Gala crashes repeatedly on X11 session when external HDMI monitor is connected

### What Happened?

#

[gala_crash_abrt.txt](https://github.com/user-attachments/files/27606403/gala_crash_abrt.txt)
[gala_crash_segv.txt](https://github.com/user-attachments/files/27606404/gala_crash_segv.txt)

## Summary

On elementary OS 8.1 with an Intel TigerLake-LP / Iris Xe GPU, `gala` (Pantheon WM, running on X11) crashes repeatedly during normal use when an external HDMI monitor is connected to the laptop. After a few automatic restarts systemd gives up with `Start request repeated too quickly` and the entire desktop session is lost, forcing me to log back in. The same machine produced **15 gala core dumps in a single day** today.

The kernel `i915` driver is healthy — no GPU hangs, resets, or wedged-context messages in `dmesg`. The faulting code lives in `libgala.so.0` / `gala`.

## System info

| Field | Value |
|---|---|
| OS | elementary OS 8.1 (Ubuntu 24.04 base) |
| Kernel | 6.17.0-23-generic |
| GPU | Intel Corporation TigerLake-LP GT2 [Iris Xe Graphics] (rev 01) — i915 |
| Session type | X11 (`io.elementary.gala@x11.service`) |
| `gala` | 8.5.0+r3045+pkg130~ubuntu8.1 |
| `libgala0` | 8.5.0+r3045+pkg130~ubuntu8.1 |
| `mutter-common` | 46.2-1ubuntu0.24.04.15 |
| Display manager | LightDM |

## How to reproduce (in my case)

1. Boot into the Pantheon (X11) session.
2. Connect an external monitor through the laptop's HDMI port.
3. Use the desktop normally — open Chrome, Termius, WebStorm, OnlyOffice, switch workspaces, use 3/4-finger gestures.
4. Within minutes, gala crashes. systemd auto-restarts it 3–4 times, then bails out and the session ends.

I have not yet tested the Wayland session — filing this for the X11 path because it's the default selected by LightDM here.

## Two distinct crash signatures

Both occurred today within seconds of each other. They reproduce repeatedly across reboots.

### Signature A — `SIGSEGV` in `gala_utils_x11_set_window_pass_through`

```
PID 24433 (gala) — Signal 11 (SEGV)
kernel: gala[24433]: segfault at 0 ip 00007e138b4288a6 sp 00007ffe2de907c0
error 4 in libgala.so.0.0.0[1c8a6,7e138b41f000+2b000]

Stack trace of thread 24433:
#0 gala_utils_x11_set_window_pass_through (libgala.so.0 + 0x1c8a6)
#1 n/a (gala + 0x6e5e5)
#2 n/a (gala + 0x6d5fc)
#3 n/a (libgala.so.0 + 0x30e22)
#4 g_closure_invoke (libgobject-2.0.so.0 + 0x152fa)
#5 n/a (libgobject-2.0.so.0 + 0x44c79)
#6 n/a (libgobject-2.0.so.0 + 0x35591)
#7 g_signal_emit_valist (libgobject-2.0.so.0 + 0x357c1)
#8 g_signal_emit (libgobject-2.0.so.0 + 0x35883)
#9 n/a (libmutter-clutter-14.so.0 + 0xac96b)
#10 n/a (libmutter-clutter-14.so.0 + 0x618b8)
#11 n/a (libglib-2.0.so.0 + 0x5d585)
#12 n/a (libglib-2.0.so.0 + 0xbc977)
#13 g_main_loop_run (libglib-2.0.so.0 + 0x5df47)
#14 meta_context_run_main_loop (libmutter-14.so.0 + 0xd508a)
#15 n/a (gala + 0x3f725)
#16 __libc_start_main (libc.so.6 + 0x2a28b)
#17 _start (gala + 0x2bde5)
```

Immediately before the SEGV, the journal is flooded with:

```
gala[24433]: Can't update stage views actor unnamed [ClutterActor] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [ClutterClone] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [GalaWorkspaceRow] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [GalaWorkspaceClone] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [GalaWindowCloneContainer] is on because it needs an allocation.
gala[24433]: Can't update stage views actor unnamed [GalaWindowClone] is on because it needs an allocation.
```
…and many `clutter_actor_get_width: assertion 'CLUTTER_IS_ACTOR (self)' failed` lines, suggesting an actor is being operated on after it has been destroyed (use-after-free / dangling Clutter actor).

