Bug#1095325: libgtk-3-0t64: segfault in application since upgrade to version 3.24.48-4

Sun May 25 15:39:00 BST 2025

Hello,

I believe I am experiencing the same issue. It may be causing problems 
with x11rb; see related issue with Zed 
<https://github.com/zed-industries/zed/issues/29083#issuecomment-2907005604> 
which led me to look in this direction.

I have followed the "HowToGetABacktrace" page and installed debug 
symbols that I think are relevant. I have a bunch of coredumps available 
via systemd-coredump.

Here's my dmesg segfault:

[  284.036140] ibus-x11[2813]: segfault at 2ce ip 00007f0c79604356 sp 
00007ffe766e79b0 error 4 in 
libgdk-3.so.0.2417.32[9c356,7f0c79596000+87000] likely on CPU 5 (core 2, 
socket 0)
[  284.036175] Code: 4c 89 0c 24 e8 db f0 ff ff 44 8b 54 24 18 41 81 e2 
ff 9f ff ff 45 09 d4 44 3a 68 0c 0f 82 c2 01 00 00 48 8b 78 20 41 0f b6 
cd <48> 8b 57 20 48 8d 0c ca 44 0f b6 41 04 44 89 c6 83 e6 0f 44 38 68

Here's the info for the coredump I'll show the backtrace of below:

PID: 2887 (ibus-x11)
           UID: 1000 (matt)
           GID: 1000 (matt)
        Signal: 6 (ABRT)
     Timestamp: Sun 2025-05-25 11:03:15 ADT (22min ago)
  Command Line: /usr/libexec/ibus-x11 --kill-daemon
    Executable: /usr/libexec/ibus-x11
Control Group: /user.slice/user-1000.slice/session-3.scope
          Unit: session-3.scope
         Slice: user-1000.slice
       Session: 3
     Owner UID: 1000 (matt)
       Boot ID: ------
    Machine ID: -----
      Hostname: ------
       Storage: 
/var/lib/systemd/coredump/core.ibus-x11.1000.e378e9f2f3cb4de889a510235a84ae60.2887.1748181795000000.zst 
(present)
  Size on Disk: 1.6M
       Message: Process 2887 (ibus-x11) of user 1000 dumped core.

Here's a backtrace from the same:

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, 
signo=signo at entry=6, no_tid=no_tid at entry=0)
    at ./nptl/pthread_kill.c:44
#1  0x00007f019578d9ff in __pthread_kill_internal (threadid=<optimized 
out>, signo=6)
    at ./nptl/pthread_kill.c:89
#2  0x00007f0195738cc2 in __GI_raise (sig=sig at entry=6) at 
../sysdeps/posix/raise.c:26
#3  0x00007f01957214ac in __GI_abort () at ./stdlib/abort.c:73
#4  0x00007f0195722291 in __libc_message_impl 
(fmt=fmt at entry=0x7f01958a432d "%s\n")
    at ../sysdeps/posix/libc_fatal.c:134
#5  0x00007f0195797465 in malloc_printerr
    (str=str at entry=0x7f01958a74d0 "corrupted size vs. prev_size in 
fastbins") at ./malloc/malloc.c:5829
#6  0x00007f019579802c in malloc_consolidate (av=av at entry=0x7f01958e0ac0 
<main_arena>)
    at ./malloc/malloc.c:4924
#7  0x00007f019579a858 in _int_malloc (av=av at entry=0x7f01958e0ac0 
<main_arena>, bytes=bytes at entry=2560)
    at ./malloc/malloc.c:4099

#8  0x00007f019579cf47 in __libc_calloc (n=n at entry=2560, 
elem_size=elem_size at entry=1)
    at ./malloc/malloc.c:3844
#9  0x00005616353bf94b in _Xi18nChangeIC
--Type <RET> for more, q to quit, c to continue without paging--
    (ims=ims at entry=0x56164b8ae4d0, 
call_data=call_data at entry=0x7ffdd1fb72c0, p=p at entry=0x56164ba744c4 "\001",
create_flag=create_flag at entry=0) at ./util/IMdkit/i18nIc.c:697
#10 0x00005616353bdebc in SetICValuesMessageProc
    (ims=0x56164b8ae4d0, call_data=0x7ffdd1fb72c0, p=0x56164ba744c4 
"\001") at ./util/IMdkit/i18nPtHdr.c:923
#11 _Xi18nMessageHandler
    (ims=ims at entry=0x56164b8ae4d0, connect_id=1, 
p=p at entry=0x56164ba744c0 "6", delete=delete at entry=0x7ffdd1fb7
510) at ./util/IMdkit/i18nPtHdr.c:1849
#12 0x00005616353b7f3b in WaitXIMProtocol
    (dpy=<optimized out>, win=<optimized out>, ev=<optimized out>, 
client_data=0x56164b8ae4d0 "@a<5\026V")
    at ./util/IMdkit/i18nX.c:524
#13 0x00007f0195c923d6 in _gdk_x11_display_queue_events 
(display=0x56164b7fdb00 [GdkX11Display])
    at ../../../gdk/x11/gdkeventsource.c:337

#14 0x00007f0195c36e24 in gdk_display_get_event 
(display=display at entry=0x56164b7fdb00 [GdkX11Display])
    at ../../../gdk/gdkdisplay.c:442
#15 0x00007f0195c92216 in gdk_event_source_dispatch
    (source=<optimized out>, callback=<optimized out>, 
user_data=<optimized out>)
    at ../../../gdk/x11/gdkeventsource.c:363
#16 0x00007f0195a9c345 in g_main_dispatch 
(context=context at entry=0x56164b8a0000)
    at ../../../glib/gmain.c:3398
#17 0x00007f0195a9e577 in g_main_context_dispatch_unlocked 
(context=0x56164b8a0000)
    at ../../../glib/gmain.c:4249
#18 g_main_context_iterate_unlocked
    (context=0x56164b8a0000, block=block at entry=1, 
dispatch=dispatch at entry=1, self=<optimized out>)
    at ../../../glib/gmain.c:4314
#19 0x00007f0195a9efdf in g_main_loop_run (loop=0x7f01580025f0) at 
../../../glib/gmain.c:4516
#20 0x00007f0195d4d650 in ibus_main () at ./src/ibusshare.c:415
#21 0x00005616353b2c7c in main (argc=<optimized out>, argv=<optimized 
out>) at ./client/x11/main.c:1456

-- 
*Matthew Scheffel* | Software Developer
52 Townshend Avenue, Amherst, Nova Scotia, B4H 4N6
*Cell*: 1 (647) 230-4773 *E-mail*: matt at dataheck.com

DATAHECK.COM | 🦀 🐍
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20250525/86c9744a/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 322 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20250525/86c9744a/attachment-0001.sig>