Gala crashes repeatedly on X11 session when external HDMI monitor is connected

[willobm]

What Happened?

gala_crash_abrt.txt
gala_crash_segv.txt

Summary

On elementary OS 8.1 with an Intel TigerLake-LP / Iris Xe GPU, gala (Pantheon WM, running on X11) crashes repeatedly during normal use when an external HDMI monitor is connected to the laptop. After a few automatic restarts systemd gives up with Start request repeated too quickly and the entire desktop session is lost, forcing me to log back in. The same machine produced 15 gala core dumps in a single day today.

The kernel i915 driver is healthy — no GPU hangs, resets, or wedged-context messages in dmesg. The faulting code lives in libgala.so.0 / gala.

System info

Field	Value
OS	elementary OS 8.1 (Ubuntu 24.04 base)
Kernel	6.17.0-23-generic
GPU	Intel Corporation TigerLake-LP GT2 [Iris Xe Graphics] (rev 01) — i915
Session type	X11 (io.elementary.gala@x11.service)
gala	8.5.0+r3045+pkg130~ubuntu8.1
libgala0	8.5.0+r3045+pkg130~ubuntu8.1
mutter-common	46.2-1ubuntu0.24.04.15
Display manager	LightDM

How to reproduce (in my case)

1. Boot into the Pantheon (X11) session.
2. Connect an external monitor through the laptop's HDMI port.
3. Use the desktop normally — open Chrome, Termius, WebStorm, OnlyOffice, switch workspaces, use 3/4-finger gestures.
4. Within minutes, gala crashes. systemd auto-restarts it 3–4 times, then bails out and the session ends.

I have not yet tested the Wayland session — filing this for the X11 path because it's the default selected by LightDM here.

Two distinct crash signatures

Both occurred today within seconds of each other. They reproduce repeatedly across reboots.

Signature A — SIGSEGV in gala_utils_x11_set_window_pass_through

PID 24433 (gala) — Signal 11 (SEGV)
kernel: gala[24433]: segfault at 0 ip 00007e138b4288a6 sp 00007ffe2de907c0
        error 4 in libgala.so.0.0.0[1c8a6,7e138b41f000+2b000]

Stack trace of thread 24433:
#0  gala_utils_x11_set_window_pass_through       (libgala.so.0 + 0x1c8a6)
#1  n/a                                          (gala       + 0x6e5e5)
#2  n/a                                          (gala       + 0x6d5fc)
#3  n/a                                          (libgala.so.0 + 0x30e22)
#4  g_closure_invoke                             (libgobject-2.0.so.0 + 0x152fa)
#5  n/a                                          (libgobject-2.0.so.0 + 0x44c79)
#6  n/a                                          (libgobject-2.0.so.0 + 0x35591)
#7  g_signal_emit_valist                         (libgobject-2.0.so.0 + 0x357c1)
#8  g_signal_emit                                (libgobject-2.0.so.0 + 0x35883)
#9  n/a                                          (libmutter-clutter-14.so.0 + 0xac96b)
#10 n/a                                          (libmutter-clutter-14.so.0 + 0x618b8)
#11 n/a                                          (libglib-2.0.so.0 + 0x5d585)
#12 n/a                                          (libglib-2.0.so.0 + 0xbc977)
#13 g_main_loop_run                              (libglib-2.0.so.0 + 0x5df47)
#14 meta_context_run_main_loop                   (libmutter-14.so.0 + 0xd508a)
#15 n/a                                          (gala + 0x3f725)
#16 __libc_start_main                            (libc.so.6 + 0x2a28b)
#17 _start                                       (gala + 0x2bde5)

Immediately before the SEGV, the journal is flooded with:

gala[24433]: Can't update stage views actor unnamed [ClutterActor] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [ClutterClone] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [GalaWorkspaceRow] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [GalaWorkspaceClone] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [GalaWindowCloneContainer] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [GalaWindowClone] is on because it needs an allocation.

…and many clutter_actor_get_width: assertion 'CLUTTER_IS_ACTOR (self)' failed lines, suggesting an actor is being operated on after it has been destroyed (use-after-free / dangling Clutter actor).

