https://bugs.kde.org/show_bug.cgi?id=511410
[email protected] changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #14 from [email protected] --- Additional reproduction and live Xwayland evidence, captured 2026-10-02. Environment: - Fedora 44, KDE Plasma/KWin 6.7.5, Wayland session - Xwayland 24.1.13-1.fc44 - x2goclient 4.1.2.3-10.fc44, launched with QT_QPA_PLATFORM=xcb - nxproxy / nx-libs 3.5.99.27-9.fc44 - Mesa 26.2.3; kernel 7.2.7-200.fc44.x86_64 - Laptop has Intel UHD Graphics 630 and NVIDIA Quadro T1000 Mobile (active rendering device was not captured) - Remote server: Gentoo, x2goserver 4.1.0.6, NX 3.5.99.27, LXQt desktop Observed behaviour: The remote session runs with low CPU use. Ending the remote desktop session triggers Xwayland consuming an entire CPU core; the user reports the local desktop subsequently freezes after several minutes. During the live capture, Xwayland used 100.0% of one core over a 2-second sample, x2goclient 1.5%, and kwin_wayland 3.0%. The nxproxy child had already exited and remained a zombie. The desktop was still responsive enough to capture diagnostics; a KWin stack during a full desktop freeze was not captured. Three separate live GDB attachments found Xwayland at the same instruction in damageRegionProcessPending.lto_priv.0. The call chain goes through damageCopyArea, compRestoreWindow, compCheckRedirect, compUnrealizeWindow, DeleteWindow, FreeClientResources, and CloseDownClient. The stuck instruction was: mov (%rbx),%rbx The linked-list node points to itself, captured BEFORE terminating Xwayland: $rbx = 0x562b9bb7bd60 x/2gx $rbx: 0x562b9bb7bd60: 0x0000562b9bb7bd60 0x0000562b9bb86700 x/2gx *(void **)$rbx: 0x562b9bb7bd60: 0x0000562b9bb7bd60 0x0000562b9bb86700 This is live evidence of a self-referential damage list, consistent with comment 8. A three-second strace attachment observed no syscalls. Mesa worker threads in the initial all-thread capture were waiting on condition variables. Recovery: SIGTERM did not stop the stuck Xwayland process within two seconds; SIGKILL did. KWin remained alive, started a replacement Xwayland, and its measured CPU usage was then 0.0%. Local X11 clients lost their connection. The included stack has function names but no source-level debug information. No core dump was taken. The separate server-side keyboard/resume issue was fixed afterward; its relationship to this Xwayland bug has not been established. Live stack and pointer capture: [New LWP 5772] [New LWP 5771] [New LWP 5770] [New LWP 5769] This GDB supports auto-downloading debuginfo from the following URLs: <ima:enforcing> <https://debuginfod.fedoraproject.org/> <ima:ignore> Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal] Debuginfod has been disabled. To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". 0x0000562b77cb8acf in damageRegionProcessPending.lto_priv.0 () #0 0x0000562b77cb8acf in damageRegionProcessPending.lto_priv.0 () #1 0x0000562b77cbafc3 in damageCopyArea () #2 0x0000562b77c98243 in compRestoreWindow () #3 0x0000562b77c9dba9 in compCheckRedirect () #4 0x0000562b77c9ec0f in compUnrealizeWindow () #5 0x0000562b77c970c9 in UnrealizeTree () #6 0x0000562b77c9ac7b in UnmapWindow.isra.0 () #7 0x0000562b77c92532 in DeleteWindow () #8 0x0000562b77c8f497 in doFreeResource.lto_priv.0 () #9 0x0000562b77c96a5d in FreeClientResources.part.0 () #10 0x0000562b77c6b49f in CloseDownClient () #11 0x0000562b77d52312 in ospoll_wait () #12 0x0000562b77c60adf in Dispatch () #13 0x0000562b77bd749a in main () $1 = 0x562b9bb7bd60 0x562b9bb7bd60: 0x0000562b9bb7bd60 0x0000562b9bb86700 0x562b9bb7bd60: 0x0000562b9bb7bd60 0x0000562b9bb86700 [Inferior 1 (process 5766) detached] -- You are receiving this mail because: You are watching all bug changes.
