Bug#1079292: libgtk-3-0t64: segfault in gdk_window_get_toplevel() crashes waybar when clicking any tray icon

[Lukas F. Hartmann]

Package: libgtk-3-0t64
Version: 3.24.43-2
Severity: important
X-Debbugs-Cc: ***@mntre.com

Dear Maintainer,

Some of our MNT Reform aarch64 users (which runs unstable by default), and I,
also on my amd64 PC, upgraded the libgtk-3-0t64 today. This renders tray icon
functionality in waybar, a popular wayland task bar, unusable. Clicking any
tray icon makes waybar crash and exit. Running waybar under gdb reveals a
segfault in libgtk-3's gdk_window_get_toplevel():

Thread 1 "waybar" received signal SIGSEGV, Segmentation fault.
0x00007ffff6d40485 in gdk_window_get_toplevel (window=0xa00000080) at
../../../gdk/gdkwindow.c:2488
Download failed: Invalid argument. Continuing without source file
./debian/build/deb/../../../gdk/gdkwindow.c.
2488 ../../../gdk/gdkwindow.c: No such file or directory.
(gdb) bt
#0 0x00007ffff6d40485 in gdk_window_get_toplevel (window=0xa00000080) at
../../../gdk/gdkwindow.c:2488
#1 0x00007ffff651a8a5 in () at /lib/x86_64-linux-gnu/libgtk-layer-shell.so.0
#2 0x00007ffff7115002 in gtk_tooltip_position (tooltip=0x555555dbc1c0,
display=0x0, new_tooltip_widget=<optimized out>, device=0x555555907630)
at ../../../gtk/gtktooltip.c:975
#3 gtk_tooltip_show_tooltip (display=***@entry=0x5555558c1b20) at
../../../gtk/gtktooltip.c:1051
#4 0x00007ffff71151cf in tooltip_popup_timeout (data=0x5555558c1b20) at
../../../gtk/gtktooltip.c:1129
#5 0x00007ffff6d259db in gdk_threads_dispatch (data=0x555555dbe050) at
../../../gdk/gdk.c:769
#6 0x00007ffff68f0bbe in () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#7 0x00007ffff68ede1f in () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#8 0x00007ffff68efea7 in () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#9 0x00007ffff68f04c0 in g_main_context_iteration () at /lib/x86_64-linux-
gnu/libglib-2.0.so.0
#10 0x00007ffff6be748d in g_application_run () at /lib/x86_64-linux-
gnu/libgio-2.0.so.0
#11 0x00005555555b6660 in waybar::Client::main(int, char**) ()
#12 0x00005555555b4d05 in main ()

This problem was not present with the previous version of libgtk-3-0t64.

Best,
Lukas (minute)


-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, arm64

Kernel: Linux 6.9.9-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libgtk-3-0t64 depends on:
ii adwaita-icon-theme 43-1
ii hicolor-icon-theme 0.17-2
ii libatk-bridge2.0-0t64 2.51.90-4
ii libatk1.0-0t64 2.51.90-4
ii libc6 2.38-11
ii libcairo-gobject2 1.18.0-3+b1
ii libcairo2 1.18.0-3+b1
ii libcloudproviders0 0.3.6-1
ii libcolord2 1.4.6-2.2
ii libcups2t64 2.4.7-1.2+b1
ii libepoxy0 1.5.10-1
ii libfontconfig1 2.14.1-4
ii libfribidi0 1.0.13-3
ii libgdk-pixbuf-2.0-0 2.42.10+dfsg-3+b3
ii libglib2.0-0t64 2.80.2-1
ii libgtk-3-common 3.24.43-2
ii libharfbuzz0b 8.3.0-2
ii libpango-1.0-0 1.52.2+ds-1
ii libpangocairo-1.0-0 1.52.2+ds-1
ii libpangoft2-1.0-0 1.52.2+ds-1
ii libwayland-client0 1.22.0-2.1
ii libwayland-cursor0 1.22.0-2.1
ii libwayland-egl1 1.22.0-2.1
ii libx11-6 2:1.8.7-1
ii libxcomposite1 1:0.4.5-1
ii libxcursor1 1:1.2.1-1
ii libxdamage1 1:1.1.6-1+b1
ii libxext6 2:1.3.4-1+b1
ii libxfixes3 1:6.0.0-2
ii libxi6 2:1.8-1+b1
ii libxinerama1 2:1.1.4-3
ii libxkbcommon0 1.6.0-1+b1
ii libxrandr2 2:1.5.2-2+b1
ii shared-mime-info 2.2-1