Signature B — SIGABRT in gala_workspace_manager_thaw_remove

The restarted gala instance immediately hits an assertion failure while replaying gestures/workspace state:

gala[24734]: meta_sound_player_play_from_theme: assertion 'META_IS_SOUND_PLAYER (player)' failed
gala[24734]: gala_workspace_manager_get_default: assertion 'instance != null' failed
gala[24734]: gala_workspace_manager_freeze_remove: assertion 'self != NULL' failed
gala[24734]: Called enable_unredirect_for_display while unredirection is enabled.
gala[24734]: ERROR:src/gala.p/WorkspaceManager.c:313:gala_workspace_manager_thaw_remove:
             assertion failed: (remove_freeze_count >= 0)
gala[24734]: Bail out! ERROR:src/gala.p/WorkspaceManager.c:313:gala_workspace_manager_thaw_remove:
             assertion failed: (remove_freeze_count >= 0)

Relevant frames from the abort stack:

#5  gala_workspace_manager_thaw_remove  (gala + 0x5bd26)
#6  n/a                                 (gala + 0x7fdc4)
#7  gala_gesture_controller_jump        (libgala.so.0 + 0x33f3a)
…
#14 n/a                                 (gala + 0x56c48)
#27 n/a                                 (gala + 0x3f725)
#30 _start                              (gala + 0x2bde5)

So remove_freeze_count is going negative — the freeze/thaw calls in WorkspaceManager get mis-paired when a gesture transitions while workspace state is also being reshuffled (which I believe is what happens when the HDMI hotplug forces Mutter to reconfigure monitors mid-gesture).

Service-level fallout

systemd[3661]: io.elementary.gala@x11.service: Main process exited, code=dumped, status=6/ABRT
systemd[3661]: io.elementary.gala@x11.service: Failed with result 'core-dump'.
systemd[3661]: io.elementary.gala@x11.service: Scheduled restart job, restart counter is at 4.
systemd[3661]: io.elementary.gala@x11.service: Start request repeated too quickly.
systemd[3661]: io.elementary.gala@x11.service: Failed with result 'core-dump'.
systemd[3661]: Stopped target io.elementary.gala.target - Gala.
xdg-desktop-por[10203]: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown:
                        The name org.pantheon.gala was not provided by any .service files

LightDM then tears down the session.

Frequency

15 core dumps from /usr/bin/gala on 2026-05-11 alone, alternating between SIGTRAP, SIGSEGV and SIGABRT every few minutes once the crash loop starts:

09:54:55  SIGABRT
10:37:19  SIGTRAP
10:37:30  SIGABRT
10:46:49  SIGTRAP
10:47:08  SIGABRT
11:49:29  SIGTRAP
11:49:39  SIGABRT
11:51:53  SIGTRAP
11:52:03  SIGABRT
11:54:13  SIGTRAP
11:54:28  SIGABRT
12:28:34  SIGTRAP
12:28:36  SIGSEGV
12:28:37  SIGABRT
12:28:39  SIGABRT

What I think is happening

When the external HDMI monitor is connected, the kernel signals an output reconfiguration to Mutter/gala. While gala is in the middle of an animation or gesture (the gesture_controller_jump frame is the tell), workspace freeze/thaw counters fall out of sync and a Clutter actor is destroyed while still being referenced by gala_utils_x11_set_window_pass_through. Either path lands in an unrecoverable state.

This is consistent with set_window_pass_through operating on the X11 pass-through window list, which gets rebuilt whenever monitor geometry changes.

What I will try next

Switching to the Wayland session (pantheon-wayland.desktop is installed) to see whether the same workload reproduces it there. I'll add a comment once I have data.

Attachments

Full coredumpctl info output for the two representative crashes is attached.

• gala_crash_segv.txt — PID 24433, SIGSEGV (Signature A)
• gala_crash_abrt.txt — PID 24734, SIGABRT (Signature B)

Steps to Reproduce

1. Boot into the Pantheon session on X11 (the default selected by LightDM).
2. Connect any external display through the laptop's HDMI port — the bug is
   not monitor-specific; it has reproduced with multiple different monitors.
3. Open a handful of regular applications (in my case: Chrome, Termius,
   WebStorm, OnlyOffice).
4. Switch between windows using Alt+Tab as you normally would during work.

