Crash with Wacom tablet when clicking top menu bar
Gnome crashes with Wacom tablet when clicking top menu bar with the tablet pen.
Affected version
- mutter 45.0-1 and 45.0+r49+g8d3d8b86-1
- Arch Linux, using XOrg
- Tested with kernel versions 6.5.8-arch1-1 and 6.1.59-1-lts
- Tablet: Wacom Intuos3 9x12
possibly relevant: nVidia RTX 2070 GPU, two monitors, Wacom tablet mapped to one of them
Bug summary
Gnome crashes with Wacom tablet when clicking top menu bar with the tablet pen. The logs show a message when the input device is detected, then an assertion failiure:
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (II) libinput: Wacom Intuos3 9x12 Pen: needs a virtual subdevice
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Wacom Intuos3 9x12 Pen Pen (0x7504ad1): Applying InputClass "evdev tablet catchall"
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Wacom Intuos3 9x12 Pen Pen (0x7504ad1): Applying InputClass "libinput tablet catchall"
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (II) Using input driver 'libinput' for 'Wacom Intuos3 9x12 Pen Pen (0x7504ad1)'
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (II) systemd-logind: returning pre-existing fd for /dev/input/event4 13:68
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Wacom Intuos3 9x12 Pen Pen (0x7504ad1): always reports core events
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Option "Device" "/dev/input/event4"
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (II) libinput: Wacom Intuos3 9x12 Pen Pen (0x7504ad1): is a virtual subdevice
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:14.0/usb3/3-4/3-4:1.0/0003:056A:00B2.0001/input/input8/event4"
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (II) XINPUT: Adding extended input device "Wacom Intuos3 9x12 Pen Pen (0x7504ad1)" (type: STYLUS, id 13)
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Option "AccelerationScheme" "none"
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Wacom Intuos3 9x12 Pen Pen (0x7504ad1): (accel) selected scheme none/0
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Wacom Intuos3 9x12 Pen Pen (0x7504ad1): (accel) acceleration factor: 2.000
Oct 23 20:25:32 urk /usr/lib/gdm-x-session[5983]: (**) Wacom Intuos3 9x12 Pen Pen (0x7504ad1): (accel) acceleration threshold: 4
Oct 23 20:25:32 urk gnome-shell[6105]: **
Oct 23 20:25:32 urk gnome-shell[6105]: Clutter:ERROR:../mutter/clutter/clutter/clutter-stage.c:3374:clutter_stage_emit_crossing_event: assertion failed: (entry != NULL)
Possibly related: #3112 (closed) also input-device related, back-trace points to similar event emission functions (?).
Steps to reproduce
The crash is repeatable on my system. Moving the cursor with the pen hovering over the tablet is ok. Clicking (pressing down the pen against the tablet) leads to a crash. Always on clicking the date display at the top of the screen, not sure if always when clicking the empty desktop.
Syslog lines, with backtrace
Oct 23 20:48:37 urk gnome-shell[2172]: Clutter:ERROR:../mutter/clutter/clutter/clutter-stage.c:3374:clutter_stage_emit_crossing_event: assertion failed:>
Oct 23 20:48:37 urk gnome-shell[2172]: Bail out! Clutter:ERROR:../mutter/clutter/clutter/clutter-stage.c:3374:clutter_stage_emit_crossing_event: asserti>
Oct 23 20:48:37 urk gnome-shell[2172]: == Stack trace for context 0x55d6f2743840 ==
Oct 23 20:48:37 urk gnome-shell[2172]: #0 55d6f280eb08 i resource:///org/gnome/shell/ui/init.js:21 (3385fbe70ba0 @ 48)
Oct 23 20:48:37 urk systemd[1]: Created slice Slice /system/systemd-coredump.
Oct 23 20:48:37 urk systemd[1]: Started Process Core Dump (PID 2909/UID 0).
Oct 23 20:48:38 urk systemd-coredump[2910]: [🡕] Process 2172 (gnome-shell) of user 1000 dumped core.