Versions of packages libgtk-3-0t64 recommends:
ii libgtk-3-bin 3.24.43-2
ii librsvg2-common 2.58.0+dfsg-1

Versions of packages libgtk-3-0t64 suggests:
ii gvfs 1.54.0-4

Versions of packages libgtk-3-0t64 is related to:
pn appmenu-gtk3-module <none>
pn fcitx-frontend-gtk3 <none>
pn gcin-gtk3-immodule <none>
pn gtk-vector-screenshot <none>
pn gtk3-engines-xfce <none>
pn gtk3-im-libthai <none>
pn hime-gtk3-immodule <none>
ii ibus-gtk3 1.5.29-1
pn imhangul-gtk3 <none>
ii libcanberra-gtk3-module 0.30-10
pn libcaribou-gtk3-module <none>
pn libgtk3-nocsd0 <none>
pn maliit-inputcontext-gtk3 <none>
pn packagekit-gtk3-module <none>
pn scim-gtk-immodule <none>
pn topmenu-gtk3 <none>
pn uim-gtk3 <none>
pn uim-gtk3-immodule <none>

-- no debconf information

[Johannes Schauer Marin Rodrigues]

Control: severity -1 serious

Hi,

I'm bumping severity because this bug breaks unrelated software on the system
and (if you are a waybar user) makes the system unusable unless you are a bit
more technically versed.

Post by Lukas F. Hartmann
Some of our MNT Reform aarch64 users (which runs unstable by default), and I,
also on my amd64 PC, upgraded the libgtk-3-0t64 today. This renders tray icon
functionality in waybar, a popular wayland task bar, unusable. Clicking any
tray icon makes waybar crash and exit. Running waybar under gdb reveals a

Rebuilding src:gtk+3.0 with this patch fixes the issue:

--- gtk+3.0-3.24.43/debian/patches/series 2024-08-20 22:42:46.000000000 +0200
+++ gtk+3.0-3.24.43/debian/patches/series 2024-08-22 12:35:57.000000000 +0200
@@ -3,9 +3,3 @@
060_ignore-random-icons.patch
reftest_compare_surfaces-Report-how-much-the-images-diffe.patch
reftests-Allow-minor-differences-to-be-tolerated.patch
-wayland-Add-support-for-v2-of-xdg_foreign-protocol.patch
-immulticontext-Don-t-have-a-global_context_id.patch
-Ensure-the-staging_cairo_surface-is-destroyed-before-re-a.patch
-gesture-set-widget-x-and-y-if-coordinate-translation-betw.patch
-a11y-Extract-helper-function-to-set-GtkMessageDialog-a11y.patch
-a11y-Use-non-empty-message-dialog-title-as-a11y-name.patch

It is thus likely that some of the patches that were cherry picked with the
last upload are responsible for this.

Thanks!

cheers, josch

[Johannes Schauer Marin Rodrigues]

hi,

Quoting Jeremy Bícha (2024-08-22 18:15:16)

On Thu, Aug 22, 2024 at 11:59 AM Johannes Schauer Marin Rodrigues

Quoting Jeremy Bícha (2024-08-22 17:49:40)

On Thu, Aug 22, 2024 at 11:45 AM Johannes Schauer Marin Rodrigues
Thank you. I agree with bumping the severity. Do you have time to
bisect and figure out which specific patch is broken? This would be
very helpful upstream so that the problematic commit does not make it
into the next stable gtk3 release.

I do not have a lot of time. Maybe we can share the work? If you have a hunch
which of the commits could be the likely culprit, I'll test out just dropping
that one. Bisecting six commits needs 3 tries anyways. :)

wayland-Add-support-for-v2-of-xdg_foreign-protocol.patch
Ensure-the-staging_cairo_surface-is-destroyed-before-re-a.patch
a11y-Use-non-empty-message-dialog-title-as-a11y-name.patch
immulticontext-Don-t-have-a-global_context_id.patch

thank you, that helps!

