Gala crashes repeatedly (segfault) during normal desktop use, with no specific trigger I can identify (no monitor connect/disconnect, no suspend/resume, just regular desktop usage). This happened 3 times within about 40 minutes.
Two of the three crashes share an identical stack trace, crashing in meta_window_get_buffer_rect during a clutter_actor_destroy call chain. The third crash (a few minutes later, likely during gala's own restart after the first crash) shows a related but different trace involving meta_backend_get_monitor_manager and clutter_actor_destroy_all_children.
I initially suspected a third-party app (Ferdium, an Electron-based messaging client) because it also crashed within seconds of one gala crash, but the bug reproduced again later with no other app crashing alongside it, so I don't believe Ferdium is the trigger.
Steps to Reproduce
Unable to find a reliable reproduction step. Crashes happen sporadically during normal desktop use (window management, no specific action identified as the trigger).
Expected Behavior
Gala should not crash during normal window management.
OS Version
elementary OS (Ubuntu Noble base)
Session Type
X11 (confirmed via --ozone-platform=x11 in related app process args)
Software Versions
gala: 8.6.0+r3140+pkg133~ubuntu8.1 (latest available in the elementary-os stable PPA at time of reporting)
libmutter-14-0: 46.2-1ubuntu0.24.04.16 (latest available)
Both confirmed to already be the latest candidate versions via apt policy — this is not an outdated-package issue.
Log Output — Crash 1 (10:05:16)
Process 2239 (gala) of user 1000 dumped core.
Stack trace of thread 2239:
#0 0x000070dba00e9184 meta_window_get_buffer_rect (libmutter-14.so.0 + 0xe9184)
#1 0x000070dba00bc09f n/a (libmutter-14.so.0 + 0xbc09f)
#2 0x00006319050dd69c n/a (gala + 0xa469c)
#3 0x000070dba039d7bb n/a (libgio-2.0.so.0 + 0xb17bb)
#4 0x000070dba03a1713 n/a (libgio-2.0.so.0 + 0xb5713)
#5 0x00006319050d5582 n/a (gala + 0x9c582)
#6 0x000070dba039d7bb n/a (libgio-2.0.so.0 + 0xb17bb)
#7 0x000070dba039d7f5 n/a (libgio-2.0.so.0 + 0xb17f5)
#8 0x000070dba130845e n/a (libglib-2.0.so.0 + 0x5d45e)
#9 0x000070dba1367977 n/a (libglib-2.0.so.0 + 0xbc977)
#10 0x000070dba1307a23 g_main_context_iteration (libglib-2.0.so.0 + 0x5ca23)
#11 0x000070dba14fd626 n/a (libgala.so.0 + 0x3c626)
#12 0x000070dba14092fa g_closure_invoke (libgobject-2.0.so.0 + 0x152fa)
#13 0x000070dba143890c n/a (libgobject-2.0.so.0 + 0x4490c)
#14 0x000070dba1429591 n/a (libgobject-2.0.so.0 + 0x35591)
#15 0x000070dba14297c1 g_signal_emit_valist (libgobject-2.0.so.0 + 0x357c1)
#16 0x000070dba1429883 g_signal_emit (libgobject-2.0.so.0 + 0x35883)
#17 0x000070db9ff552d5 n/a (libmutter-clutter-14.so.0 + 0x4d2d5)
#18 0x000070dba12ec965 n/a (libglib-2.0.so.0 + 0x41965)
#19 0x000070db9ff4191a n/a (libmutter-clutter-14.so.0 + 0x3991a)
#20 0x000070db9ff41c18 n/a (libmutter-clutter-14.so.0 + 0x39c18)
#21 0x000070db9ff3e136 n/a (libmutter-clutter-14.so.0 + 0x36136)
#22 0x000070dba14186c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#23 0x000070db9ff3defe clutter_actor_destroy (libmutter-clutter-14.so.0 + 0x35efe)
#24 0x000070dba00e6f88 n/a (libmutter-14.so.0 + 0xe6f88)
#25 0x000070dba01132df n/a (libmutter-14.so.0 + 0x1132df)
#26 0x000070dba0116845 n/a (libmutter-14.so.0 + 0x116845)
#27 0x000070dba130845e n/a (libglib-2.0.so.0 + 0x5d45e)
#28 0x000070dba1367977 n/a (libglib-2.0.so.0 + 0xbc977)
#29 0x000070dba1308f47 g_main_loop_run (libglib-2.0.so.0 + 0x5df47)
#30 0x000070dba00d50aa meta_context_run_main_loop (libmutter-14.so.0 + 0xd50aa)
#31 0x00006319050706e5 n/a (gala + 0x376e5)
#32 0x000070db9f62a1ca n/a (libc.so.6 + 0x2a1ca)
#33 0x000070db9f62a28b __libc_start_main (libc.so.6 + 0x2a28b)
#34 0x0000631905068535 _start (gala + 0x2f535)
An identical crash (same signature, same offsets) occurred again minutes later, apparently right after gala's automatic restart.
