Dear Maintainer,

kwin_wayland segfaults when a display output is removed and then
re-enabled, e.g. via Power Management's "Turn off screen" idle action,
or DPMS screen-off followed by wake. All running applications (Firefox
in particular) crash along with the compositor, so the whole Wayland
session is lost.

This is an exact match for upstream KDE bug 504959, already fixed
upstream by commit e1fd647b979df7f0bd10065932a614a2aa806e87
("wayland: Make ColorManagementOutputV1 handle output removal better",
Vlad Zahorodnii, 2025-05-30). The fix is included in Plasma 6.4, but
trixie ships 6.3.6, which is affected.

Since wl_output removal is racy, a client can request
wp_color_manager_v1.get_output() after KWin has destroyed the
underlying handle but before the wl_output resource is gone. KWin then
dereferences a null pointer:

Core was generated by `/usr/bin/kwin_wayland --wayland-fd 7 ...'.
Program terminated with signal SIGSEGV, Segmentation fault.

#4  KWin::ColorManagementOutputV1::ColorManagementOutputV1
      (this=0x55951f72c7d0, client=<optimized out>, id=76,
       version=1, output=0x0)
      at ./src/wayland/colormanagement_v1.cpp:580
#5  ffi_call () from libffi.so.8
#8  wl_closure_invoke () from libwayland-server.so.0
#10 wl_event_loop_dispatch () from libwayland-server.so.0
#11 KWin::Display::dispatchEvents () at ./src/wayland/display.cpp:121

Reproducible: always, when the screen is turned off by the idle action
with Firefox running, then woken up.

Environment: Debian trixie, kwin-wayland 4:6.3.6-1, Intel graphics
(i915), Mesa 25.0.7, Wayland session.

Request: please backport the upstream fix (a small null-safety change
in src/wayland/colormanagement_v1.cpp/h) to the trixie package.
Upstream bug: https://bugs.kde.org/show_bug.cgi?id=504959
Upstream fix: https://invent.kde.org/plasma/kwin/-/commit/e1fd647b979df7f0bd10065932a614a2aa806e87

I can provide the full coredump on request.

Hey,

thanks for reporting the bug. Your reported issue is already reported in
#1147212 and there is an ongoing proposed-update for Trixie ( see #1150067 )
to bring the fix to Trixie. The proposed fix is the backport of upstream commits
e1fd647b and 172f8f2e.

Best regards,

hefee

Hey,

thanks for reporting the bug. Your reported issue is already reported in
#1147212 and there is an ongoing proposed-update for Trixie ( see #1150067 )
to bring the fix to Trixie. The proposed fix is the backport of upstream commits
e1fd647b and 172f8f2e.

Best regards,

hefee