https://bugs.kde.org/show_bug.cgi?id=527886
Bug ID: 527886
Summary: kwin_wayland crashes with SIGSEGV (null-pointer jump)
inside Mesa's shader compiler on any
first-use-per-session shader compile
Classification: Plasma
Product: kwin
Version First 6.7.3
Reported In:
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: compositing
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
DESCRIPTION
This bug report was written with the assistance of Claude Code:
kwin_wayland reliably crashes with a SIGSEGV at a null function pointer (ip
0000000000000000) while compiling an OpenGL/GLSL shader via
KWin::GLShader::compile(), which dies inside Mesa's gallium driver
(libgallium-26.1.2.so). This has been observed through three structurally
different call paths, all bottoming out in the identical crash site:
KWin::EffectTogglableState::toggle() → KWin::QuickSceneEffect::startInternal()
→ addScreen() → fresh OffscreenQuickView/QOpenGLContext::create() →
EglContext::checkSupported() → ShaderManager::shader() →
GLShader::load/compile() (triggered by the Overview effect's first activation
in a session).
KWin::TabBox::TabBox::show() → QML scene-graph render →
QSGBatchRenderer::Renderer::ensurePipelineState() → same Mesa driver crash
(triggered by the Alt+Tab task switcher's first activation).
KWin::Compositor::composite() → WorkspaceScene::paint() →
EffectsHandler::paintWindow() (×3, through the effect chain) →
WorkspaceScene::finalDrawWindow() → ItemRendererOpenGL::renderItem() →
ShaderManager::pushShader() → GLShader::load/compile() → same crash (triggered
during ordinary window compositing, no user input involved at all)
This strongly suggests the actual defect is in Mesa's shader compiler itself
(or possibly in KWin's error handling around a failed/null shader program), and
it can be hit by any KWin code path that requests a shader variant (ShaderTrait
combination) for the first time in a given kwin_wayland process lifetime — not
something specific to Overview or the task switcher, which were just the first
two paths we happened to test deliberately.
STEPS TO REPRODUCE
Any of the following, in a fresh kwin_wayland session:
Activate the Overview effect (default Meta+W) — crashes on first activation
most reliably when done shortly after a particular third-party Electron
application (Claude Desktop) has just launched, though we have also reproduced
it with that application completely absent after extended testing — see
"Trigger conditions" below.
Activate the Alt+Tab task switcher — same crash. Note: increasing the Task
Switcher's DelayTime (System Settings → Window Management → Task Switcher) from
its default to ~500-1000ms dramatically reduces (does not necessarily
eliminate) the reproduction rate, which may be a useful clue about the nature
of the underlying race.
Simply use the desktop normally with certain applications open — the crash has
also been captured during routine compositing with no user input at all (see
stack trace #3 above), ~15 minutes after any related application launch, which
rules out a simple "right after launch" timing window as the sole explanation.
#0 0x0000000000000000 n/a (n/a + 0x0)
#1-3 n/a (libgallium-26.1.2.so + ...)
#4 KWin::GLShader::compile(unsigned int, unsigned int, QByteArray const&)
(libkwin.so.6)
#5 KWin::GLShader::load(QByteArray const&, QByteArray const&) (libkwin.so.6)
#6 KWin::ShaderManager::generateCustomShader(QFlags<ShaderTrait>, QByteArray
const&, QByteArray const&) (libkwin.so.6)
#7 KWin::ShaderManager::generateShader(QFlags<ShaderTrait>) (libkwin.so.6)
#8 KWin::ShaderManager::shader(QFlags<ShaderTrait>) (libkwin.so.6)
#9 KWin::EglContext::checkSupported() const (libkwin.so.6)
#10 KWin::EglContext::create(KWin::EglDisplay*, void*, void*) (libkwin.so.6)
#13 QOpenGLContext::create() (libQt6Gui.so.6)
#14 KWin::OffscreenQuickView::OffscreenQuickView(...) (libkwin.so.6)
#15 KWin::QuickSceneView::QuickSceneView(KWin::QuickSceneEffect*,
KWin::Output*) (libkwin.so.6)
#19 QQmlComponent::create(...) (libQt6Qml.so.6)
#20 KWin::QuickSceneEffect::addScreen(KWin::Output*) (libkwin.so.6)
#21 KWin::QuickSceneEffect::startInternal() (libkwin.so.6)
#24
KWin::EffectTogglableState::statusChanged(KWin::EffectTogglableState::Status)
(libkwin.so.6)
#25 KWin::EffectTogglableState::toggle() (libkwin.so.6)
#27 QAction::activate(QAction::ActionEvent) (libQt6Gui.so.6)
#29-30 (libKF6GlobalAccel.so.6)
Case 2: Alt+Tab task switcher, first activation
#0 0x0000000000000000 n/a (n/a + 0x0)
#1-3 n/a (libgallium-26.1.2.so + ...)
#4-5 n/a (libQt6Gui.so.6 + ...)
