Public bug reported:
gnome-shell (Wayland session) repeatedly crashes with SIGSEGV in
meta_compositor_sync_stack(). The crash ends the whole user session:
all applications are closed and unsaved work is lost.
The crash matches an upstream bug that was fixed in mutter 46.3, but the
fix is not in noble's mutter 46.2-1ubuntu0.24.04.x. Please consider
backporting it in an SRU.
== Environment ==
Ubuntu 24.04 (noble), amd64, GNOME on Wayland
gnome-shell 46.0-0ubuntu6~24.04.14 and ~24.04.15
libmutter-14-0 46.2-1ubuntu0.24.04.16
xwayland 2:23.2.6-1ubuntu0.8
Kernels 7.0.0-31, -34 and -38-generic (crashed on all three)
GPU Intel Tiger Lake (i915), internal eDP-1 + external HDMI-A-1
Extensions ubuntu-dock, ubuntu-appindicators. The crash also happened
with tiling-assistant and desktop-icons-ng disabled.
== Occurrences (identical signature every time) ==
2026-09-22 17:30, 2026-09-30 11:57, 2026-10-07 11:53, 2026-10-07 17:29
gnome-shell[4070]: segfault at 29e ip 00007399faee4935 sp 00007ffd7e7dbcd0
error 4 in libmutter-14.so.0.0.0[e4935,7399fae50000+167000]
== Backtrace ==
Symbolized with libmutter-14-0-dbgsym 46.2-1ubuntu0.24.04.16
(build-id 9e23feb34618e83d573bf082ab3964e525c91051, matches the
installed library):
#0 meta_compositor_sync_stack (stack=0x0, compositor=0x60f141b649a0)
at ../src/compositor/compositor.c:773
#1 meta_stack_tracker_sync_stack (tracker=0x60f141b57560)
at ../src/core/stack-tracker.c:1079
#2 stack_tracker_sync_stack_later (data=0x60f141b57560)
at ../src/core/stack-tracker.c:1089
#3 meta_later_invoke (later=0x60f146dd1ea0)
at ../src/compositor/meta-later.c:122
#4 run_repaint_laters (laters_list=0x60f141b64e20)
at ../src/compositor/meta-later.c:168
#5 on_before_update (stage=0x60f141af7080, ...)
at ../src/compositor/meta-later.c:186
#6 _clutter_marshal_VOID__OBJECT_BOXEDv (...)
at clutter/clutter/clutter-marshal.c:1931
#7 g_signal_emit_valist / g_signal_emit (libgobject-2.0)
...
#11 meta_context_run_main_loop ()
compositor.c:773 is:
if ((old_window->hidden || old_window->unmanaging) &&
State at the time of the crash:
old_window = 0x0
old_actor = 0x60f1462cb2e0, a MetaWindowActorX11
(class vfuncs: meta_window_actor_x11_dispose, ...)
MetaWindowActorPrivate of old_actor:
window = 0x0, surface = 0x0, disposed = 1, needs_destroy = 1
The compositor's window list still holds an X11 (Xwayland) window actor
that has already been disposed. The next stack sync dereferences its
NULL MetaWindow (offset 0x29e is old_window->hidden).
== Upstream fix ==
This is the failure mode described in mutter MR !3732, "frame: Handle
reparent failure avoiding duplicate stack windows instances". A failed
frame reparent leaves a duplicate entry in the stack, so the window is
added to the compositor's list twice, and only one entry is removed when
the window is destroyed.
- main: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/3732
(merged 2024-05-27)
- gnome-46: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/3785
commit 24e6843ab7b9fff9fbba3956e421f5202e251050,
first released in mutter 46.3
The installed libmutter-14.so.0 (46.2-1ubuntu0.24.04.16) does not contain
this fix. The strings added by the fix ("Setting up frame for window %s
failed", "Failed to set %lu as %s frame", "Ignoring addition of %s as
per NO_RESTACK_X_WINDOWS") are not in the binary, while "Incrementing
unmaps_pending on %s for reparent", which exists both before and after
the fix, is present. The changelogs of 46.2-1ubuntu0.24.04.17 and .18 do
not mention it either.
== When it happens ==
Every crash happened while I was away from the desk, about 1-3 seconds
after the screen locked on idle (idle-delay 300, lock enabled, external
HDMI monitor). The timing is inferred from journal entries that are
logged at each screen lock on this machine.
X11 clients normally running on this machine:
- teams-for-linux (snap; its launcher forces --ozone-platform=x11)
- VS Code (snap, runs through Xwayland)
The screen locks several times a day, but only 4 locks in about three
weeks ended in a crash, which looks like a race. It cannot be reproduced
on demand.
== Additional information ==
The apport crash file (/var/crash/_usr_bin_gnome-shell.1000.crash) with
a core dump exists locally. I have not attached it because it contains a
full memory dump of the session. I can provide more details or run
additional commands on request.
** Affects: mutter (Ubuntu)
Importance: Undecided
Status: New
** Information type changed from Private Security to Public Security
** Information type changed from Public Security to Public
** Package changed: gnome-terminal (Ubuntu) => mutter (Ubuntu)
--
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to mutter in Ubuntu.
https://bugs.launchpad.net/bugs/2169912
Title:
gnome-shell crashed with SIGSEGV in meta_compositor_sync_stack() -
please backport mutter fix 24e6843a (46.3) to noble
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2169912/+subscriptions
--
desktop-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
