Dear Maintainer,

kwin_wayland 6.3.6 in trixie crashes with SIGSEGV when external monitors
are removed, taking down the whole Plasma session. On my machine this
happens when unplugging a Thunderbolt dock with two monitors attached.

Cause: wl_output removal is racy. A client (Firefox, Chromium, Electron
apps, anything using wp_color_manager_v1) can send
wp_color_manager_v1.get_output for a wl_output whose backing output KWin
has already removed. ColorManagerV1::wp_color_manager_v1_get_output()
then calls OutputInterface::get(output)->handle(), which is null, and
the ColorManagementOutputV1 constructor dereferences it
(src/wayland/colormanagement_v1.cpp:580 in 6.3.6).

Key frames from the symbolized backtrace of the first crash (client was
firefox-esr; core no longer available):

  #4  KWin::ColorManagementOutputV1::ColorManagementOutputV1(wl_client*, uint, uint, KWin::Output*)
        (output=0x0) at src/wayland/colormanagement_v1.cpp:580
  ...  libffi / libwayland-server
  #10 wl_event_loop_dispatch
  #11 KWin::Display::dispatchEvents()

All three crashes fault at the same address (libkwin.so.6 + 0x5a8130).
Closing Firefox before unplugging does not avoid it, since other
clients send the same request.

Upstream fix (KDE bug 504959, fixed in 6.4.5), two small commits:

  e1fd647b979df7f0bd10065932a614a2aa806e87
    wayland: Make ColorManagementOutputV1 handle output removal better
    https://invent.kde.org/plasma/kwin/-/commit/e1fd647b979df7f0bd10065932a614a2aa806e87

  172f8f2e71d93a27f23586587d9cf86cbfee8615
    wayland: Check for nullptr output in ColorManagementOutputV1
    https://invent.kde.org/plasma/kwin/-/commit/172f8f2e71d93a27f23586587d9cf86cbfee8615

(Cherry-picked to Plasma/6.4 as 598438b9 and 5baacbef.) Both only touch
src/wayland/colormanagement_v1.{cpp,h}, which is the same code that
6.3.6 ships, so they should backport cleanly.

Could these be included in a trixie point release?

This report was drafted with an AI assistant (Claude Opus 5.5). The crashes,
versions and backtraces are from my system; I checked that the upstream
patches apply to the 6.3.6 source.

System: Debian 13 (trixie), amd64, kernel 6.12.113+deb13-amd64
  kwin-wayland 4:6.3.6-1
  libqt6core6t64 6.8.2+dfsg-9+deb13u2
  libwayland-server0 1.23.1-3
  Hardware: Dell XPS 15 9510 (Intel + NVIDIA), Dell SD25TB4 dock

Thanks!

control: forcemerge 1150067 1151390

Hey,

your issue and fix was already reported at #1147212.
https://bugs.debian.org/1147212

Yes, a request for a proposed upload is already running #1150067
https://bugs.debian.org/1150067
have the same subject so it is easy to spot.  It is work on our side to handle
the requests.

It is read like a AI crafted mail: too long explanation what happens and why.
But the most relevant information is missing, does those two patches are fixing
your issue? How did you test that these two patches did fix you issue?

Regards,

hefee