If you use sbuild, you can add --profiles=noudeb,nocheck to speed up the
build for this case.

Thankhs, I'll add those. The build is not the problem but testing it is. I do
run Debian bookworm, so to test this, I'm using an SD-Card with Debian unstable
on it that I flash every time... XD

[Johannes Schauer Marin Rodrigues]

Contorl: forwarded -1 https://gitlab.gnome.org/GNOME/gtk/-/issues/6958

Quoting Jeremy Bícha (2024-08-23 14:07:35)

On Fri, Aug 23, 2024 at 3:30 AM Johannes Schauer Marin Rodrigues

I now built four libgtk-3-0t64 packages. Each of them identical to what is
currently in unstable except, each of them has one of above four packages *not*
applied. I tried this in a vanilla Debian unstable system booted from SD-card
on my arm64 laptop and the only package where the bug did *not* surface was the
package that I built without
wayland-Add-support-for-v2-of-xdg_foreign-protocol.patch

Thank you! Are you able to do one more thing and report this issue upstream?
https://gitlab.gnome.org/GNOME/gtk/-/issues

Done.

[Jeremy Bícha]

Control: reopen -1

This bug seems to have reappeared for me.
I suspect 3.24.48-3 to be the culprit; it used to work before that.

Yes, this is being tracked in https://bugs.debian.org/1094442

However, it's reasonable to have a bug that will block the new gtk+3.0
from reaching Testing until that bug is fixed so we can use this one.

It may be worth doing a quick NMU to fix that issue. I haven't heard
back from Mike Gabriel. Martin Wimpress said he'd look at the issue
"later" but I have no idea how long that would take.

Thank you,
Jeremy Bícha

[Matthias Geiger]

Post by Jeremy Bícha
Control: reopen -1

This bug seems to have reappeared for me.
I suspect 3.24.48-3 to be the culprit; it used to work before that.

Yes, this is being tracked in https://bugs.debian.org/1094442
However, it's reasonable to have a bug that will block the new gtk+3.0
from reaching Testing until that bug is fixed so we can use this one.
It may be worth doing a quick NMU to fix that issue. I haven't heard
back from Mike Gabriel. Martin Wimpress said he'd look at the issue
"later" but I have no idea how long that would take.

Either two upstream commits need to be cherrypicked (or 0.9.0 imported).
Some symbols changed though (note the MISSING):

dpkg-gensymbols: warning: some new symbols appeared in the symbols file: see diff output below
dpkg-gensymbols: error: some symbols or patterns disappeared in the symbols file: see diff output below
dpkg-gensymbols: warning: debian/libgtk-layer-shell0/DEBIAN/symbols doesn't match completely debian/libgtk-layer-shell0.symbols
--- debian/libgtk-layer-shell0.symbols (libgtk-layer-shell0_0.9.0-1_amd64)
+++ dpkg-gensymbolsSq3Lxk 2025-01-29 12:41:54.106054147 +0000
@@ -1,5 +1,7 @@
libgtk-layer-shell.so.0 libgtk-layer-shell0 #MINVER#
* Build-Depends-Package: libgtk-layser-shell0-dev
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
***@Base 0.1.0
***@Base 0.1.0
#MISSING: 0.8.2-1# ***@Base 0.1.0
@@ -8,6 +10,7 @@
***@Base 0.1.0
***@Base 0.1.0
***@Base 0.1.0
+ ***@Base 0.9.0-1
***@Base 0.1.0
***@Base 0.1.0
***@Base 0.1.0
@@ -198,6 +201,7 @@
***@Base 0.3.0
***@Base 0.3.0
***@Base 0.3.0
+ ***@Base 0.9.0-1
#MISSING: 0.3.0# ***@Base 0.1.0
***@Base 0.3.0
***@Base 0.3.0
@@ -408,7 +412,13 @@
***@Base 0.3.0
***@Base 0.3.0
***@Base 0.3.0
- ***@Base 0.3.0
+#MISSING: 0.9.0-1# ***@Base 0.3.0
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
***@Base 0.3.0
***@Base 0.3.0
***@Base 0.3.0
@@ -447,7 +457,13 @@
***@Base 0.3.0
***@Base 0.3.0
***@Base 0.3.0
- ***@Base 0.3.0
+#MISSING: 0.9.0-1# ***@Base 0.3.0
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
***@Base 0.3.0
***@Base 0.3.0
***@Base 0.3.0
@@ -526,7 +542,10 @@
***@Base 0.3.0
***@Base 0.3.0
***@Base 0.3.0
- ***@Base 0.3.0
+#MISSING: 0.9.0-1# ***@Base 0.3.0
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
***@Base 0.3.0
***@Base 0.3.0
***@Base 0.3.0
@@ -542,7 +561,10 @@
***@Base 0.3.0
***@Base 0.6.0
***@Base 0.3.0
- ***@Base 0.3.0
+#MISSING: 0.9.0-1#
***@Base 0.3.0
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
+ ***@Base 0.9.0-1
***@Base 0.3.0
***@Base 0.3.0
***@Base 0.3.0
@@ -758,6 +780,7 @@
***@Base 0.1.0
***@Base 0.1.0
***@Base 0.1.0
+ ***@Base 0.9.0-1
***@Base 0.3.0
***@Base 0.4.0
***@Base 0.4.0

