Bug 2464127 - [abrt] gnome-shell: convert_ubyte_rgba_to_bgra(): gnome-shell killed by SIGSEGV
Summary: [abrt] gnome-shell: convert_ubyte_rgba_to_bgra(): gnome-shell killed by SIGSEGV
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: gnome-shell
Version: 44
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: GNOME SIG Unassigned
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:d011eed99f8d7559113ba9b18fb...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-30 14:44 UTC by Harro Verton
Modified: 2026-08-31 23:42 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)
File: proc_pid_status (1.47 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: maps (119.45 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: limits (1.29 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: environ (1.29 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: open_fds (14.38 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: mountinfo (4.37 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: os_info (699 bytes, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: cpuinfo (3.05 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: core_backtrace (138.92 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: exploitable (81 bytes, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: dso_list (27.79 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: var_log_messages (5.04 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details
File: backtrace (89.89 KB, text/plain)
2026-04-30 14:45 UTC, Harro Verton
no flags Details

Description Harro Verton 2026-04-30 14:44:57 UTC
Description of problem:
Happens as soon as I try to connect using gnome-remote-desktop (using the Remmina RDP client on Fedora 43).

Version-Release number of selected component:
gnome-shell-50.1-2.fc44

Additional info:
reporter:       libreport-2.17.15
type:           CCpp
reason:         gnome-shell killed by SIGSEGV
journald_cursor: s=91d88e8a502146c5b41fe27497deb8dd;i=4be94;b=da7a8f8e3da746adaf8b66a7cc7e4c8d;m=493d3ab;t=650adaaf87047;x=62b40213de41ddbe
executable:     /usr/bin/gnome-shell
cmdline:        /usr/bin/gnome-shell --mode=gdm
cgroup:         0::/user.slice/user-60579.slice/user/session.slice/org.gnome.Shell
rootdir:        /
uid:            60579
kernel:         6.19.14-300.fc44.x86_64
package:        gnome-shell-50.1-2.fc44
runlevel:       /bin/sh: line 1: runlevel: command not found
backtrace_rating: 4
crash_function: convert_ubyte_rgba_to_bgra
comment:        Happens as soon as I try to connect using gnome-remote-desktop (using the Remmina RDP client on Fedora 43).

Truncated backtrace:
Thread no. 0 (48 frames)
 #0 convert_ubyte_rgba_to_bgra at ../src/mesa/main/format_utils.c:226
 #1 _mesa_format_convert at ../src/mesa/main/format_utils.c:362
 #2 read_rgba_pixels at ../src/mesa/main/readpix.c:609
 #3 _mesa_readpixels at ../src/mesa/main/readpix.c:923
 #4 st_ReadPixels at ../src/mesa/state_tracker/st_cb_readpixels.c:577
 #5 read_pixels at ../src/mesa/main/readpix.c:1218
 #6 _mesa_ReadnPixelsARB at ../src/mesa/main/readpix.c:1235
 #7 _mesa_ReadPixels at ../src/mesa/main/readpix.c:1250
 #8 cogl_gl_framebuffer_read_pixels_into_bitmap at ../cogl/cogl/driver/gl/cogl-framebuffer-gl.c:579
 #9 cogl_framebuffer_read_pixels_into_bitmap at ../cogl/cogl/cogl-framebuffer.c:1358
 #10 clutter_stage_paint_to_buffer at ../clutter/clutter/clutter-stage.c:2736
 #11 meta_screen_cast_virtual_stream_src_record_to_buffer at ../src/backends/meta-screen-cast-virtual-stream-src.c:447
 #12 meta_screen_cast_stream_src_record_to_buffer at ../src/backends/meta-screen-cast-stream-src.c:397
 #13 do_record_frame at ../src/backends/meta-screen-cast-stream-src.c:845
 #14 meta_screen_cast_stream_src_record_frame_with_timestamp at ../src/backends/meta-screen-cast-stream-src.c:1238
 #15 notify_watchers_for_mode at ../src/backends/meta-stage.c:245
 #16 clutter_stage_paint_view at ../clutter/clutter/clutter-stage.c:465
 #17 paint_stage at ../src/backends/meta-stage-impl.c:406
 #18 meta_stage_impl_redraw_view_primary at ../src/backends/meta-stage-impl.c:668
 #19 meta_stage_impl_redraw_view at ../src/backends/meta-stage-impl.c:803
 #20 meta_stage_native_redraw_view at ../src/backends/native/meta-stage-native.c:135
 #21 _clutter_stage_window_redraw_view at ../clutter/clutter/clutter-stage-window.c:78
 #22 handle_frame_clock_frame at ../clutter/clutter/clutter-stage-view.c:1052
 #23 clutter_frame_clock_dispatch at ../clutter/clutter/clutter-frame-clock.c:1708
 #24 frame_clock_source_dispatch at ../clutter/clutter/clutter-frame-clock.c:1750
 #26 g_main_context_dispatch_unlocked at ../glib/gmain.c:4451
 #27 g_main_context_iterate_unlocked at ../glib/gmain.c:4516
 #29 meta_context_run_main_loop at ../src/core/meta-context.c:506
 #30 ffi_call_unix64 at ../src/x86/unix64.S:104
 #31 ffi_call_int at ../src/x86/ffi64.c:676
 #32 ffi_call at ../src/x86/ffi64.c:713
 #33 Gjs::Function::invoke at ../gi/function.cpp:1022
 #34 Gjs::Function::call at ../gi/function.cpp:1194
 #35 CallJSNative at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:494
 #36 js::InternalCallOrConstruct at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:576
 #37 InternalCall at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:657
 #38 js::CallFromStack at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:662
 #39 js::Interpret at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:3286
 #40 MaybeEnterInterpreterTrampoline at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:395
 #41 js::RunScript at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:464
 #42 js::InternalCallOrConstruct at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:622
 #43 InternalCall at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:657
 #44 js::Call at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/Interpreter.cpp:689
 #45 JS::Call at /usr/src/debug/mozjs140-140.6.0-4.fc44.x86_64/js/src/vm/CallAndConstruct.cpp:119
 #47 GjsContextPrivate::run_main_loop_hook at ../gjs/context.cpp:1418
 #48 GjsContextPrivate::eval_module at ../gjs/context.cpp:1571
 #49 gjs_context_eval_module at ../gjs/context.cpp:1311
 #50 gjs_context_eval_module_file at ../gjs/context.cpp:1653

