Public bug reported:
## Environment
- DistroRelease: Ubuntu 26.10 (Linux probook 7.3.0-9-generic #9-Ubuntu SMP
PREEMPT_DYNAMIC Mon Oct 5 10:38:02 UTC 2026 x86_64 GNU/Linux)
- GNOME Shell 51.0 (`gnome-shell --mode=ubuntu`), mutter 51.0, Wayland session
- Crash signal: SIGSEGV (11); apport dump:
/var/crash/_usr_bin_gnome-shell.1000.crash (2026-10-17 16:37)
- Input method: IBus (default), Chinese input via ibus-libpinyin
- Enabled extensions: ubuntu-dock, ubuntu-appindicators, tiling-assistant,
ding, myna-shell, snapd-prompting, snapd-search-provider, web-search-provider
## Steps to reproduce
1. Log in to a normal GNOME session with IBus running.
2. Type using the Chinese input method in any application (e.g. Firefox).
3. After a while the whole graphical session crashes and the user is dropped
back to the GDM login screen.
## Log evidence
Before each crash gnome-shell emits a large number of repeated messages
(up to several thousand per boot):
```
gnome-shell[139929]: Object 0x... of type IBusAttrList has been finalized
while it was still owned by gjs, this is due to invalid memory management.
gnome-shell[139929]: g_object_unref: assertion 'G_IS_OBJECT (object)' failed
```
## Occurrences (multiple)
- 2026-10-17 16:37: crash with apport core dump produced (backtrace below)
- 2026-10-18 09:08:27: gnome-shell[3627] "GNOME Shell crashed with signal 11";
immediately before (09:07:37) flooded with IBusAttrList/g_object_unref
warnings
- 2026-10-18 09:09:38: gnome-shell[41040] "GNOME Shell crashed with signal 11"
again, same warnings
- 2026-10-18 (current boot): 1266 IBusAttrList warnings accumulated
After the crash GDM automatically restarts the session, which appears to the
user as being kicked back to the login screen.
## Backtrace (extracted with gdb from the apport CoreDump, crashing
thread)
```
Program terminated with signal SIGSEGV
#0 __pthread_kill_implementation (pthread_kill.c:44)
#3 __GI_raise (sig=11)
#5 <signal handler called>
#6 g_type_check_instance_is_fundamentally_a () from libgobject-2.0.so.0
#7 g_object_unref () from libgobject-2.0.so.0
#8 0x000071b4a6f3f68f in ?? () from /usr/lib/x86_64-linux-gnu/libibus-1.0.so.5
#9 g_closure_invoke () from libgobject-2.0.so.0
```
## Analysis
The crash occurs inside a libibus GObject signal callback that calls
g_object_unref() on an already-freed / corrupted object. This is consistent with
the repeated "IBusAttrList finalized while it was still owned by gjs" messages:
the reference counting / lifetime management of IBusAttrList objects between the
gnome-shell GJS binding layer and libibus is incorrect. While typing, preedit
attribute lists are passed back and forth frequently, which eventually triggers
the SEGV.
Firefox is only the application being typed into; it is not the crashing
process. The crashing process is gnome-shell, and the same crash can be
triggered by typing with the Chinese input method in any application.
## Expected result
gnome-shell should not crash while typing; IBus object lifetime management on
the GJS side should be correct.
** Affects: gnome-shell (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171321
Title:
gnome-shell crashes (SIGSEGV) while typing: IBusAttrList finalized
while still owned by gjs, crash in g_object_unref from libibus signal
callback
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-shell/+bug/2171321/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
