855 "PipeWire:Interface:Registry", version = 3, 
  bound_id = 4294967295, refcount = 0, zombie = 1, removed = 1, destroyed = 1, in_map = 0, listener_list = {list = {next = 0x5620b61f2968, prev = 0x5620b61f2968}}, object_listener_list = {list = {next = 0x5620b610ebc0, 
      prev = 0x5620b610ebc0}}, marshal = 0x7f397e68a740, user_data = 0x0}
(gdb) print proxy->core
$7 = (struct pw_core *) 0x5620b61df860
(gdb) print *$7
$8 = {proxy = {impl = {type = 0x7f397e67f922 "PipeWire:Interface:Core", version = 3, cb = {funcs = 0x7f397e68a9c0, data = 0x5620b61df860}}, core = 0x5620b61df860, id = 0, type = 0x7f397e67f922 "PipeWire:Interface:Core", version = 3, 
    bound_id = 4294967295, refcount = 1, zombie = 0, removed = 0, destroyed = 0, in_map = 1, listener_list = {list = {next = 0x5620b61df938, prev = 0x5620b61df938}}, object_listener_list = {list = {next = 0x5620b61df908, 
        prev = 0x5620b610eb88}}, marshal = 0x7f397e68a820, user_data = 0x0}, context = 0x5620b610e870, link = {next = 0x5620b610e8f8, prev = 0x5620b610e8f8}, properties = 0x5620b61df9f0, pool = 0x5620b61e0200, core = 0x5620b61df860, 
  core_listener = {link = {next = 0x5620b610eb88, prev = 0x5620b61df8b8}, cb = {funcs = 0x7f397eff1f20 <core_events>, data = 0x5620b61df860}, removed = 0x0, priv = 0x0}, proxy_core_listener = {link = {next = 0x5620b61df8a8, 
      prev = 0x5620b61df8a8}, cb = {funcs = 0x7f397eff1ee0 <proxy_core_events>, data = 0x5620b61df860}, removed = 0x0, priv = 0x0}, objects = {items = {data = 0x5620b61e0490, size = 56, alloc = 512, extend = 32}, free_list = 5}, 
  client = 0x5620b61f2890, stream_list = {next = 0x5620b61df998, prev = 0x5620b61df998}, filter_list = {next = 0x5620b61df9a8, prev = 0x5620b61df9a8}, conn = 0x5620b61e06a0, recv_seq = 56, send_seq = 1073741838, removed = 0, 
  destroyed = 0, user_data = 0x0}
(gdb) print proxy->core->removed
$9 = 0
(gdb) print proxy->core->objects
$10 = {items = {data = 0x5620b61e0490, size = 56, alloc = 512, extend = 32}, free_list = 5}

I can’t easily upgrade to 0.3.11, but none of the commits 0.3.10..0.3.11 look like they’d fix it, to the best of my understanding (which is minimal). I can reproduce this reliably, but setting up the VM to get debug data out is quite time consuming, so please ask all your questions at once if you can!