Crash in meta_window_get_buffer_rect after switching workspace

[utf-4096]

What Happened?

I've recently been encountering occasional segfaults in gala after switching workspace using Meta+Arrow.

Steps to Reproduce

1. Switch workspace using Meta+Arrow
2. See entire session crash (sometimes)

Expected Behavior

No crash.

OS Version

8.x (Circe)

OS Architecture

amd64 (on most hardwares)

Session Type

Secure Session (Wayland, This is the default)

Software Version

Latest release (I have run all updates)

Log Output

(gdb) bt
#0  meta_window_get_buffer_rect (window=0x0, rect=0x7ffd4347b0c0) at ../src/core/window.c:4449
#1  0x0000751f054bc05f in meta_window_actor_sync_actor_geometry (self=0x5af3a9eb7e60, did_placement=did_placement@entry=0) at ../src/compositor/meta-window-actor.c:952
#2  0x0000751f054bc85e in meta_window_actor_after_effects (self=<optimized out>) at ../src/compositor/meta-window-actor.c:822
#3  0x0000751f054bca74 in meta_window_actor_effect_completed (event=META_PLUGIN_MAP, self=<optimized out>) at ../src/compositor/meta-window-actor.c:906
#4  0x00005af370a6720c in gala_window_manager_gala_animate_map_co.isra.0 (_data_=0x5af3a837d6a0) at src/gala.p/WindowManager.c:5531
#5  0x0000751f059327bb in g_task_return_now (task=0x5af3a83b6720) at ../../../gio/gtask.c:1361
#6  0x0000751f05936713 in g_task_return (type=<optimized out>, task=0x5af3a83b6720) at ../../../gio/gtask.c:1430
#7  g_task_return (task=0x5af3a83b6720, type=<optimized out>) at ../../../gio/gtask.c:1387
#8  0x0000751f05936c6b in g_task_return_pointer (task=<optimized out>, result=<optimized out>, result_destroy=<optimized out>) at ../../../gio/gtask.c:1872
#9  0x00005af370a63a88 in gala_transition_builder_run_co.isra.0 (_data_=0x5af3a83a4730) at src/gala.p/TransitionBuilder.c:384
#10 0x0000751f068e72fa in g_closure_invoke (closure=0x5af3ad8c7320, return_value=0x0, n_param_values=2, param_values=0x7ffd4347b3a0, invocation_hint=0x7ffd4347b2f0) at ../../../gobject/gclosure.c:834
#11 0x0000751f0691690c in signal_emit_unlocked_R.isra.0
    (node=node@entry=0x7ffd4347b490, detail=detail@entry=0, instance=instance@entry=0x5af3a83b6c50, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffd4347b3a0)
    at ../../../gobject/gsignal.c:3888
#12 0x0000751f06907591 in signal_emit_valist_unlocked (instance=instance@entry=0x5af3a83b6c50, signal_id=signal_id@entry=292, detail=detail@entry=0, var_args=var_args@entry=0x7ffd4347b600) at ../../../gobject/gsignal.c:3520
#13 0x0000751f069077c1 in g_signal_emit_valist (instance=0x5af3a83b6c50, signal_id=292, detail=0, var_args=var_args@entry=0x7ffd4347b600) at ../../../gobject/gsignal.c:3263
#14 0x0000751f06907883 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3583
#15 0x0000751f057112d5 in transition_closure_free (data=0x5af3a8475f70) at ../clutter/clutter/clutter-actor.c:16319
#16 0x0000751f067ca965 in iter_remove_or_steal (ri=0x7ffd4347b730, notify=<optimized out>) at ../../../glib/ghash.c:1179
#17 0x0000751f067ca9de in g_hash_table_iter_remove (iter=<optimized out>) at ../../../glib/ghash.c:1215
#18 0x0000751f056fd91a in _clutter_actor_stop_transitions (self=self@entry=0x5af3a9eb7e60) at ../clutter/clutter/clutter-actor.c:3867
#19 0x0000751f056fdc18 in clutter_actor_remove_child_internal (self=0x5af3a2c88190, child=0x5af3a9eb7e60, flags=REMOVE_CHILD_DEFAULT_FLAGS) at ../clutter/clutter/clutter-actor.c:3962
#20 0x0000751f056fa136 in clutter_actor_dispose (object=0x5af3a9eb7e60) at ../clutter/clutter/clutter-actor.c:5283