Within minutes — sometimes seconds — Alt+Tab triggers a gala crash. systemd
auto-restarts gala 3–4 times; each restarted instance also crashes (the
second crash signature, the WorkspaceManager assertion). After the restart
counter is exhausted, systemd gives up with "Start request repeated too
quickly" and the entire desktop session is torn down by LightDM, forcing a
re-login.

When the laptop is used without the external HDMI monitor, the same Alt+Tab
usage does NOT crash gala. The crash only manifests while the HDMI output
is active.

Expected: Alt+Tab cycles between windows normally.
Actual: gala segfaults (SIGSEGV in gala_utils_x11_set_window_pass_through),
then its restart hits ERROR in gala_workspace_manager_thaw_remove
and the whole session dies.

Expected Behavior

.

OS Version

8.x (Circe)

OS Architecture

amd64 (on most hardwares)

Session Type

Secure Session (Wayland, This is the default)

Software Version

Latest release (I have run all updates)

Log Output

Hardware Info

No response

[peteruithoven]

I feel like I'm experiencing the same issue. But your issue is a bit confusing

• you're providing multiple how to reproduce
• The title and the first part of the body seems to be about X11, but then the second part, after more testing is about Wayland and the Session Type at the end just says Wayland. Maybe clarify that you're running into an issue on both? And maybe clarify which part of the issue is about X11 and which about Wayland?

For me, just testing on Wayland, I've just figured out it happens when

1. Laptop with external monitor connected over DP (it doesn't seem to matter which monitor is primary)
2. Logging into Wayland session
3. Starting a applications
4. With mouse on external monitor I can alt+tab just fine
5. Move the mouse to my laptop screen
6. Press alt+tab, full crash, logged out of session.

This does not happen without the external monitor or when I close the laptop and just use the external monitor.

Willobm, does it make a difference for you on which monitor you alt+tab?

Setup:

• External monitor: 3840x2160 60Hz 200%
• Laptop screen: 2880x1920 120Hz 200%
• 12 × AMD Ryzen AI 9 HX 370 w/ Radeon 890M
• elementary OS 8.1
• Built on Ubuntu 24.04.4 LTS
• Linux 6.16.12-061612-generic

Observed and analyzed crash details using GPT-5.4:

Latest coredump:

• Signal: TRAP
• User unit: io.elementary.gala@wayland.service

Top of the crashing thread:

• g_malloc0
• libgala.so.0 + 0x2cb76
• clutter_actor_continue_paint
• clutter_paint_node_paint
• clutter_actor_paint
• meta_context_run_main_loop

Resolving libgala.so.0 + 0x2cb76 against a local build points to Gala’s window snapshot helper:

• gala_utils_get_window_actor_snapshot()
• source location: lib/Utils.vala:232

Relevant journal lines immediately before the crash

• meta_window_set_stack_position_no_sync: assertion 'window->stack_position >= 0' failed
• clutter_actor_get_width: assertion 'CLUTTER_IS_ACTOR (self)' failed
• clutter_actor_get_height: assertion 'CLUTTER_IS_ACTOR (self)' failed
• gala_drawing_canvas_set_size: assertion 'new_width >= -1 && new_height >= -1' failed
• clutter_paint_volume_set_width: assertion 'width >= 0.0f' failed
• failed to allocate 18446744073708736364 bytes

Why this seems relevant
The latest crash does not look like a generic X11 path issue. It appears to happen in the Wayland compositor during a paint/snapshot path, and the logging suggests invalid or negative geometry reaches window snapshot rendering shortly before Gala aborts.

Possible code path
The resolved snapshot helper is called from the size-change animation path in WindowManager.vala:1123, where Gala snapshots a window actor using the old frame rect before animating a size change.

[peteruithoven]

I just updated from Gala 8.5.0 to Gala 8.5.1 and it seems to have solves the issue for me on Wayland.