I think this should be fine; codesearch.d.o shows this symbol is only
used in wlmaker. I will test a build of wlmaker if it works with the
updated symbol and then prepare an NMU for gtk-layer-shell and a patch
for wlmaker.

best,

werdahias

[Matthias Geiger]

Hi Matthias,

Post by Matthias Geiger

Post by Jeremy Bícha
Control: reopen -1
On Tue, Jan 28, 2025 at 6:59 PM Matthias Geiger

This bug seems to have reappeared for me.
I suspect 3.24.48-3 to be the culprit; it used to work before that.

Yes, this is being tracked in https://bugs.debian.org/1094442
However, it's reasonable to have a bug that will block the new gtk+3.0
from reaching Testing until that bug is fixed so we can use this one.
It may be worth doing a quick NMU to fix that issue. I haven't heard
back from Mike Gabriel. Martin Wimpress said he'd look at the issue
"later" but I have no idea how long that would take.

Either two upstream commits need to be cherrypicked (or 0.9.0 imported).

Matthias, can you please bump gtk-layer-shell to 0.9.0 (if that is
latest upstream)? I am not using gtk-layer-shell actively. I
originally uploaded it to Debian, because mate-panel will use it one
day. But MATE is not there, yet.
That said, Matthias, feel free to add yourself to Uploaders: in
debian/control.
If that is not an option, I can bump gtk-layer-shell to latest
upstream in Debian unstable, but won't have much focus on testing
problems discussed here (sorry, totally busy with Lomiri atm).

Hi Mike,

sure, I'd have gone for an NMU, but I can add myself to uploaders and
upload 0.9.0, fixing those bugs.

best,

werdahias

[Mike Gabriel]

Hi Matthias,

Post by Matthias Geiger

Post by Jeremy Bícha
Control: reopen -1
On Tue, Jan 28, 2025 at 6:59 PM Matthias Geiger

This bug seems to have reappeared for me.
I suspect 3.24.48-3 to be the culprit; it used to work before that.

Yes, this is being tracked in https://bugs.debian.org/1094442
However, it's reasonable to have a bug that will block the new gtk+3.0
from reaching Testing until that bug is fixed so we can use this one.
It may be worth doing a quick NMU to fix that issue. I haven't heard
back from Mike Gabriel. Martin Wimpress said he'd look at the issue
"later" but I have no idea how long that would take.

Either two upstream commits need to be cherrypicked (or 0.9.0 imported).

Matthias, can you please bump gtk-layer-shell to 0.9.0 (if that is
latest upstream)? I am not using gtk-layer-shell actively. I
originally uploaded it to Debian, because mate-panel will use it one
day. But MATE is not there, yet.

That said, Matthias, feel free to add yourself to Uploaders: in
debian/control.

If that is not an option, I can bump gtk-layer-shell to latest
upstream in Debian unstable, but won't have much focus on testing
problems discussed here (sorry, totally busy with Lomiri atm).

Mike