Thanks, and fair point: when this was filed, the "upstream fix" rested on the NEWS line alone and no commit had been identified. It has been now:
https://gitlab.gnome.org/GNOME/at-spi2-core/-/commit/d442ee182ec8fa095c6bc5298a17663cfc70cf9a "atk-adaptor: Have the SpiCache keep its own weak ref" (Mike Gorse, first released in 2.55.2; it is the NEWS 2.55.2 entry "Attempt to fix a use after free in the atk bridge", and its message cites upstream #176 and #178). So THIS IS A REQUEST TO BACKPORT the fix to noble, which is still on 2.52.0. Resolute already ships it (2.60.0-1 has d442ee18 and c4ddb104). Upstream later fixed two problems in that change, so a backport would want all three: https://gitlab.gnome.org/GNOME/at-spi2-core/-/commit/c4ddb104fb25ba9b1f839cea28f280bb3a4146ba "atk-adaptor: Fix cleaning up the cache object's weak refs" (2.59.0, closes #213) https://gitlab.gnome.org/GNOME/at-spi2-core/-/commit/8db3f580bd024095ddd86981b07f975575992c5d "Avoid duplicate weak refs for cached objects" (2.61.0, closes #231) d442ee18 is on upstream gnome-48 and later, not gnome-46; resolute does not have 8db3f580 yet. All three apply cleanly, in order, to noble's 2.52.0-1build1 source with its two Ubuntu patches applied (2 files, +29/-9). --- Upstream #178 is this crash, symbolized: https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/178 g_type_check_instance_is_fundamentally_a <- g_object_ref <- g_hash_table_foreach <- spi_cache_foreach (accessible-cache.c:423) <- impl_GetItems (cache-adaptor.c:327) <- handle_other / handle_message (droute.c) <- dbus_connection_dispatch Daniel van Vugt closed it on 2026-06-30: "It appears this was fixed by d442ee182ec8fa095c6bc5298a17663cfc70cf9a and the Ubuntu crash reports seem to confirm it." (https://errors.ubuntu.com/problem/e9dbfbbbc04ccca9d8012dd11f60e810e033d7ac) Our trace maps onto that path on noble's own binary (libatk-bridge2.0-0t64 2.52.0-1build1, build-id d084b33aee91857655590d31ce1daecf276e02b3, md5 matches the package): #9 libatk-bridge+0x18ad7 returns from "call spi_cache_foreach" at +0x18ad2, the first of three consecutive spi_cache_foreach calls in impl_GetItems (the Cache.GetItems handler, cache-adaptor.c:327-329). Its arguments are the callback +0xf400 ("endbr64; jmp g_object_ref@plt", i.e. ref_accessible_hf) and data = NULL: the same call as frame #2 of #178 (func=ref_accessible_hf, user_data=0x0). #10 libatk-bridge+0x1c380 returns from an indirect "call *%r13", consistent with droute's handle_other calling the method handler (in #178, handle_message is inlined into that same frame; the noble binary is stripped). spi_cache_foreach (+0x10280) is "mov 0x18(%rdi),%rdi; jmp g_hash_table_foreach", a tail call, which is why it has no frame of its own. On which object: that cannot be recovered from the core. The key handed to g_object_ref (0x5ec00e640190, inside the heap) has 0x29719 as its first word, which is not a class pointer, so the hash-table key no longer pointed at a live GObject. What the trace does pin is the path: GetItems walking SpiCache's object table and reaching such a key, which is the dangling-pointer case d442ee18 addresses. Second occurrence on the same machine: 2026-10-08 22:47, the same named frames #6-#12, and no package change between the two crashes (gnome-shell 46.0-0ubuntu6~24.04.15, at-spi2-core 2.52.0-1build1). Both were Wayland sessions, and both times the shell crash ended the session. Our own AT-SPI client had no request in flight at the second crash. /Karsahsrv ** Bug watch added: gitlab.gnome.org/GNOME/at-spi2-core/-/issues #178 https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/178 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2169478 Title: gnome-shell SIGSEGV in atk-bridge (g_object_ref during g_hash_table_foreach) while dispatching AT-SPI D-Bus message — Wayland session ends; at-spi2-core 2.52.0 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/at-spi2-core/+bug/2169478/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
