This crash is still present in noble-updates (mutter 46.2-1ubuntu0.24.04.18). Upstream fixed it in 46.3 (commit 8978f74c, mutter#3552, MR !3849). The Noble task is Triaged and has no patch yet, so I am attaching a debdiff for 46.2-1ubuntu0.24.04.19 that backports the fix.
The attached debdiff is against the published 46.2-1ubuntu0.24.04.18 source. It adds one patch, the unmodified gnome-46 cherry-pick, with DEP-3 headers. It applies with an offset only, no fuzz. The same change is on a branch for the Salsa packaging repository. [ Impact ] gnome-shell crashes with SIGSEGV in wl_resource_get_version(resource=NULL), called from committed_state_handle_highest_scale_monitor() when a client destroys a wl_surface (often an xdg_popup) while its scale state is still being applied. On Wayland the shell is the display server, so every open app is killed and the user is sent back to the login screen. Unsaved work is lost. Also seen on Zorin OS 18 (Noble base), MacBookPro11,4: the session ended on 2026-09-02 and 2026-09-23 with the same backtrace. [ Test Plan ] 1. Log in to a Wayland session on Noble with fractional scaling on. 2. Use apps that open and close popups quickly (scrub a video in Totem, open and close context menus). 3. Check https://errors.ubuntu.com/problem/fe092080e51d5bc7c80988a3ef5cfcd7f32ae6d1 and `coredumpctl list gnome-shell` for new crashes in committed_state_handle_highest_scale_monitor(). There is no reliable manual reproducer, so verification is that the crash signature stops appearing for the fixed version. [ Where problems could occur ] The change only adds an early return when surface->resource is NULL, which means the client already destroyed the surface. No scale event can be sent in that state anyway, and a committed state without a resource cannot have child sub-surfaces. A regression would show as a fractional- scale or preferred-buffer-scale event not being sent to a surface that no longer exists on the client side. [ What was checked ] The patched source builds. In the built libmutter-14.so.0 the function now starts with a NULL check on surface->resource (cmpq $0x0,0x18(%rdi), then an early return). I have not yet run it as a live session library, and I have not built the Ubuntu .19 package itself, only the same patch on the Zorin .18 source. Subscribing ubuntu-sponsors for upload review. ** Patch added: "debdiff: mutter 46.2-1ubuntu0.24.04.18 -> .19 (backport upstream 8978f74c)" https://bugs.launchpad.net/bugs/2129173/+attachment/6011243/+files/mutter_46.2-1ubuntu0.24.04.19.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2129173 Title: gnome-shell crashed with SIGSEGV in wl_resource_get_version(resource=NULL) from committed_state_handle_highest_scale_monitor() To manage notifications about this bug go to: https://bugs.launchpad.net/mutter/+bug/2129173/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