Stack trace of thread 2172:
#0 0x00007fb0a94ac83c n/a (libc.so.6 + 0x8e83c)
#1 0x00007fb0a945c668 raise (libc.so.6 + 0x3e668)
#2 0x000055d6f0c3a109 n/a (gnome-shell + 0x4109)
#3 0x00007fb0a945c710 n/a (libc.so.6 + 0x3e710)
#4 0x00007fb0a94ac83c n/a (libc.so.6 + 0x8e83c)
#5 0x00007fb0a945c668 raise (libc.so.6 + 0x3e668)
#6 0x00007fb0a94444b8 abort (libc.so.6 + 0x264b8)
#7 0x00007fb0a9c260ee n/a (libglib-2.0.so.0 + 0x1e0ee)
#8 0x00007fb0a9c87180 g_assertion_message_expr (libglib-2.0.so.0 + 0x7f180)
#9 0x00007fb0a9a1233c n/a (libmutter-clutter-13.so.0 + 0xb533c)
#10 0x00007fb0a9a16653 clutter_stage_update_device (libmutter-clutter-13.so.0 + 0xb9653)
#11 0x00007fb0a99ee0ef clutter_stage_handle_event (libmutter-clutter-13.so.0 + 0x910ef)
#12 0x00007fb0a970ce10 n/a (libmutter-13.so.0 + 0x10ce10)
#13 0x00007fb0a9c61f19 n/a (libglib-2.0.so.0 + 0x59f19)
#14 0x00007fb0a9cc02b7 n/a (libglib-2.0.so.0 + 0xb82b7)
#15 0x00007fb0a9c62b47 g_main_loop_run (libglib-2.0.so.0 + 0x5ab47)
#16 0x00007fb0a96d7bdb meta_context_run_main_loop (libmutter-13.so.0 + 0xd7bdb)
#17 0x00007fb0a8b374f6 n/a (libffi.so.8 + 0x74f6)
#18 0x00007fb0a8b33f5e n/a (libffi.so.8 + 0x3f5e)
#19 0x00007fb0a8b36b73 ffi_call (libffi.so.8 + 0x6b73)
#20 0x00007fb0a9aedce8 n/a (libgjs.so.0 + 0x4dce8)
#21 0x00007fb0a9aee378 n/a (libgjs.so.0 + 0x4e378)
#22 0x00007fb0a806b198 n/a (libmozjs-115.so + 0x166b198)
#23 0x00007fb0a7d0882d n/a (libmozjs-115.so + 0x130882d)
#24 0x00007fb0a7cfb55d n/a (libmozjs-115.so + 0x12fb55d)
#25 0x00007fb0a81ce703 _ZN2JS4CallEP9JSContextNS_6HandleINS_5ValueEEES4_RKNS_16HandleValueArrayENS_13Mutable>
#26 0x00007fb0a9b2b312 n/a (libgjs.so.0 + 0x8b312)
#27 0x00007fb0a9b3338f gjs_context_eval_module (libgjs.so.0 + 0x9338f)
#28 0x00007fb0a9b33581 gjs_context_eval_module_file (libgjs.so.0 + 0x93581)
#29 0x000055d6f0c3957f n/a (gnome-shell + 0x357f)
#30 0x00007fb0a9445cd0 n/a (libc.so.6 + 0x27cd0)
#31 0x00007fb0a9445d8a __libc_start_main (libc.so.6 + 0x27d8a)
#32 0x000055d6f0c399e5 n/a (gnome-shell + 0x39e5)
Attempt at backtrace with debug symbols. Probably from a different crash than above.