### Signature B — `SIGABRT` in `gala_workspace_manager_thaw_remove`

The restarted gala instance immediately hits an assertion failure while replaying gestures/workspace state:

```
gala[24734]: meta_sound_player_play_from_theme: assertion 'META_IS_SOUND_PLAYER (player)' failed
gala[24734]: gala_workspace_manager_get_default: assertion 'instance != null' failed
gala[24734]: gala_workspace_manager_freeze_remove: assertion 'self != NULL' failed
gala[24734]: Called enable_unredirect_for_display while unredirection is enabled.
gala[24734]: ERROR:src/gala.p/WorkspaceManager.c:313:gala_workspace_manager_thaw_remove:
assertion failed: (remove_freeze_count >= 0)
gala[24734]: Bail out! ERROR:src/gala.p/WorkspaceManager.c:313:gala_workspace_manager_thaw_remove:
assertion failed: (remove_freeze_count >= 0)
```

Relevant frames from the abort stack:

```
#5 gala_workspace_manager_thaw_remove (gala + 0x5bd26)
#6 n/a (gala + 0x7fdc4)
#7 gala_gesture_controller_jump (libgala.so.0 + 0x33f3a)
…
#14 n/a (gala + 0x56c48)
#27 n/a (gala + 0x3f725)
#30 _start (gala + 0x2bde5)
```

So `remove_freeze_count` is going negative — the `freeze`/`thaw` calls in `WorkspaceManager` get mis-paired when a gesture transitions while workspace state is also being reshuffled (which I believe is what happens when the HDMI hotplug forces Mutter to reconfigure monitors mid-gesture).

## Service-level fallout

```
systemd[3661]: io.elementary.gala@x11.service: Main process exited, code=dumped, status=6/ABRT
systemd[3661]: io.elementary.gala@x11.service: Failed with result 'core-dump'.
systemd[3661]: io.elementary.gala@x11.service: Scheduled restart job, restart counter is at 4.
systemd[3661]: io.elementary.gala@x11.service: Start request repeated too quickly.
systemd[3661]: io.elementary.gala@x11.service: Failed with result 'core-dump'.
systemd[3661]: Stopped target io.elementary.gala.target - Gala.
xdg-desktop-por[10203]: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown:
The name org.pantheon.gala was not provided by any .service files
```

LightDM then tears down the session.

## Frequency

15 core dumps from `/usr/bin/gala` on **2026-05-11** alone, alternating between SIGTRAP, SIGSEGV and SIGABRT every few minutes once the crash loop starts:

```
09:54:55 SIGABRT
10:37:19 SIGTRAP
10:37:30 SIGABRT
10:46:49 SIGTRAP
10:47:08 SIGABRT
11:49:29 SIGTRAP
11:49:39 SIGABRT
11:51:53 SIGTRAP
11:52:03 SIGABRT
11:54:13 SIGTRAP
11:54:28 SIGABRT
12:28:34 SIGTRAP
12:28:36 SIGSEGV
12:28:37 SIGABRT
12:28:39 SIGABRT
```

## What I think is happening

When the external HDMI monitor is connected, the kernel signals an output reconfiguration to Mutter/gala. While gala is in the middle of an animation or gesture (the `gesture_controller_jump` frame is the tell), workspace freeze/thaw counters fall out of sync and a Clutter actor is destroyed while still being referenced by `gala_utils_x11_set_window_pass_through`. Either path lands in an unrecoverable state.

This is consistent with `set_window_pass_through` operating on the X11 pass-through window list, which gets rebuilt whenever monitor geometry changes.

## What I will try next

Switching to the Wayland session (`pantheon-wayland.desktop` is installed) to see whether the same workload reproduces it there. I'll add a comment once I have data.

## Attachments

Full `coredumpctl info` output for the two representative crashes is attached.
- `gala_crash_segv.txt` — PID 24433, SIGSEGV (Signature A)
- `gala_crash_abrt.txt` — PID 24734, SIGABRT (Signature B)

### Steps to Reproduce

1. Boot into the Pantheon session on X11 (the default selected by LightDM).
2. Connect any external display through the laptop's HDMI port — the bug is
not monitor-specific; it has reproduced with multiple different monitors.
3. Open a handful of regular applications (in my case: Chrome, Termius,
WebStorm, OnlyOffice).
4. Switch between windows using Alt+Tab as you normally would during work.

Within minutes — sometimes seconds — Alt+Tab triggers a gala crash. systemd
auto-restarts gala 3–4 times; each restarted instance also crashes (the
second crash signature, the WorkspaceManager assertion). After the restart
counter is exhausted, systemd gives up with "Start request repeated too
quickly" and the entire desktop session is torn down by LightDM, forcing a
re-login.

When the laptop is used without the external HDMI monitor, the same Alt+Tab
usage does NOT crash gala. The crash only manifests while the HDMI output
is active.

Expected: Alt+Tab cycles between windows normally.
Actual: gala segfaults (SIGSEGV in gala_utils_x11_set_window_pass_through),
then its restart hits ERROR in gala_workspace_manager_thaw_remove
and the whole session dies.

### Expected Behavior

.

### OS Version

8.x (Circe)

### OS Architecture

amd64 (on most hardwares)

### Session Type

Secure Session (Wayland, This is the default)

### Software Version

Latest release (I have run all updates)

### Log Output

```shell

```

### Hardware Info

_No response_