Log Output — Crash 2, ~30 minutes later (10:35:32), different signature
Process 21808 (gala) of user 1000 dumped core.
Stack trace of thread 21808:
#0 0x000075a601078d1b meta_backend_get_monitor_manager (libmutter-14.so.0 + 0x78d1b)
#1 0x000058d48a60b77b n/a (gala + 0x3d77b)
#2 0x000075a60260c61d g_object_unref (libgobject-2.0.so.0 + 0x2461d)
#3 0x000075a6013735a4 clutter_actor_destroy_all_children (libmutter-clutter-14.so.0 + 0x3c5a4)
#4 0x000075a6025fd25c g_closure_invoke (libgobject-2.0.so.0 + 0x1525c)
#5 0x000075a60262cf05 n/a (libgobject-2.0.so.0 + 0x44f05)
#6 0x000075a60261d591 n/a (libgobject-2.0.so.0 + 0x35591)
#7 0x000075a60261d7c1 g_signal_emit_valist (libgobject-2.0.so.0 + 0x357c1)
#8 0x000075a60261d883 g_signal_emit (libgobject-2.0.so.0 + 0x35883)
#9 0x000075a60136d122 n/a (libmutter-clutter-14.so.0 + 0x36122)
#10 0x000075a60260c6c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#11 0x000075a60136cefe clutter_actor_destroy (libmutter-clutter-14.so.0 + 0x35efe)
#12 0x000075a6013735a4 clutter_actor_destroy_all_children (libmutter-clutter-14.so.0 + 0x3c5a4)
#13 0x000075a6025fd2fa g_closure_invoke (libgobject-2.0.so.0 + 0x152fa)
#14 0x000075a60262cf05 n/a (libgobject-2.0.so.0 + 0x44f05)
#15 0x000075a60261d591 n/a (libgobject-2.0.so.0 + 0x35591)
#16 0x000075a60261d7c1 g_signal_emit_valist (libgobject-2.0.so.0 + 0x357c1)
#17 0x000075a60261d883 g_signal_emit (libgobject-2.0.so.0 + 0x35883)
#18 0x000075a60136d122 n/a (libmutter-clutter-14.so.0 + 0x36122)
#19 0x000075a60260c6c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#20 0x000075a60136cefe clutter_actor_destroy (libmutter-clutter-14.so.0 + 0x35efe)
#21 0x000075a6013735a4 clutter_actor_destroy_all_children (libmutter-clutter-14.so.0 + 0x3c5a4)
#22 0x000075a6013bf806 n/a (libmutter-clutter-14.so.0 + 0x88806)
#23 0x000075a60260c6c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#24 0x000075a60136cefe clutter_actor_destroy (libmutter-clutter-14.so.0 + 0x35efe)
#25 0x000075a6010742a5 n/a (libmutter-14.so.0 + 0x742a5)
#26 0x000075a6010f9fef n/a (libmutter-14.so.0 + 0xf9fef)
#27 0x000075a60260c6c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#28 0x000075a6010d9e33 n/a (libmutter-14.so.0 + 0xd9e33)
#29 0x000075a60260c3fe g_object_unref (libgobject-2.0.so.0 + 0x243fe)
#30 0x000058d48a5fdc44 n/a (gala + 0x2fc44)
#31 0x000058d48a60574c n/a (gala + 0x3774c)
#32 0x000075a60082a1ca n/a (libc.so.6 + 0x2a1ca)
#33 0x000075a60082a28b __libc_start_main (libc.so.6 + 0x2a28b)
#34 0x000058d48a5fd535 _start (gala + 0x2f535)
This second trace looks like it may be happening during gala's own restart sequence after the first crash (destroying the whole actor tree / monitor manager teardown), so it might be a secondary effect rather than an independent bug — but I'm including it in case it's useful.
Related
Both traces involve actor/window destruction races within libmutter-14, similar in category (though not identical) to #2102 (already fixed via #2183), which was also a segfault in libmutter-14 during a clutter_actor/window lifecycle operation. This may be a related but distinct race condition in the same area of the codebase.
Additional Notes
No duplicate/conflicting gala or Flatpak installs at the time of these crashes.
Both gala and libmutter-14-0 confirmed to be at the latest available package versions.
Happens without any specific reproducible trigger (no display/monitor changes, no suspend/resume, just normal desktop use).
