Dear Maintainer,

Immediately after upgrading from verstion 3.24.43-5 to 3.24.48-4
my mailclient 'balsa' started to crash reproducably every time
when the mouse pointer is hovering into the addresses/subject
frame of a received message.

Downgrading libgtk-3-0t64 and libgtk-common to version 3.24.43-5
immediately solved the problem.

way to achieve this is by using systemd-coredump.

More information: https://wiki.debian.org/HowToGetABacktrace

Thanks,
    smcv

Hello,

I believe I am experiencing the same issue. It may be causing problems
with x11rb; see related issue with Zed
<https://github.com/zed-industries/zed/issues/29083#issuecomment-2907005604>
which led me to look in this direction.

I have followed the "HowToGetABacktrace" page and installed debug
symbols that I think are relevant. I have a bunch of coredumps available
via systemd-coredump.

Here's my dmesg segfault:

[  284.036140] ibus-x11[2813]: segfault at 2ce ip 00007f0c79604356 sp
00007ffe766e79b0 error 4 in
libgdk-3.so.0.2417.32[9c356,7f0c79596000+87000] likely on CPU 5 (core 2,
socket 0)
[  284.036175] Code: 4c 89 0c 24 e8 db f0 ff ff 44 8b 54 24 18 41 81 e2
ff 9f ff ff 45 09 d4 44 3a 68 0c 0f 82 c2 01 00 00 48 8b 78 20 41 0f b6
cd <48> 8b 57 20 48 8d 0c ca 44 0f b6 41 04 44 89 c6 83 e6 0f 44 38 68

Here's the info for the coredump I'll show the backtrace of below:

PID: 2887 (ibus-x11)
           UID: 1000 (matt)
           GID: 1000 (matt)
        Signal: 6 (ABRT)
     Timestamp: Sun 2025-05-25 11:03:15 ADT (22min ago)
  Command Line: /usr/libexec/ibus-x11 --kill-daemon
    Executable: /usr/libexec/ibus-x11
Control Group: /user.slice/user-1000.slice/session-3.scope
          Unit: session-3.scope
         Slice: user-1000.slice
       Session: 3
     Owner UID: 1000 (matt)
       Boot ID: ------
    Machine ID: -----
      Hostname: ------
       Storage:
/var/lib/systemd/coredump/core.ibus-x11.1000.e378e9f2f3cb4de889a510235a84ae60.2887.1748181795000000.zst
(present)
  Size on Disk: 1.6M
       Message: Process 2887 (ibus-x11) of user 1000 dumped core.

Here's a backtrace from the same:

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6, no_tid=no_tid@entry=0)
    at ./nptl/pthread_kill.c:44
#1  0x00007f019578d9ff in __pthread_kill_internal (threadid=<optimized
out>, signo=6)
    at ./nptl/pthread_kill.c:89
#2  0x00007f0195738cc2 in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
#3  0x00007f01957214ac in __GI_abort () at ./stdlib/abort.c:73
#4  0x00007f0195722291 in __libc_message_impl
(fmt=fmt@entry=0x7f01958a432d "%s\n")
    at ../sysdeps/posix/libc_fatal.c:134
#5  0x00007f0195797465 in malloc_printerr
    (str=str@entry=0x7f01958a74d0 "corrupted size vs. prev_size in
fastbins") at ./malloc/malloc.c:5829
#6  0x00007f019579802c in malloc_consolidate (av=av@entry=0x7f01958e0ac0
<main_arena>)
    at ./malloc/malloc.c:4924
#7  0x00007f019579a858 in _int_malloc (av=av@entry=0x7f01958e0ac0
<main_arena>, bytes=bytes@entry=2560)
    at ./malloc/malloc.c:4099

#8  0x00007f019579cf47 in __libc_calloc (n=n@entry=2560,
elem_size=elem_size@entry=1)
    at ./malloc/malloc.c:3844
#9  0x00005616353bf94b in _Xi18nChangeIC
--Type <RET> for more, q to quit, c to continue without paging--
    (ims=ims@entry=0x56164b8ae4d0,
call_data=call_data@entry=0x7ffdd1fb72c0, p=p@entry=0x56164ba744c4 "\001",
create_flag=create_flag@entry=0) at ./util/IMdkit/i18nIc.c:697
#10 0x00005616353bdebc in SetICValuesMessageProc
    (ims=0x56164b8ae4d0, call_data=0x7ffdd1fb72c0, p=0x56164ba744c4
"\001") at ./util/IMdkit/i18nPtHdr.c:923
#11 _Xi18nMessageHandler
    (ims=ims@entry=0x56164b8ae4d0, connect_id=1,
p=p@entry=0x56164ba744c0 "6", delete=delete@entry=0x7ffdd1fb7
510) at ./util/IMdkit/i18nPtHdr.c:1849
#12 0x00005616353b7f3b in WaitXIMProtocol
    (dpy=<optimized out>, win=<optimized out>, ev=<optimized out>,
client_data=0x56164b8ae4d0 "@a<5\026V")
    at ./util/IMdkit/i18nX.c:524
#13 0x00007f0195c923d6 in _gdk_x11_display_queue_events
(display=0x56164b7fdb00 [GdkX11Display])
    at ../../../gdk/x11/gdkeventsource.c:337

#14 0x00007f0195c36e24 in gdk_display_get_event
(display=display@entry=0x56164b7fdb00 [GdkX11Display])
    at ../../../gdk/gdkdisplay.c:442
#15 0x00007f0195c92216 in gdk_event_source_dispatch
    (source=<optimized out>, callback=<optimized out>,
user_data=<optimized out>)
    at ../../../gdk/x11/gdkeventsource.c:363
#16 0x00007f0195a9c345 in g_main_dispatch
(context=context@entry=0x56164b8a0000)
    at ../../../glib/gmain.c:3398
#17 0x00007f0195a9e577 in g_main_context_dispatch_unlocked
(context=0x56164b8a0000)
    at ../../../glib/gmain.c:4249
#18 g_main_context_iterate_unlocked
    (context=0x56164b8a0000, block=block@entry=1,
dispatch=dispatch@entry=1, self=<optimized out>)
    at ../../../glib/gmain.c:4314
#19 0x00007f0195a9efdf in g_main_loop_run (loop=0x7f01580025f0) at
../../../glib/gmain.c:4516
#20 0x00007f0195d4d650 in ibus_main () at ./src/ibusshare.c:415
#21 0x00005616353b2c7c in main (argc=<optimized out>, argv=<optimized
out>) at ./client/x11/main.c:1456