Comment 1 Harro Verton 2026-04-30 14:45:01 UTC
Created attachment 2138899 [details]
File: proc_pid_status

Comment 2 Harro Verton 2026-04-30 14:45:02 UTC
Created attachment 2138900 [details]
File: maps

Comment 3 Harro Verton 2026-04-30 14:45:03 UTC
Created attachment 2138901 [details]
File: limits

Comment 4 Harro Verton 2026-04-30 14:45:05 UTC
Created attachment 2138902 [details]
File: environ

Comment 5 Harro Verton 2026-04-30 14:45:06 UTC
Created attachment 2138903 [details]
File: open_fds

Comment 6 Fedora Admin user for bugzilla script actions 2026-04-30 14:45:07 UTC
Please consider reporting your issue directly to GNOME at https://gitlab.gnome.org/GNOME/ to improve the chances that your issue will be resolved. This issue should only be kept open if it:

1. Relates to Fedora packaging or integration with other Fedora components
2. Is required for Fedora release processes, such as blocker bugs and freeze exceptions

If this issue isn't needed for either of these two reasons, please:

 * create an issue with GNOME
 * add a link to the GNOME issue here
 * close this issue as CLOSED/UPSTREAM

Thank you!

Comment 7 Harro Verton 2026-04-30 14:45:07 UTC
Created attachment 2138904 [details]
File: mountinfo

Comment 8 Harro Verton 2026-04-30 14:45:09 UTC
Created attachment 2138905 [details]
File: os_info

Comment 9 Harro Verton 2026-04-30 14:45:10 UTC
Created attachment 2138906 [details]
File: cpuinfo

Comment 10 Harro Verton 2026-04-30 14:45:12 UTC
Created attachment 2138907 [details]
File: core_backtrace

Comment 11 Harro Verton 2026-04-30 14:45:13 UTC
Created attachment 2138908 [details]
File: exploitable

Comment 12 Harro Verton 2026-04-30 14:45:14 UTC
Created attachment 2138909 [details]
File: dso_list

Comment 13 Harro Verton 2026-04-30 14:45:15 UTC
Created attachment 2138910 [details]
File: var_log_messages

Comment 14 Harro Verton 2026-04-30 14:45:16 UTC
Created attachment 2138911 [details]
File: backtrace

Comment 15 Harro Verton 2026-07-08 18:22:23 UTC
Two months on, no activity, and the bug still exists, we can't use gnome-remote-desktop to remotely connect to work desktops, which is becoming a pain. Time to dump Fedora, me thinks.

Comment 16 Harro Verton 2026-07-08 18:41:23 UTC
[169919.051661] gnome-shell[7204]: segfault at 7fe240bef000 ip 00007fe300d0b7f1 sp 00007fff12734b28 error 6 in libgallium-26.1.3.so[30b7f1,7fe300a00000+1f37000] likely on CPU 4 (core 0, socket 8)
[169919.051692] Code: 96 4c 8b 65 e0 4c 8b 6d e8 4c 8b 75 f0 4c 8b 7d f8 e9 da fe ff ff 4c 89 d9 4c 8b 5d c8 8b 54 b8 fc 41 83 c2 01 0f ca c1 ca 08 <41> 89 54 b8 fc 45 39 d3 74 cd 48 01 d8 4d 01 c8 48 85 c9 0f 85 27

Comment 17 Adam Williamson (Red Hat non-Fedora) 2026-07-08 19:21:25 UTC
There was activity: the comment saying "Please consider reporting your issue directly to GNOME at https://gitlab.gnome.org/GNOME/ to improve the chances that your issue will be resolved". The GNOME package maintainers generally don't monitor RHBZ, which is why that automated comment gets posted on bugs filed against GNOME components.

The crash here is actually in mesa, but it could possibly be caused by gjs or cogl feeding it bad input. Hard to be sure exactly where the issue is. But it'd probably be best to file it at https://gitlab.gnome.org/GNOME/gjs/-/work_items first, I guess.

Comment 18 Adam Williamson (Red Hat non-Fedora) 2026-07-08 19:23:37 UTC
Hmm, based on frame #11 might even be mutter? That's where the somewhat-weird looking huge string of "\377&\"\"\377&\".. seems to show up first.


Note You need to log in before you can comment on or make changes to this bug.