Dear Maintainer,

mate-panel crashes as soon as the GTK theme Blackbird (package
blackbird-gtk-theme) is selected in Appearance Preferences, and at every
start while Blackbird is set, so the session ends up without panels.

Seen on trixie, X11, two monitors, with mate-panel 1.27.1-4.1 (and a
local rebuild of it), libgtk-3-0t64 3.24.49-3, libcairo2 1.18.4-1+b1,
blackbird-gtk-theme 0.4+20171213-4.

Steps to reproduce:
1. apt install blackbird-gtk-theme
2. In Appearance Preferences (mate-appearance-properties), select the
    theme Blackbird.
mate-panel crashes. Whether and where exactly it crashes depends on the
stack contents (see below); here it crashed every time.

Cause:
mate-panel/panel-background.c, panel_background_prepare(), case
PANEL_BACK_NONE:

     cairo_surface_t *surface;

     cairo_pattern_get_surface(background->default_pattern, &surface);
     /* catch invalid images (e.g. -gtk-gradient) before scaling and
rendering */
     if (surface != NULL ){
         ...
         cairo_surface_reference(surface);

default_pattern is the theme's background-image
(set_background_default_style()
in panel-toplevel.c). For background-image: -gtk-gradient(...), GTK 3.24
returns the gradient's own cairo pattern (css_image_value_query() in
gtk/gtkcssstylepropertyimpl.c); for other images it returns a surface
pattern. For a gradient pattern, cairo_pattern_get_surface() returns
CAIRO_STATUS_PATTERN_TYPE_MISMATCH and does not write to surface. The
return value is ignored and surface is uninitialized, so the check that
is meant to catch exactly this case tests stack garbage. Blackbird sets
background-image: -gtk-gradient(...) for PanelToplevel
(gtk-3.20/apps/gnome-applications.css).

Backtraces, from a local rebuild 1.27.1-4.1+armin1 with its dbgsym. It
differs from 1.27.1-4.1 only by an unrelated wnck-pager patch; Debian's
build crashed at the same offset (mate-panel + 0x4007a, line 112).

1. SIGSEGV when selecting the theme:
#0  cairo_surface_reference () from libcairo.so.2
#1  panel_background_prepare (background=0x555eb3f90dc0) at
panel-background.c:112
#2  set_background_default_style (widget=0x555eb3f90d70) at
panel-toplevel.c:2961

2. SIGABRT, cairo's reference count assertion in the same call:
#4  __assert_fail_base (..., line=939, ...) at ./assert/assert.c:118
#5  ?? () from libcairo.so.2
#6  panel_background_prepare (background=0x55c6f20dece0) at
panel-background.c:112
#7  set_background_region (toplevel=0x55c6f20dec90) at panel-toplevel.c:3195

3. SIGSEGV at startup, after the garbage pointer survived the reference:
#0  gdk_window_set_background_pattern () from libgdk-3.so.0
#1  panel_background_prepare (background=0x55a272a94da0) at
panel-background.c:121
#2  set_background_region (toplevel=0x55a272a94d50) at panel-toplevel.c:3195
#4  panel_toplevel_size_allocate (widget=0x55a272a94d50, ...) at
panel-toplevel.c:3274

The attached patch initializes the pointer and checks the return value,
so such a theme falls back to the background color with the existing
warning, as the code intends. Tested on the affected machine with
1.27.1-4.1 plus this patch: no crash when selecting Blackbird or when
starting with Blackbird set; the warning "unsupported value of
'background-image' in GTK+ theme" appears instead.

The code is unchanged in mate-panel 1.28.x and master. Related reports,
closed without a code change or not handled:
https://github.com/mate-desktop/mate-panel/issues/1249
https://github.com/mate-desktop/mate-panel/issues/1352
https://bugs.launchpad.net/ubuntu/+source/mate-panel/+bug/1986453
I will forward the patch upstream and add the link here.

Regards,
Armin Fuerst

Forwarded upstream:
report:       https://github.com/mate-desktop/mate-panel/issues/1586
pull request: https://github.com/mate-desktop/mate-panel/pull/1587
The pull request contains the same change as the attached patch.

For transparency, as also stated upstream: the analysis and the patch
were prepared with AI assistance (Claude Opus 5.5); I reproduced the
crash, built and tested the fix, and reviewed the change.