Gala crashes repeatedly (segfault) during normal desktop use, with no specific trigger I can identify (no monitor connect/disconnect, no suspend/resume, just regular desktop usage). This happened 3 times within about 40 minutes.
Two of the three crashes share an identical stack trace, crashing in meta_window_get_buffer_rect during a clutter_actor_destroy call chain. The third crash (a few minutes later, likely during gala's own restart after the first crash) shows a related but different trace involving meta_backend_get_monitor_manager and clutter_actor_destroy_all_children.
I initially suspected a third-party app (Ferdium, an Electron-based messaging client) because it also crashed within seconds of one gala crash, but the bug reproduced again later with no other app crashing alongside it, so I don't believe Ferdium is the trigger.
Steps to Reproduce
Unable to find a reliable reproduction step. Crashes happen sporadically during normal desktop use (window management, no specific action identified as the trigger).
Expected Behavior
Gala should not crash during normal window management.
OS Version
elementary OS (Ubuntu Noble base)
Session Type
X11 (confirmed via --ozone-platform=x11 in related app process args)
Software Versions
gala: 8.6.0+r3140+pkg133~ubuntu8.1 (latest available in the elementary-os stable PPA at time of reporting)
libmutter-14-0: 46.2-1ubuntu0.24.04.16 (latest available)
Both confirmed to already be the latest candidate versions via apt policy — this is not an outdated-package issue.
Log Output — Crash 1 (10:05:16)
Process 2239 (gala) of user 1000 dumped core.
Stack trace of thread 2239:
#0 0x000070dba00e9184 meta_window_get_buffer_rect (libmutter-14.so.0 + 0xe9184)
#1 0x000070dba00bc09f n/a (libmutter-14.so.0 + 0xbc09f)
#2 0x00006319050dd69c n/a (gala + 0xa469c)
#3 0x000070dba039d7bb n/a (libgio-2.0.so.0 + 0xb17bb)
#4 0x000070dba03a1713 n/a (libgio-2.0.so.0 + 0xb5713)
#5 0x00006319050d5582 n/a (gala + 0x9c582)
#6 0x000070dba039d7bb n/a (libgio-2.0.so.0 + 0xb17bb)
#7 0x000070dba039d7f5 n/a (libgio-2.0.so.0 + 0xb17f5)
#8 0x000070dba130845e n/a (libglib-2.0.so.0 + 0x5d45e)
#9 0x000070dba1367977 n/a (libglib-2.0.so.0 + 0xbc977)
#10 0x000070dba1307a23 g_main_context_iteration (libglib-2.0.so.0 + 0x5ca23)
#11 0x000070dba14fd626 n/a (libgala.so.0 + 0x3c626)
#12 0x000070dba14092fa g_closure_invoke (libgobject-2.0.so.0 + 0x152fa)
#13 0x000070dba143890c n/a (libgobject-2.0.so.0 + 0x4490c)
#14 0x000070dba1429591 n/a (libgobject-2.0.so.0 + 0x35591)
#15 0x000070dba14297c1 g_signal_emit_valist (libgobject-2.0.so.0 + 0x357c1)
#16 0x000070dba1429883 g_signal_emit (libgobject-2.0.so.0 + 0x35883)
#17 0x000070db9ff552d5 n/a (libmutter-clutter-14.so.0 + 0x4d2d5)
#18 0x000070dba12ec965 n/a (libglib-2.0.so.0 + 0x41965)
#19 0x000070db9ff4191a n/a (libmutter-clutter-14.so.0 + 0x3991a)
#20 0x000070db9ff41c18 n/a (libmutter-clutter-14.so.0 + 0x39c18)
#21 0x000070db9ff3e136 n/a (libmutter-clutter-14.so.0 + 0x36136)
#22 0x000070dba14186c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#23 0x000070db9ff3defe clutter_actor_destroy (libmutter-clutter-14.so.0 + 0x35efe)
#24 0x000070dba00e6f88 n/a (libmutter-14.so.0 + 0xe6f88)
#25 0x000070dba01132df n/a (libmutter-14.so.0 + 0x1132df)
#26 0x000070dba0116845 n/a (libmutter-14.so.0 + 0x116845)
#27 0x000070dba130845e n/a (libglib-2.0.so.0 + 0x5d45e)
#28 0x000070dba1367977 n/a (libglib-2.0.so.0 + 0xbc977)
#29 0x000070dba1308f47 g_main_loop_run (libglib-2.0.so.0 + 0x5df47)
#30 0x000070dba00d50aa meta_context_run_main_loop (libmutter-14.so.0 + 0xd50aa)
#31 0x00006319050706e5 n/a (gala + 0x376e5)
#32 0x000070db9f62a1ca n/a (libc.so.6 + 0x2a1ca)
#33 0x000070db9f62a28b __libc_start_main (libc.so.6 + 0x2a28b)
#34 0x0000631905068535 _start (gala + 0x2f535)
An identical crash (same signature, same offsets) occurred again minutes later, apparently right after gala's automatic restart.
