Debdiff for Noble attached: mutter 46.2-1ubuntu0.24.04.18 ->
46.2-1ubuntu0.24.04.19.
It backports upstream commit 8978f74c ("wayland/surface: Can't send
scale events with NULL surface->resource", mutter#3552, MR !3849, in
46.3). Noble is still on 46.2 and still has the bug; the other series
are already Fix Released. The patch is the unmodified gnome-46 cherry-
pick with DEP-3 headers.
[ Impact ]
gnome-shell crashes with SIGSEGV in wl_resource_get_version(resource=NULL),
called from committed_state_handle_highest_scale_monitor(), when a client
destroys a wl_surface (often an xdg_popup) while its scale state is still being
applied. On a Wayland session the shell is the display server, so every open
app is killed and the user returns to the login screen. Reported here and in
the error tracker bucket above. I also hit it twice (2026-09-02 and 2026-09-23)
on a MacBookPro11,4 running a Noble-based distribution.
[ Test Plan ]
There is no reliable manual reproducer. Run a Wayland session with fractional
scaling, open and close popups quickly (context menus, video scrubbing in Totem
on a second window), and check `coredumpctl list gnome-shell` and the error
tracker bucket for new crashes in committed_state_handle_highest_scale_monitor.
[ Where problems could occur ]
The change adds one early return when surface->resource is NULL, i.e. after the
client already destroyed the surface. No scale event can be sent in that state
anyway, and the committed state of such a surface cannot have child
sub-surfaces. A regression would show up as a scale event not sent to a surface
that no longer exists on the client side.
[ Other Info ]
Upstream commit:
https://gitlab.gnome.org/GNOME/mutter/-/commit/8978f74c1e2199f061a07e10c593cb64fd904771
Upstream issue: https://gitlab.gnome.org/GNOME/mutter/-/issues/3552
I rebuilt libmutter-14 from the .18 source with this patch and confirmed in the
compiled code that committed_state_handle_highest_scale_monitor now starts with
a NULL check on surface->resource. Subscribing ubuntu-sponsors for sponsorship.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2129173
Title:
gnome-shell crashed with SIGSEGV in
wl_resource_get_version(resource=NULL) from
committed_state_handle_highest_scale_monitor()
To manage notifications about this bug go to:
https://bugs.launchpad.net/mutter/+bug/2129173/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
