Same crash on Ubuntu 26.04 (Wayland), single occurrence — but not on the lock screen. The session was active and in use: the journal shows no screensaver, idle, lock or DPMS event in the 18 minutes before the crash, and a window title change 4 minutes before it. So whatever invalidates the keymap is not specific to the lock/unlock path.
Versions gnome-shell 50.1-0ubuntu1.2 libmutter-18-0 50.1-0ubuntu2.2 mutter-common 50.1-0ubuntu2.2 libxkbcommon0 1.13.1 kernel 7.0.0-30-generic (amd64) session GNOME on Wayland Backtrace (from the apport core dump, no debug symbols installed) #5 <signal handler called> #6 0x00007039df74736c in xkb_keymap_mod_get_index () from /usr/lib/x86_64-linux-gnu/libxkbcommon.so.0 #7 0x00007039e2fb4903 in ?? () from /usr/lib/x86_64-linux-gnu/libmutter-18.so.0 #8 0x00007039e2fb49fd in ?? () from /usr/lib/x86_64-linux-gnu/libmutter-18.so.0 #9 0x00007039e352bb9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 #10 0x00007039e352d1d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 #11 0x00007039e352d577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 #12 0x00007039e2f0164a in meta_context_run_main_loop () from /usr/lib/x86_64-linux-gnu/libmutter-18.so.0 Frames #7/#8 match the update_state_from_modifier_state() / update_keymap_in_main() pair named in Ubuntu bug #2152175. The keymap pointer was not NULL This issue describes the keymap as being NULL. In this core it was not: si_addr = 0x3e800001edf faulting instruction: => 0x7039df74736c <xkb_keymap_mod_get_index+28>: mov (%rbx),%rdx The faulting address splits cleanly into two values that both match this process: 0x3e8 = 1000 = the session uid, and 0x1edf = 7903 = the pid of the crashed gnome-shell. So the value sitting in the keymap slot looks like a uid/pid pair packed into one 64-bit word rather than a pointer. I cannot say which struct it came from — no debug symbols were installed, and rbx being the keymap argument is inferred from the single disassembled instruction above. Taking the observation for what it is: a NULL check alone would not have caught this one. Other observations All 35 other threads were parked in futex/poll waits, so no obvious race with a concurrent keymap teardown. Not memory pressure: RSS at crash time was 280 MB, and neither the kernel OOM killer nor systemd-oomd had killed anything (0 entries in the journal). The usual xkb warnings (Unsupported maximum keycode 708, Virtual modifier Hyper multiply defined) appear 141 and 282 times respectively over the 4 days of journal retained, including after the crash on the fresh session, so they are constant noise here rather than a trigger. No user interaction with keyboard settings or input devices at the time; no input device hotplug appears in the journal in the minutes before the crash. First occurrence in this boot (uptime 5 days 18 hours). -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to mutter in Ubuntu. https://bugs.launchpad.net/bugs/2152175 Title: gnome-shell crashed with SIGSEGV in xkb_atom_lookup() from xkb_keymap_mod_get_index() from update_state_from_modifier_state() from update_keymap_in_main() from g_main_dispatch() To manage notifications about this bug go to: https://bugs.launchpad.net/mutter/+bug/2152175/+subscriptions -- desktop-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