Regards,
Armin Fuerst

Hello,

Bug #1150554 in mate-panel reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian-mate-team/mate-panel/-/commit/23fa83ad4aebe0c998f5fb7e0625254d73b647f1
------------------------------------------------------------------------
debian/patches: Add 1001-panel-background-fix-uninitialized-surface.patch. Fix crash with gradient background-image in the GTK theme  panel_background_prepare() passes an uninitialized pointer to  cairo_pattern_get_surface() and ignores its return value. (Closes: #1150554).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1150554

We believe that the bug you reported is fixed in the latest version of
mate-panel, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150554@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mike Gabriel <sunweaver@debian.org> (supplier of updated mate-panel package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 10 Oct 2026 21:37:45 +0200
Source: mate-panel
Architecture: source
Version: 1.27.1-6
Distribution: unstable
Urgency: medium
Maintainer: Debian+Ubuntu MATE Packaging Team <debian-mate@lists.debian.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Closes: 1150554
Changes:
 mate-panel (1.27.1-6) unstable; urgency=medium
 .
   * debian/patches:
     + Add 1001-panel-background-fix-uninitialized-surface.patch. Fix crash with
       gradient background-image in the GTK theme  panel_background_prepare()
       passes an uninitialized pointer to  cairo_pattern_get_surface() and
       ignores its return value. (Closes: #1150554). Thanks to Amin Fuerst for
       submitting the patch.
Checksums-Sha1:
 f05337a5e46f15b0b12550f4eea46ace4309b1d0 3207 mate-panel_1.27.1-6.dsc
 487b1bb4f68de8361af5eefa4ce339490dc6e474 25388 mate-panel_1.27.1-6.debian.tar.xz
 a683e1565b39a91b3048c71be8f9348b19093c7c 21151 mate-panel_1.27.1-6_source.buildinfo
Checksums-Sha256:
 d424f8297b4acc4e64a2a28f9069b2c9137a503bda5e4d2bb0760c76a17391aa 3207 mate-panel_1.27.1-6.dsc
 dc4ffc3c7ad7c69abb952c02288739535007a37d4a362e5e67eb4ad732a09d59 25388 mate-panel_1.27.1-6.debian.tar.xz
 c7587c05d15a3d308c217eb8443eec307f3de02b9f200423992bab43062ef59b 21151 mate-panel_1.27.1-6_source.buildinfo
Files:
 bb4e6a7c4e1a675de9e57123514962d1 3207 x11 optional mate-panel_1.27.1-6.dsc
 dc11814d520424577e5185c5fdfe7584 25388 x11 optional mate-panel_1.27.1-6.debian.tar.xz
 10da10201af19fc412da390fa88446a7 21151 x11 optional mate-panel_1.27.1-6_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJJBAEBCgAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmrKlSsVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxIEoP/32Z/BkLLo5Crqo2H4S5pIxGlWis
O2pebdj+VRWLu0hypWtcHHcFMfbutlJWB1KXfMh3Ckwtw/Zkc7GImPuPfNFo5i91
1JerwsRDmNiT1XdEAe+PpvkYWvtUaRvN7lyWgnRTMiute4oU6rniPIFu5BjSAKSA
V1gSvwzn/9HKQt86MZI5HvmDW+mVa6WHaooq2tzyA7zwHIbjJWjD6VqnkyGw4P/d
tAJcFjWg3l2SQuuva7L3gWyE+sZ6gdK5KpHXh8OIEB1C0L2TJXclpTpQNuZaP/H9
aRHICOJ7jQoUDtILY1LoFugPmIuG1zcFIqorNpjtlyK5kJxI4VEo0Ama89/Wc8wF
mCPq0zkIRJ58nphWthAnxlJUInEnAqA5HTJkZt605GPJ1DABo4BS6DWrAWaAGpNt
smlobwlhxBl6BxUll8pdcAeclmZ3BWqhAqIVpgTg4AvJezkAnTlciBW7KZHEbKkR
Bnwo2+SlHCV0IariMgwMpAg9bu8Ebnfdybnyh31qZRmW9nR+GRPDbOvaGqjgWTCy
P63snjs73jujaMJF3SGKxS65YfyMFDcOPdxalhPjHqg6PJJ76uHLFQt5h+w+h+FU
iAn4WE+buttz7qdxci8EN0sq3Knlox2KJicX1lq/M9a6iQIL1Xya7R/U9n30si0F
6P18qmZ0UlI6oIxf
=Iboq
-----END PGP SIGNATURE-----