#10 0x00007fbac62f8180 in g_assertion_message_expr
(domain=0x7fbac60b7015 "Clutter", file=0x7fbac60c3838 "../mutter/clutter/clutter/clutter-stage.c", line=3374, func=0x7fbac60d26c0 "clutter_stage_emit_crossing_event", expr=<optimized out>) at ../glib/glib/gtestutils.c:3523
s = 0x556063d47700 "assertion failed: (entry != NULL)"
#11 0x00007fbac608333c in () at /usr/lib/mutter-13/libmutter-clutter-13.so.0
--Type <RET> for more, q to quit, c to continue without paging--
#12 0x00007fbac6087633 in clutter_stage_update_device () at /usr/lib/mutter-13/libmutter-clutter-13.so.0
#13 0x00007fbac605f0ef in clutter_stage_handle_event () at /usr/lib/mutter-13/libmutter-clutter-13.so.0
#14 0x00007fbac5d0ce10 in () at /usr/lib/libmutter-13.so.0
#15 0x00007fbac62d2f19 in g_main_dispatch (context=0x556060554d80) at ../glib/glib/gmain.c:3476
dispatch = 0x7fbac5d0c5c0
prev_source = 0x0
begin_time_nsec = 67378523297498
was_in_call = 0
user_data = 0x0
callback = 0x0
cb_funcs = 0x0
cb_data = 0x0
need_destroy = <optimized out>
source = 0x556060d63810
current = 0x55606055df10
i = 0
__func__ = "g_main_dispatch"
#16 0x00007fbac63312b7 in g_main_context_dispatch_unlocked (context=0x556060554d80) at ../glib/glib/gmain.c:4284
max_priority = 2147483647
timeout = 16
some_ready = 1
nfds = 16
allocated_nfds = 18
fds = 0x556060f0a170
begin_time_nsec = 67378519175807
#17 g_main_context_iterate_unlocked.isra.0 (context=0x556060554d80, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4349
max_priority = 2147483647
timeout = 16
some_ready = 1
nfds = 16
allocated_nfds = 18
fds = 0x556060f0a170
begin_time_nsec = 67378519175807
#18 0x00007fbac62d3b47 in g_main_loop_run (loop=0x556060da9390) at ../glib/glib/gmain.c:4551
__func__ = "g_main_loop_run"
#19 0x00007fbac5cd7bdb in meta_context_run_main_loop () at /usr/lib/libmutter-13.so.0
#20 0x00007fbac519f4f6 in ffi_call_unix64 () at ../src/x86/unix64.S:104
#21 0x00007fbac519bf5e in ffi_call_int (cif=cif@entry=0x556060e97190, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>, closure=closure@entry=0x0) at ../src/x86/ffi64.c:673
classes = {X86_64_INTEGER_CLASS, X86_64_NO_CLASS, 20, X86_64_NO_CLASS}
stack = <optimized out>
argp = 0x7fff4c412480 "\003"
arg_types = <optimized out>
gprcount = 2
ssecount = <optimized out>
ngpr = 1
nsse = 0
i = <optimized out>
avn = <optimized out>
flags = <optimized out>
reg_args = <optimized out>
#22 0x00007fbac519eb73 in ffi_call (cif=0x556060e97190, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>) at ../src/x86/ffi64.c:710
arg_types = 0x556060e97c40
--Type <RET> for more, q to quit, c to continue without paging--
i = <optimized out>
nargs = 2
max_reg_struct_size = <optimized out>
#23 0x00007fbac615ece8 in Gjs::Function::invoke(JSContext*, JS::CallArgs const&, JS::Handle<JSObject*>, _GIArgument*) (this=0x556060e97170, context=0x556060581940, args=..., this_obj=..., r_value=0x0)
at ../gjs/gi/function.cpp:1058
return_value_p = <optimized out>
return_value = {v_boolean = 1279338112, v_int8 = -128 '\200', v_uint8 = 128 '\200', v_int16 = 9856, v_uint16 = 9856, v_int32 = 1279338112, v_uint32 = 1279338112, v_int64 = 140734472726144, v_uint64 = 140734472726144, v_float = 50633216, v_double = 6.9532068159569633e-310, v_short = 9856, v_ushort = 9856, v_int = 1279338112, v_uint = 1279338112, v_long = 140734472726144, v_ulong = 140734472726144, v_ssize = 140734472726144, v_size = 140734472726144, v_string = 0x7fff4c412680 "X\031X``U", v_pointer = 0x7fff4c412680}
ffi_argc = 2
state = Python Exception <class 'gdb.error'>: No type named std::__detail::_Hash_node<union _GIArgument *, false>.
