GNOME Shell crashes when a resize edge is touched with a finger #7

New issue

Closed

opened 2026-10-13 02:31:59 +00:00 by asxpi · 0 comments

asxpi commented

2026-10-13 02:31:59 +00:00

What happens

With the client-side title bar, the invisible resize edges (aim-window-frame, ui/src/views/window-controls.ts) call startResizeDragging on mousedown. WebKitGTK sends a mousedown for a touch too, so a finger on an edge makes Tauri/GTK send xdg_toplevel.resize with the touch's serial. If mutter has already cancelled that touch, it dereferences NULL:

#0 touch_can_grab_surface               (mutter src/wayland/meta-wayland-touch.c)
#1 meta_wayland_touch_find_grab_sequence
#2 meta_wayland_seat_get_grab_info
#3 xdg_toplevel_resize

kernel: .gnome-shell-wr[69083]: segfault at 0 ... error 4 in libmutter-18.so.0.0.0[1dcaa3,...]

meta_wayland_touch_cancel() clears focus_surface on every active touch but keeps each touch's serial until the finger lifts, and touch_can_grab_surface() reads touch_info->focus_surface->surface without a check. This is a mutter bug (any client can trigger it; mutter main still has the same code), but our resize edges are what set it off here.

Fix on our side

Have the edges react to pointerdown and skip pointerType === 'touch': a 6px edge is no target for a finger anyway, and mouse resizing stays as it is. A local change does this, with a case in ui/test/window-frame.test.ts (41/41 pass, tsc clean):

@pointerdown=${(e: PointerEvent) => {
    if (e.pointerType === 'touch' || e.button !== 0) return;
    e.preventDefault();
    e.stopPropagation();
    void frame.startResizeDragging(dir).catch(() => undefined);
}}

Moving the window by dragging the title bar with a finger (ui/src/views/window-drag.ts, startDragging → xdg_toplevel.move) goes through the same unchecked mutter code. It was not seen to crash and is worth keeping, but it may need the same guard if it does.

Upstream

The mutter fix is a NULL check in touch_can_grab_surface(); it is to be sent to GNOME/mutter. Until then, NixOS users can carry it as a patch on mutter.

On Linux under GNOME (Wayland, mutter 50.2), touching the window's resize edges with a finger can crash GNOME Shell, which ends the whole session. It happened four times on 2026-10-13 on a touchscreen laptop, always at the same address. ## What happens With the client-side title bar, the invisible resize edges (`aim-window-frame`, `ui/src/views/window-controls.ts`) call `startResizeDragging` on `mousedown`. WebKitGTK sends a `mousedown` for a touch too, so a finger on an edge makes Tauri/GTK send `xdg_toplevel.resize` with the touch's serial. If mutter has already cancelled that touch, it dereferences NULL: ``` #0 touch_can_grab_surface (mutter src/wayland/meta-wayland-touch.c) #1 meta_wayland_touch_find_grab_sequence #2 meta_wayland_seat_get_grab_info #3 xdg_toplevel_resize ``` ``` kernel: .gnome-shell-wr[69083]: segfault at 0 ... error 4 in libmutter-18.so.0.0.0[1dcaa3,...] ``` `meta_wayland_touch_cancel()` clears `focus_surface` on every active touch but keeps each touch's serial until the finger lifts, and `touch_can_grab_surface()` reads `touch_info->focus_surface->surface` without a check. This is a mutter bug (any client can trigger it; mutter `main` still has the same code), but our resize edges are what set it off here. ## Fix on our side Have the edges react to `pointerdown` and skip `pointerType === 'touch'`: a 6px edge is no target for a finger anyway, and mouse resizing stays as it is. A local change does this, with a case in `ui/test/window-frame.test.ts` (41/41 pass, `tsc` clean): ```ts @pointerdown=${(e: PointerEvent) => { if (e.pointerType === 'touch' || e.button !== 0) return; e.preventDefault(); e.stopPropagation(); void frame.startResizeDragging(dir).catch(() => undefined); }} ``` Moving the window by dragging the title bar with a finger (`ui/src/views/window-drag.ts`, `startDragging` → `xdg_toplevel.move`) goes through the same unchecked mutter code. It was not seen to crash and is worth keeping, but it may need the same guard if it does. ## Upstream The mutter fix is a NULL check in `touch_can_grab_surface()`; it is to be sent to GNOME/mutter. Until then, NixOS users can carry it as a patch on `mutter`.

asxpi referenced this issue

2026-10-13 02:36:49 +00:00

Touch at the window border: no GNOME Shell crash, resize and move by touch #8

asxpi referenced this issue

2026-10-13 03:22:11 +00:00

The window cannot be moved by touch #9