Public bug reported:
On Ubuntu 24.04 (noble), gnome-shell crashes with SIGSEGV when a
Thunderbolt dock that drives all external monitors is hot-unplugged.
mutter dereferences a NULL logical monitor in meta_window_place().
Upstream fixed this in mutter 49 (commit 785a83ae, MR !4549). The fix is
absent from the 46, 47 and 48 branches. This report asks for an SRU of
that commit into noble's mutter 46.2.
SYSTEM
- Ubuntu 24.04 LTS, Wayland
- At crash time (2026-09-04): gnome-shell 46.0-0ubuntu6~24.04.14, mutter
46.2-1ubuntu0.24.04.16, kernel 6.8.0-139-generic
- Now: gnome-shell 46.0-0ubuntu6~24.04.15, mutter 46.2-1ubuntu0.24.04.16
(unchanged, no fix), kernel 6.8.0-142-generic
- gnome-shell-extension-ubuntu-dock 90ubuntu3
- gnome-shell-extension-desktop-icons-ng 46+really47.0.9-1ubuntu5
- Lenovo ThinkPad X1 Carbon Gen 9 (20XW005VSP), Intel Iris Xe (i915, Tiger Lake)
- CalDigit TB3-MiniDock-HM driving two 1920x1080 monitors: DP-1 at 0,0 and DP-2
at 1920,0 (primary). Built-in eDP-1 disabled in the saved layout.
WHAT HAPPENS
1. The dock is unplugged while it drives both external monitors.
2. The kernel releases the Thunderbolt device and the dock i210 NIC cleanly. No
kernel error occurs.
3. About 3 seconds later, mutter reconfigures to a single logical monitor:
eDP-1 at {0,0,1920,1200}.
4. About 2 seconds after that, gnome-shell crashes with SIGSEGV. gdm restarts
the session.
Observed rate: 1 crash in 5 dock disconnects.
ANALYSIS
Core dump analysed with libmutter-14-0-dbgsym 46.2-1ubuntu0.24.04.16:
#4 meta_window_place (window=0x62f7a1d71670) at ../src/core/place.c:967
#5 place_window_if_needed at ../src/core/constraints.c:574
#6 meta_window_constrain at ../src/core/constraints.c:317
#7 meta_window_move_resize_internal at ../src/core/window.c:3979
#8 meta_window_force_placement (force_move=1) at ../src/core/window.c:2113
#10 xdg_toplevel_set_maximized at ../src/wayland/meta-wayland-xdg-shell.c:474
#17 wayland_event_source_dispatch at ../src/wayland/meta-wayland.c:139
NULL dereference at place.c:967, "x = logical_monitor->rect.x;".
Faulting instruction "mov 0x1c(%r12),%eax" with r12 = 0. gdb confirms
logical_monitor = 0x0.
State read from the core:
- The monitor manager holds exactly one logical monitor: eDP-1,
{0,0,1920,1200}, primary. The list is consistent and correct.
- Seat viewports are already updated to that single view.
- The pointer is at x = 1921, y = 91.5. META_POINT_IN_RECT tests x < rect.x +
width, so 1921 lies outside 0..1919 and
meta_backend_get_current_logical_monitor() returns NULL.
- The window being placed is a new Wayland toplevel, title "Desktop Icons 1",
placed = 0, showing_for_first_time = 1, decorated = 0.
Trigger chain:
1. Desktop Icons NG destroys and recreates its per-monitor windows whenever the
monitor count changes, and calls maximize() on each.
2. That arrives as xdg_toplevel.set_maximized, which forces placement of a
not-yet-placed window.
3. Placement requests the logical monitor under the pointer, receives NULL, and
dereferences it.
Why the pointer is outside every monitor: ensure_pointer_onscreen()
should clamp it to 1919 and emit an absolute motion, but that motion
passes through the barrier code. Ubuntu Dock creates a pressure barrier
at monitor.x + 1 for its monitor; with the removed primary at x=1920 the
barrier sits at x = 1921. dash-to-dock destroys that barrier from JS on
monitors-changed, which runs later in the main loop, while
ensure_pointer_onscreen() runs synchronously inside mutter's monitor
rebuild. The stale barrier blocks the relocation, so the pointer stays
at 1921. Dock settings in use: position LEFT, require-pressure-to-show
true, intellihide true.
The NULL dereference is what this report asks to fix. The relocation-
versus-barrier ordering is a separate root cause that remains unfixed
upstream.
UPSTREAM FIX
Commit 785a83ae3a2cc7b58a3252e31d628315bbf8c901, "core/place: Guarantee we
never get work area for a NULL logical monitor", merged 2025-08-06:
https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/4549
It adds a g_warn_if_fail and falls back to the primary logical monitor.
Present in tags 49.0 and main; absent in 46.9, 47.10 and 48.8. No
backport MR exists on the gnome-46 branch.
Related open upstream issues:
https://gitlab.gnome.org/GNOME/mutter/-/issues/3208
https://gitlab.gnome.org/GNOME/mutter/-/issues/4366
WHY THIS WAS MISSED ON NOBLE
LP: #1933186 carries the identical Error Tracker signature and was
closed as Fix Released, with a comment on 2026-01-20 stating "No crashes
have been reported since Noble so we assume this was fixed, somewhere."
This crash occurred on fully updated noble on 2026-09-04, so that
assumption does not hold. LP: #2117277 records the same crash on 25.04
and was fixed only via mutter 49 in questing, with no noble task.
REQUEST
Please SRU commit 785a83ae into noble's mutter 46.2. The patch is small
and applies to 46.2 place.c with trivial context. It converts a hard
crash of the entire session into a warning plus a sane fallback.
ATTACHMENTS
- gnome-shell-2026-09-04-backtrace.txt (symbolized backtrace)
- The full apport crash report with core (79 MB) is kept locally and can be
shared privately on request.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: mutter (not installed)
ProcVersionSignature: Ubuntu 6.8.0-142.142-generic 6.8.12
Uname: Linux 6.8.0-142-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Mon Sep 28 12:32:18 2026
InstallationDate: Installed on 2022-06-03 (1578 days ago)
InstallationMedia: Ubuntu 22.04 LTS "Jammy Jellyfish" - Release amd64 (20220419)
SourcePackage: mutter
UpgradeStatus: Upgraded to noble on 2024-10-20 (708 days ago)
** Affects: mutter (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble wayland-session
** Attachment added: "gnome-shell-2026-09-04-backtrace.txt"
https://bugs.launchpad.net/bugs/2168739/+attachment/6003414/+files/gnome-shell-2026-09-04-backtrace.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168739
Title:
gnome-shell 46 SIGSEGV in meta_window_place() on Thunderbolt dock
unplug: upstream fix (mutter !4549) missing from noble
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2168739/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