Log Output — Crash 2, ~30 minutes later (10:35:32), different signature
Process 21808 (gala) of user 1000 dumped core.
Stack trace of thread 21808:
#0 0x000075a601078d1b meta_backend_get_monitor_manager (libmutter-14.so.0 + 0x78d1b)
#1 0x000058d48a60b77b n/a (gala + 0x3d77b)
#2 0x000075a60260c61d g_object_unref (libgobject-2.0.so.0 + 0x2461d)
#3 0x000075a6013735a4 clutter_actor_destroy_all_children (libmutter-clutter-14.so.0 + 0x3c5a4)
#4 0x000075a6025fd25c g_closure_invoke (libgobject-2.0.so.0 + 0x1525c)
#5 0x000075a60262cf05 n/a (libgobject-2.0.so.0 + 0x44f05)
#6 0x000075a60261d591 n/a (libgobject-2.0.so.0 + 0x35591)
#7 0x000075a60261d7c1 g_signal_emit_valist (libgobject-2.0.so.0 + 0x357c1)
#8 0x000075a60261d883 g_signal_emit (libgobject-2.0.so.0 + 0x35883)
#9 0x000075a60136d122 n/a (libmutter-clutter-14.so.0 + 0x36122)
#10 0x000075a60260c6c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#11 0x000075a60136cefe clutter_actor_destroy (libmutter-clutter-14.so.0 + 0x35efe)
#12 0x000075a6013735a4 clutter_actor_destroy_all_children (libmutter-clutter-14.so.0 + 0x3c5a4)
#13 0x000075a6025fd2fa g_closure_invoke (libgobject-2.0.so.0 + 0x152fa)
#14 0x000075a60262cf05 n/a (libgobject-2.0.so.0 + 0x44f05)
#15 0x000075a60261d591 n/a (libgobject-2.0.so.0 + 0x35591)
#16 0x000075a60261d7c1 g_signal_emit_valist (libgobject-2.0.so.0 + 0x357c1)
#17 0x000075a60261d883 g_signal_emit (libgobject-2.0.so.0 + 0x35883)
#18 0x000075a60136d122 n/a (libmutter-clutter-14.so.0 + 0x36122)
#19 0x000075a60260c6c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#20 0x000075a60136cefe clutter_actor_destroy (libmutter-clutter-14.so.0 + 0x35efe)
#21 0x000075a6013735a4 clutter_actor_destroy_all_children (libmutter-clutter-14.so.0 + 0x3c5a4)
#22 0x000075a6013bf806 n/a (libmutter-clutter-14.so.0 + 0x88806)
#23 0x000075a60260c6c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#24 0x000075a60136cefe clutter_actor_destroy (libmutter-clutter-14.so.0 + 0x35efe)
#25 0x000075a6010742a5 n/a (libmutter-14.so.0 + 0x742a5)
#26 0x000075a6010f9fef n/a (libmutter-14.so.0 + 0xf9fef)
#27 0x000075a60260c6c4 g_object_run_dispose (libgobject-2.0.so.0 + 0x246c4)
#28 0x000075a6010d9e33 n/a (libmutter-14.so.0 + 0xd9e33)
#29 0x000075a60260c3fe g_object_unref (libgobject-2.0.so.0 + 0x243fe)
#30 0x000058d48a5fdc44 n/a (gala + 0x2fc44)
#31 0x000058d48a60574c n/a (gala + 0x3774c)
#32 0x000075a60082a1ca n/a (libc.so.6 + 0x2a1ca)
#33 0x000075a60082a28b __libc_start_main (libc.so.6 + 0x2a28b)
#34 0x000058d48a5fd535 _start (gala + 0x2f535)
This second trace looks like it may be happening during gala's own restart sequence after the first crash (destroying the whole actor tree / monitor manager teardown), so it might be a secondary effect rather than an independent bug — but I'm including it in case it's useful.
Related
Both traces involve actor/window destruction races within libmutter-14, similar in category (though not identical) to #2102 (already fixed via #2183), which was also a segfault in libmutter-14 during a clutter_actor/window lifecycle operation. This may be a related but distinct race condition in the same area of the codebase.
Additional Notes
No duplicate/conflicting gala or Flatpak installs at the time of these crashes.
Both gala and libmutter-14-0 confirmed to be at the latest available package versions.
Happens without any specific reproducible trigger (no display/monitor changes, no suspend/resume, just normal desktop use).