Additional data point: a full mutter-internal stack trace, recovered
from a retained core dump (Ubuntu 24.04, libmutter-14-0
46.2-1ubuntu0.24.04.16, gnome-shell 46.0-0ubuntu6~24.04.15, X11 session,
kernel 6.8.0-124, single DisplayPort monitor, no NVIDIA).
#5 meta_window_get_work_area_for_logical_monitor (window=...,
logical_monitor=NULL, area=...)
src/core/window.c:5957 <- g_assert
(logical_monitor)
#6 meta_window_get_work_area_current_monitor (window=..., area=...)
src/core/window.c:5992
#7 meta_window_unmaximize (directions=..., window=0x5d29e0fa90b0)
src/core/window.c:3243
#8 meta_window_unmaximize (window=0x5d29e0fa90b0, directions=...)
src/core/window.c:3215
#9 meta_window_x11_client_message (event=..., window=...)
src/x11/window-x11.c:3232
#10 handle_other_xevent (x11_display=..., event=...)
src/x11/events.c:1638
#11 meta_x11_display_handle_xevent (...)
src/x11/events.c:1930
#12 xevent_func (...)
src/x11/events.c:1969
#13 meta_x11_event_source_dispatch (...)
src/x11/meta-x11-event-source.c:62
#14 g_main_context_dispatch #16 g_main_loop_run #17 meta_context_run_main_loop
What the core says at the moment of the abort:
* window->monitor == NULL is the proximate cause, and
meta_window_get_work_area_current_monitor() passes it straight through
(meta_window_get_work_area_for_logical_monitor (window, window->monitor,
area)). I checked current upstream main (src/core/window.c:6316) - still no
NULL guard there either.
* It is NOT the unmanage path: window->workspace != NULL, window->mapped == 1,
window->unmanaging == 0. In meta_window_unmanage() the monitor is only cleared
after g_assert (window->workspace == NULL) (window.c:1516 -> 1535), so that
route is excluded here.
* The whole call path is inside mutter: no JS/extension frame is involved (the
gjs/mozjs frames sit below g_main_loop_run, i.e. they are just the main-loop
entry). So this is the "assertion still reachable after the 46.1 fix" case, not
the Tiling Assistant path.
* Trigger input is an ordinary X11 client message: _NET_WM_STATE requesting
un-maximize for a window whose window->monitor is NULL
(window-x11.c:3222-3235). The offending window belongs to an Electron/CEF app
(Xiaomi miWork, title "帧负载调频测试---性能 - 小米办公Pr"); the sender itself cannot be
identified, since X11 ClientMessages carry no sender identity.
* Not memory related: VmRSS 185 MB, VmHWM 409 MB at abort time; no kernel OOM
around it.
* Recurred 4 times within 3 weeks on this machine (2026-09-29 10:08, 09-30
10:13, 10-02 10:33, 10-14 08:15). The failing line moved 5937 -> 5957 after
46.2-1ubuntu0.24.04.16 was installed, i.e. that SRU did not address it. No
drm/DPMS/RandR events were logged near any of the crashes.
Suggestion: bail out gracefully when there is no logical monitor - e.g.
return early / fall back to the current or primary logical monitor in
meta_window_get_work_area_current_monitor(), and/or ignore _NET_WM_STATE
maximize/unmaximize requests for windows without a logical monitor. A
client WM state message should never be able to abort the compositor.
Reproducing the symbolization, in case it helps others
(debuginfod.ubuntu.com is unreachable from here and the ddebs pool only
keeps the newest build, but Launchpad keeps old dbgsym files):
curl -L -O
"https://launchpad.net/ubuntu/+archive/primary/+files/libmutter-14-0-dbgsym_46.2-1ubuntu0.24.04.16_amd64.ddeb";
apport-unpack /var/crash/_usr_bin_gnome-shell.1000.crash /tmp/gs/
dpkg -x libmutter-14-0-dbgsym_*.ddeb /tmp/dbg/
gdb -batch -q -iex "set debug-file-directory /tmp/dbg/usr/lib/debug" -ex "bt
20" -ex "frame 8" -ex "p window->monitor" /usr/bin/gnome-shell /tmp/gs/CoreDump
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2097003
Title:
gnome-shell crashed with SIGABRT
[libmutter:ERROR:../src/core/window.c:5937:meta_window_get_work_area_for_logical_monitor:
assertion failed: (logical_monitor)]
To manage notifications about this bug go to:
https://bugs.launchpad.net/gnome-shell/+bug/2097003/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