{m_in_cvalues = {m_ptr = 0x556060e8a7b0}, m_out_cvalues = {m_ptr = 0x556060e970a0}, m_inout_original_cvalues = {m_ptr = 0x5560606bf050}, ignore_release = std::unordered_set with 0 elements, instance_object = {<js::TypedRootedGCThingBase<js::StackRootedBase, JSObject*>> = {<js::StackRootedBase> = {stack = 0x556060581958, prev = 0x7fff4c4128a0}, <No data fields>}, <js::RootedOperations<JSObject*, JS::Rooted<JSObject*> >> = {<js::MutableWrappedPtrOperations<JSObject*, JS::Rooted<JSObject*> >> = {<js::WrappedPtrOperations<JSObject*, JS::Rooted<JSObject*>, void>> = {<No data fields>}, <No data fields>}, <No data fields>}, ptr = 0x37bc54cb6808}, return_values = {<JS::Rooted<JS::StackGCVector<JS::Value, js::TempAllocPolicy> >> = {<js::TypedRootedTraceableBase<js::StackRootedTraceableBase, JS::StackGCVector<JS::Value, js::TempAllocPolicy> >> = {<js::StackRootedTraceableBase> = {<js::StackRootedBase> = {stack = 0x5560605819b0, prev = 0x7fff4c412b80}, <js::VirtualTraceable> = {_vptr.VirtualTraceable = 0x7fbac6270800 <vtable for JS::RootedVector<JS::Value>+16>}, <No data fields>}, <No data fields>}, <js::RootedOperations<JS::StackGCVector<JS::Value, js::TempAllocPolicy>, JS::Rooted<JS::StackGCVector<JS::Value, js::TempAllocPolicy> > >> = {<js::MutableWrappedPtrOperations<JS::StackGCVector<JS::Value, js::TempAllocPolicy>, JS::Rooted<JS::StackGCVector<JS::Value, js::TempAllocPolicy> > >> = {<js::MutableWrappedPtrOperations<JS::GCVector<JS::Value, 8, js::TempAllocPolicy>, JS::Rooted<JS::StackGCVector<JS::Value, js::TempAllocPolicy> > >> = {<js::WrappedPtrOperations<JS::GCVector<JS::Value, 8, js::TempAllocPolicy>, JS::Rooted<JS::StackGCVector<JS::Value, js::TempAllocPolicy> >, void>> = {<No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, ptr = {<JS::GCVector<JS::Value, 8, js::TempAllocPolicy>> = {vector = {<js::TempAllocPolicy> = {<js::AllocPolicyBase> = {<No data fields>}, static JsContextTag = 1, context_bits_ = 93872421607745}, static kElemIsPod = false, static kMaxInlineBytes = 992, static kInlineCapacity = 8, mBegin = 0x7fff4c4127f0, mLength = 0, mTail = {<mozilla::Vector<JS::Value, 8, js::TempAllocPolicy>::CapacityAndReserved> = {mCapacity = 8}, mBytes = "+\000\000\000\000\200\370\377\260\247\350``U\000\000\000\000\000\000\000\000\000\000\030)AL\377\177\000\000p(AL\377\177\000\000\251/qĺ\177\000\000\360{\351``U\000\000p,AL\377\177\000"}}}, <No data fields>}}, <No data fields>}, local_error = {<GjsAutoPointer<_GError, _GError, g_error_free, GjsAutoErrorFuncs::error_copy>> = {m_ptr = 0x0}, <No data fields>}, info = 0x556060e97bf0, gi_argc = 0 '\000', processed_c_args = 1 '\001', failed = false, can_throw_gerror = true, is_method = true}
ffi_arg_pointers = std::unique_ptr<void *[]> = {get() = 0x556060e97200}
gi_arg_pos = <optimized out>
ffi_arg_pos = 2
js_arg_pos = <optimized out>
obj = {<js::TypedRootedGCThingBase<js::StackRootedBase, JSObject*>> = {<js::StackRootedBase> = {stack = 0x556060581958, prev = 0x7fff4c4127a0}, <No data fields>}, <js::RootedOperations<JSObject*, JS::Rooted<JSObject*> >> = {<js::MutableWrappedPtrOperations<JSObject*, JS::Rooted<JSObject*> >> = {<js::WrappedPtrOperations<JSObject*, JS::Rooted<JSObject*>, void>> = {<No data fields>}, <No data fields>}, <No data fields>}, ptr = 0x37bc54cb6808}
dynamicString = "MetaContextMain.method Meta.Context.run_main_loop"
label = {m_stack = 0x0}
errorp = 0x7fff4c412830
return_type = <optimized out>