#21 0x0000751f068f66c4 in g_object_run_dispose (object=0x5af3a9eb7e60) at ../../../gobject/gobject.c:1839
#22 g_object_run_dispose (object=object@entry=0x5af3a9eb7e60) at ../../../gobject/gobject.c:1829
#23 0x0000751f056f9efe in clutter_actor_destroy (self=0x5af3a9eb7e60) at ../clutter/clutter/clutter-actor.c:7432
#24 clutter_actor_destroy (self=0x5af3a9eb7e60) at ../clutter/clutter/clutter-actor.c:7421
#25 0x0000751f054e6f08 in meta_compositor_remove_window (window=0x5af3a84bb1a0, compositor=<optimized out>) at ../src/compositor/compositor.c:434
#26 meta_window_unmanage (window=0x5af3a84bb1a0, timestamp=<optimized out>) at ../src/core/window.c:1436
#27 0x0000751f0555ea98 in meta_wayland_shell_surface_destroy_window (shell_surface=<optimized out>) at ../src/wayland/meta-wayland-shell-surface.c:312
#28 0x0000751f0556a878 in dismiss_popup (xdg_popup=0x5af3a84a8760) at ../src/wayland/meta-wayland-xdg-shell.c:591
#29 xdg_popup_destructor (resource=<optimized out>) at ../src/wayland/meta-wayland-xdg-shell.c:608
#30 0x0000751f056902b1 in destroy_resource (element=0x5af3a8484e70, data=data@entry=0x0, flags=0) at ../src/wayland-server.c:732
#31 0x0000751f0569222a in wl_resource_destroy (resource=<optimized out>) at ../src/wayland-server.c:749
#32 0x0000751f04e3db16 in ffi_call_unix64 () at ../src/x86/unix64.S:104
#33 0x0000751f04e3a3ef in ffi_call_int (cif=cif@entry=0x7ffd4347bb40, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>, closure=closure@entry=0x0) at ../src/x86/ffi64.c:673
#34 0x0000751f04e3d0be in ffi_call (cif=cif@entry=0x7ffd4347bb40, fn=<optimized out>, rvalue=rvalue@entry=0x0, avalue=avalue@entry=0x7ffd4347bc10) at ../src/x86/ffi64.c:710
#35 0x0000751f0568d393 in wl_closure_invoke (closure=closure@entry=0x5af3a83acd50, target=<optimized out>, target@entry=0x5af3a8484e70, opcode=opcode@entry=0, data=<optimized out>, data@entry=0x5af3a6b2fa20, flags=2)
    at ../src/connection.c:1025
#36 0x0000751f05691bb4 in wl_client_connection_data (fd=<optimized out>, mask=<optimized out>, data=0x5af3a6b2fa20) at ../src/wayland-server.c:438
#37 0x0000751f05690402 in wl_event_loop_dispatch (loop=0x5af3a2b500b0, timeout=timeout@entry=0) at ../src/event-loop.c:1027
#38 0x0000751f055441ab in wayland_event_source_dispatch (base=base@entry=0x5af3a2b502b0, callback=<optimized out>, data=<optimized out>) at ../src/wayland/meta-wayland.c:139
#39 0x0000751f067e6585 in g_main_dispatch (context=0x5af3a24e1160) at ../../../glib/gmain.c:3344
#40 0x0000751f06845977 in g_main_context_dispatch_unlocked (context=0x5af3a24e1160) at ../../../glib/gmain.c:4152
#41 g_main_context_iterate_unlocked.isra.0 (context=0x5af3a24e1160, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4217
#42 0x0000751f067e6f47 in g_main_loop_run (loop=0x5af3a2ca6e70) at ../../../glib/gmain.c:4419
#43 0x0000751f054d505a in meta_context_run_main_loop (context=<optimized out>, error=error@entry=0x7ffd4347c258) at ../src/core/meta-context.c:523
#44 0x00005af370a14695 in gala_main (args=<optimized out>, args_length1=<optimized out>) at src/gala.p/Main.c:314
#45 0x0000751f04c2a1ca in __libc_start_call_main (main=main@entry=0x5af370a00d30 <main>, argc=argc@entry=1, argv=argv@entry=0x7ffd4347c6b8) at ../sysdeps/nptl/libc_start_call_main.h:58
#46 0x0000751f04c2a28b in __libc_start_main_impl (main=0x5af370a00d30 <main>, argc=1, argv=0x7ffd4347c6b8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffd4347c6a8) at ../csu/libc-start.c:360
#47 0x00005af370a00d65 in _start ()
(gdb)

