Crash when removing a directory immediately after unmounting (via script)

Version information

thunar 4.20.6 (Xfce 4.20)

Manjaro

Steps to reproduce

  1. Mount a FUSE filesystem over a directory (unionfs-fuse, for example)
  2. Navigate to the parent directory (so the mount point is displayed)
  3. Run fusermount3 -u -- "$dir" && rmdir "$dir"

Current behavior

Thunar crashes: [1] 937570 segmentation fault (core dumped) thunar

Expected outcome

No crash, directory disappears from file list

Backtrace

#0  g_type_check_instance_is_fundamentally_a
    (type_instance=0x7f2e10001740, fundamental_type=0x50 [GObject]) at ../glib/gobject/gtype.c:3917
#1  0x00007f2e1baf6d50 in g_object_unref (_object=0x7f2e10001740) at ../glib/gobject/gobject.c:4743
#2  0x0000557b558a6935 in thunar_shortcut_free (shortcut=0x7f2e0808fa30, model=<optimized out>)
    at /usr/src/debug/thunar/thunar/thunar/thunar-shortcuts-model.c:1867
#3  0x0000557b558a7849 in thunar_shortcuts_model_remove_shortcut
    (shortcut=0x7f2e0808fa30, model=0x557b6d7c4c50 [ThunarShortcutsModel])
    at /usr/src/debug/thunar/thunar/thunar/thunar-shortcuts-model.c:1344
#8  0x00007f2e1bb07e44 in <emit signal 'device-removed' on instance 0x557b6d494bf0 [ThunarDeviceMonitor]> (instance=instance@entry=0x557b6d494bf0, signal_id=<optimized out>, detail=detail@entry=0)
    at ../glib/gobject/gsignal.c:3598
    #4  0x00007f2e1bae697c in g_closure_invoke
    (closure=0x557b6d7c8920, return_value=0x0, n_param_values=2, param_values=0x7ffca8bf61a0, invocation_hint=0x7ffca8bf60f0) at ../glib/gobject/gclosure.c:916
    #5  0x00007f2e1bb05aab in signal_emit_unlocked_R
    (node=node@entry=0x7ffca8bf62d0, detail=detail@entry=0, instance=instance@entry=0x557b6d494bf0, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffca8bf61a0) at ../glib/gobject/gsignal.c:3903
    #6  0x00007f2e1bb07b0f in signal_emit_valist_unlocked
    (instance=instance@entry=0x557b6d494bf0, signal_id=signal_id@entry=312, detail=detail@entry=0, var_args=var_args@entry=0x7ffca8bf6430) at ../glib/gobject/gsignal.c:3535
    #7  0x00007f2e1bb07d89 in g_signal_emit_valist
    (instance=0x557b6d494bf0, signal_id=312, detail=0, var_args=var_args@entry=0x7ffca8bf6430)
    at ../glib/gobject/gsignal.c:3278
#9  0x0000557b5586f85a in thunar_device_monitor_mount_removed
    (volume_monitor=<optimized out>, mount=0x557b6d9eee80, monitor=0x557b6d494bf0 [ThunarDeviceMonitor]) at /usr/src/debug/thunar/thunar/thunar/thunar-device-monitor.c:601
#13 0x00007f2e1bb0805f in <emit signal 'mount-removed or 0x7f2e1bca2853 "mount-removed"' on instance 0x557b6d43f7d0 [GUnionVolumeMonitor]>
--Type <RET> for more, q to quit, c to continue without paging--c
    (instance=0x557b6d43f7d0, detailed_signal=0x7f2e1bca2853 "mount-removed")
    at ../glib/gobject/gsignal.c:3639
    #10 0x00007f2e1bae697c in g_closure_invoke
    (closure=0x557b6d4b34f0, return_value=0x0, n_param_values=2, param_values=0x7ffca8bf6750, invocation_hint=0x7ffca8bf66a0) at ../glib/gobject/gclosure.c:916
    #11 0x00007f2e1bb05aab in signal_emit_unlocked_R
    (node=node@entry=0x7ffca8bf6880, detail=detail@entry=0, instance=instance@entry=0x557b6d43f7d0, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffca8bf6750) at ../glib/gobject/gsignal.c:3903
    #12 0x00007f2e1bb07b0f in signal_emit_valist_unlocked
    (instance=instance@entry=0x557b6d43f7d0, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffca8bf69d0) at ../glib/gobject/gsignal.c:3535
#17 0x00007f2e1bb0805f in <emit signal '0x7f2e1467c277 "mount-removed"' on instance 0x557b6d446d90 [GProxyVolumeMonitorUDisks2]>
    (instance=0x557b6d446d90, detailed_signal=0x7f2e1467c277 "mount-removed")
    at ../glib/gobject/gsignal.c:3639
    #14 0x00007f2e1bae550b in g_cclosure_marshal_VOID__OBJECTv
    (closure=<optimized out>, return_value=<optimized out>, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x557b6d43abf0)
    at ../glib/gobject/gmarshal.c:1910
    #15 0x00007f2e1bb07c77 in _g_closure_invoke_va
    (closure=0x7f2e08004ce0, return_value=0x0, instance=0x557b6d446d90, args=0x7ffca8bf6d90, n_params=1, param_types=0x557b6d43abf0) at ../glib/gobject/gclosure.c:980
    #16 signal_emit_valist_unlocked
    (instance=instance@entry=0x557b6d446d90, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffca8bf6d90) at ../glib/gobject/gsignal.c:3439
#18 0x00007f2e14676e68 in signal_emit_in_idle_do (data=0x557b6d8da880)
    at ../gvfs/monitor/proxy/gproxyshadowmount.c:546
#19 0x00007f2e1b9dbf8d in g_main_dispatch (context=0x557b6d367960) at ../glib/glib/gmain.c:3565
#20 0x00007f2e1b9dd657 in g_main_context_dispatch_unlocked (context=0x557b6d367960)
    at ../glib/glib/gmain.c:4425
#21 g_main_context_iterate_unlocked
    (context=context@entry=0x557b6d367960, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4490
#22 0x00007f2e1b9dd865 in g_main_context_iteration (context=0x557b6d367960, may_block=1)
    at ../glib/glib/gmain.c:4556
#23 0x00007f2e1bc187d6 in g_application_run () at /usr/lib/libgio-2.0.so.0
#24 0x0000557b5584f19c in main (argc=1, argv=0x7ffca8bf71e8)
    at /usr/src/debug/thunar/thunar/thunar/main.c:86

Additional information

  1. Crash doesn't happen if there is a pause between unmounting and directory being removed (like fusermount3 -u -- "$dir" && sleep 0.5 && rmdir "$dir").
  2. Rarely, a crash doesn't happen.
  3. Being inside the deleted directory does not cause a crash. Neither if the directory is not currently displayed.