Public bug reported:
ENVIRONMENT
-----------
- Ubuntu 26.04 (resolute), kernel 7.0.0-38-generic
- gnome-shell 50.1-0ubuntu1.3, mutter 50.1-0ubuntu2.4 (libmutter-18-0)
- libglib2.0-0t64 2.88.0-1ubuntu0.1, libgjs0 1.88.0-1
- Wayland session, Intel Arc Graphics (Meteor Lake-P, 00:02.0 [8086:7d55], i915)
- Single internal panel eDP-1 2880x1920@120 with fractional scaling 1.6667; no
external monitors
- suspend via lid close, mem_sleep = s2idle
ACTUAL BEHAVIOUR
----------------
On wake, 1–20 s after PM: suspend exit, gnome-shell dies:
gnome-shell[4150628]: segfault at 36 ip 00007eb904ab2c89 sp 00007ffe664096d0
error 4
in libglib-2.0.so.0.8800.0[4bc89,7eb904a86000+a6000]
systemd[3801]: [email protected]: Main process exited,
code=dumped, status=11/SEGV
gnome-calendar[4154001]: Lost connection to Wayland compositor.
The session ends and gdm shows the login screen; every running
application is terminated.
FREQUENCY
---------
9 crashes in 32 resumes between 2026-10-23 and 2026-10-29 (~28 %). All 9 within
20 s of
PM: suspend exit; zero crashes at any other time.
EXPECTED BEHAVIOUR
------------------
Session survives resume; clients keep running.
STACK (GDB ATTACHED TO THE LIVE COMPOSITOR, CAUGHT BEFORE THE PROCESS DIED)
---------------------------------------------------------------------------
#0 0x00005632b6cd3860 in ??? ()
#1 g_hash_table_remove ()
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#2 ???
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#3 ???
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#4 ???
/usr/lib/x86_64-linux-gnu/libmutter-18.so.0
#5 g_object_unref ()
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#6 g_list_foreach ()
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#7 g_list_free_full ()
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#8 ???
/usr/lib/x86_64-linux-gnu/libmutter-18.so.0
#9 ???
/usr/lib/x86_64-linux-gnu/libmutter-18.so.0
#10 ???
/usr/lib/x86_64-linux-gnu/libmutter-18.so.0
#11 cogl_onscreen_swap_buffers_with_damage ()
/usr/lib/x86_64-linux-gnu/mutter-18/libmutter-cogl-18.so.0
#12 ???
/usr/lib/x86_64-linux-gnu/libmutter-18.so.0
#13 ???
/usr/lib/x86_64-linux-gnu/libmutter-18.so.0
#14 ???
/usr/lib/x86_64-linux-gnu/mutter-18/libmutter-clutter-18.so.0
#15 clutter_frame_clock_dispatch ()
/usr/lib/x86_64-linux-gnu/mutter-18/libmutter-clutter-18.so.0
#16 ???
/usr/lib/x86_64-linux-gnu/mutter-18/libmutter-clutter-18.so.0
Read bottom-up: during swap_buffers_with_damage mutter goes through a list of
frames
(g_list_free_full → g_object_unref → object finalize → signal emission) and
ends up in
g_hash_table_remove() with a corrupted hash function pointer (call *0x30(%r15)
with r15 = 6,
fault at address 0x36). Other crashes of the same period show instruction fetch
from garbage
addresses (error 14/15), i.e. the object bookkeeping of MetaFrameNative (or its
signal handlers)
is corrupted — a double free / use-after-free rather than a logic error in GLib.
ADDITIONAL OBSERVATIONS
-----------------------
1. During the same boot, i915 rejected direct-scanout atomic commits thousands
of times:
Direct scanout page flip failed: drmModeAtomicCommit: Invalid argument —
5396 lines.
2. Setting MUTTER_DEBUG_PAINT=disable-direct-scanout made the crashes disappear:
14 resumes across 4 reboots, 0 crashes, and the atomic-commit failures went
to zero
(p ≤ 0.01 against the 28 % base rate). Caveat: on the same day 133 GB of
build artifacts were
deleted and swap grew from 8 to 16 GiB, so the improvement is not fully
attributed.
A 60-second-window correlation between the scanout failures and the crashes
was *not* found
(0/9 crashes had one vs 3/23 clean resumes), so the link needs upstream
analysis rather than
being claimed.
3. meta_frame_native_release: assertion '!frame_native->kms_update' failed is
logged 400+ times
per boot, 407 of 417 on **suspend entry** and only 10 on resume; it does not
correlate with the
crashes (25 % crash rate with it, 30 % without), so it is likely unrelated
or only a symptom of
the same suspend-time frame handling.
STEPS TO REPRODUCE
------------------
1. Plain Ubuntu 26.04 Wayland session on Intel Arc MTS, s2idle suspend.
2. Close/open the lid repeatedly.
3. Roughly one wakeup in three ends with the login screen (session gone).
To capture the stack (does not need symbols): sudo sysctl -w
kernel.yama.ptrace_scope=0, attach
gdb -p $(pgrep -f 'gnome-shell --mode=ubuntu') with handle SIGSEGV stop,
continue; the trace
is printed before the process dies.
ATTACHMENTS THAT WOULD HELP / NOTES
-----------------------------------
- apport produced a _usr_bin_gnome-shell.1000.crash (88 MB) but the embedded
core is corrupt:
the gzip payload has a valid header (CoreDump) and a broken deflate stream
(invalid stored block lengths) — reproduced twice, so attaching it is
pointless; the gdb trace
above was captured live instead.
- journalctl -b -1 around the crash contains the segfault at 36 … in
libglib-2.0.so.0
line and the service failure.
** Affects: mutter (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173026
Title:
gnome-shell segfaults on resume from suspend: SIGSEGV in
g_hash_table_remove() via cogl_onscreen_swap_buffers_with_damage(),
whole session is lost
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2173026/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