#6 QSGBatchRenderer::Renderer::ensurePipelineState(...) (libQt6Quick.so.6)
#8 QSGBatchRenderer::Renderer::prepareRenderPass(...) (libQt6Quick.so.6)
#9 QSGBatchRenderer::Renderer::render() (libQt6Quick.so.6)
#11 QSGRhiLayer::grab() (libQt6Quick.so.6)
#12 QSGRhiLayer::updateTexture() (libQt6Quick.so.6)
#13 QSGBasicInternalImageNode::preprocess() (libQt6Quick.so.6)
#16 QQuickWindowPrivate::renderSceneGraph() (libQt6Quick.so.6)
#42 KWin::TabBox::TabBox::show() (libkwin.so.6)
#44 QTimer::timerEvent(QTimerEvent*) (libQt6Core.so.6)
Case 3: ordinary window compositing, no user input
#0 0x0000000000000000 n/a (n/a + 0x0)
#1-3 n/a (libgallium-26.1.2.so + ...)
#4 KWin::GLShader::compile(...) (libkwin.so.6)
#5 KWin::GLShader::load(...) (libkwin.so.6)
#6 KWin::ShaderManager::generateCustomShader(...) (libkwin.so.6)
#7 KWin::ShaderManager::generateShader(...) (libkwin.so.6)
#8 KWin::ShaderManager::shader(...) (libkwin.so.6)
#9 KWin::ShaderManager::pushShader(QFlags<ShaderTrait>) (libkwin.so.6)
#10 KWin::ItemRendererOpenGL::renderItem(...) (libkwin.so.6)
#11 KWin::WorkspaceScene::finalDrawWindow(...) (libkwin.so.6)
#12-15 KWin::EffectsHandler::drawWindow/paintWindow(...) [x4, walking effect
chain] (libkwin.so.6)
#16 KWin::WorkspaceScene::paintWindow(...) (libkwin.so.6)
#17 KWin::WorkspaceScene::paintSimpleScreen(...) (libkwin.so.6)
#18-19 KWin::EffectsHandler::paintScreen(...) (libkwin.so.6)
#20 KWin::WorkspaceScene::paint(...) (libkwin.so.6)
#22 KWin::Compositor::composite(KWin::RenderLoop*) (libkwin.so.6)
#24 KWin::RenderLoop::frameRequested(KWin::RenderLoop*) (libkwin.so.6)
Kernel-level signal in all cases:
kwin_wayland[PID]: segfault at 0 ip 0000000000000000 sp [...] error 14
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
Trigger conditions / what we've isolated so far
We spent considerable time trying to pin down exactly what makes this
reproducible, since the crash is clearly non-deterministic in the general case
but became highly reproducible under one specific condition:
Launching a particular third-party Electron-based application (Claude Desktop,
running inside a distrobox/podman container that shares the host's
Wayland/D-Bus session) and activating Overview or Alt+Tab within roughly the
first 1-2.5 minutes afterward crashed KWin in 7/7 and multiple further
attempts.
With that application fully absent (verified via process list), extensive
repeated testing — including with several other GPU-accelerated applications
and a game running simultaneously — produced zero crashes.
However, we also captured a crash (case 3 above) roughly 15 minutes after that
application's last launch, during ordinary compositing with no effect/shortcut
activated at all, and another full crash cycle at ~107 minutes after launch in
earlier testing. So presence-shortly-after-launch increases the odds enormously
but isn't the full story — there is no point at which the system is fully safe,
only less likely to crash.
We suspect this points to a timing/resource race in Mesa's shader compiler
triggered by two independent GPU clients (that application's own
Electron/Chromium GPU process, and KWin's compositor) both touching the
driver's shader-compile/pipeline-state machinery around the same time, but we
were not able to fully confirm the mechanism from outside Mesa's own internals.
A full writeup of this isolation testing (including ruling out external monitor
configuration, and comparing against other Electron apps which did not reliably
reproduce it) is available at anthropics/claude-code#104347, filed against the
third-party application in question, in case the specific trigger conditions
are useful context even though the crash itself is squarely inside KWin/Mesa.
Why we believe this belongs here rather than purely in Mesa
Claude's code never appears anywhere in any of the three stack traces above —
every single frame belongs to kwin_wayland, Qt, or libgallium. We're filing
against kwin rather than Mesa directly because (a) we're not certain whether
the actual defect is a Mesa shader-compiler bug or a KWin-side failure to
handle a null/failed shader program gracefully, and (b) KWin's own code is
what's segfaulting, not surviving a driver-side error. Happy to re-file against
Mesa/drm if that's judged to be the more appropriate project once someone's had
a chance to look at the actual crash site in libgallium.
OBSERVED RESULT
Kwin instability introduced by opening Claude.
EXPECTED RESULT
Kwin should not crash by having a program open and activating window management
hotkeys.
SOFTWARE/OS VERSIONS
Operating System (available in the Info Center app, or by running `kinfo` in a
terminal window):
KDE Plasma Version: Operating System: SteamOS 3.9.5 Build: 20261023.100
KDE Plasma Version: 6.7.3
KDE Frameworks Version: 6.28.0
Qt Version: 6.11.1
Kernel Version: 7.2.7-valve2-2-neptune-72-g31504582a073 (64-bit)
ADDITIONAL INFORMATION
--
You are receiving this mail because:
You are watching all bug changes.