Hardware Info

• 2 external screens connected via USB-C (1920x1080@60)
• 1 internal laptop screen (1920x1080@60, turned off with lid closed)
• gala 8.4.2

[leolost2605]

Ok what I found is that according to meta_window_actor_queue_destroy, that is called in meta_compositor_remove_window, DROPDOWN_MENUs aren't supposed to have any effects: https://github.com/GNOME/mutter/blob/aae0955e6718de9084a6679fcd796cf8bd2cdef7/src/compositor/meta-window-actor.c#L999
On wayland xdg_popup's are marked as DROPDOWN_MENUs and here we are removing an xdg_popup. What I think happens is that because it's a drop down menu it gets immediately destroyed which causes our map to call map_completed but the window is already null.
The correct fix then would be to not animate DROPDOWN_MENUs because it seems as if mutter doesn't want us to but that would remove all effects from wayland menus?
So I'd like to investigate a bit more but I just can't reproduce the issue :(
@utf-4096 could you try to find a reproducer? If my assumptions are correct it should have to do something with a menu that's currently open from a certain app that closes menus on loosing focus.

[utf-4096]

I tried reopening all the windows I had previously open when I last got the crash on only my laptop screen but no luck.

I think so far every time I've had a crash its been after unlocking my session, which wakes my laptop dock from sleep, which turns on my external displays, which repositions my Sublime Text window (that I had focused, and which has a menu with auto-hide).

Unfortunately this is my work laptop so I'll only be able to test this again on Monday. I'll post if I was able to reproduce the crash or not.

[utf-4096]

Well, I haven't encountered a single crash since I created this issue, unfortunately(?). I've tried multiple times to reproduce the issue on my usual setup but again no crash.

I'm not sure what else I could try.

[utf-4096]

This has happened to me again. Interestingly I noticed FortiClient also crashes at the same time:

Wed 2026-04-22 16:01:22 CEST   2721 1000 1000 SIGSEGV present      /usr/bin/gala                                 112.7M
Wed 2026-04-22 16:01:23 CEST   3708 1000 1000 SIGSEGV present      /opt/forticlient/fortitray                      1.2M

and:

Thu 2026-04-23 17:18:13 CEST   2766 1000 1000 SIGSEGV present      /usr/bin/gala                                  71.8M
Thu 2026-04-23 17:18:13 CEST   3869 1000 1000 SIGSEGV present      /opt/forticlient/fortitray                   1015.3K

I've said in a previous comment that I've only had this happen after an unlock but this happened while I was using my session as normal, with Audacious focused (but again while switching workspace).

[utf-4096]

After much testing I was able to semi-reliably reproduce the same backtrace using Audacious.

Steps:

1. Install Audacious (using apt, haven't tested if this also happens using the flatpak)
2. Open Audacious
3. Add one or more songs to the playlist in the Qt interface
4. Hover any song name, then quickly switch workspace using Meta+Arrow once the information popup appears (you may have to try this multiple times)

[leolost2605]

@utf-4096 thanks for the thorough investigation and reproduction steps! I could indeed reproduce it and proposed a fix in #2830

[leolost2605]

@utf-4096 thanks for the thorough investigation and reproduction steps! I could indeed reproduce it and proposed a fix in #2830