GNOME Shell SIGSEGV crash in liveAltTab.js:149 during live Alt-Tab preview (highlight() on stale actor)

[AliRezaTaleghani]

Summary

GNOME Shell crashes with SIGSEGV during PaperWM's live Alt-Tab preview, killing the entire graphical session. Reproduced with a full core dump; the crashing JS stack is confirmed inside liveAltTab.js.

Environment

• PaperWM v50.0.1 (build 148), installed manually to ~/.local/share/gnome-shell/extensions/
• GNOME Shell 50.1 / Mutter 50.1 (Ubuntu 26.04, Wayland session)
• Other enabled extensions: ding, ubuntu-dock, caffeine, simplenetspeed, a local custom extension (unrelated - ruled out via its own core-dump-free crash analysis)

Crash evidence

GNOME Shell's own JS stack trace at the moment of the SIGSEGV (from the system journal):

GNOME Shell crashed with signal 11
== Stack trace for context 0x597b50869200 ==
#0   7ffe581c6710 b   resource:///org/gnome/shell/ui/main.js:932
#1   597b50961300 i   resource:///org/gnome/shell/ui/altTab.js:628
#2   597b50961270 i   file:///home/iceman/.local/share/gnome-shell/extensions/paperwm@paperwm.github.com/liveAltTab.js:149
#3   597b509611a8 i   resource:///org/gnome/shell/ui/switcherPopup.js:228
#4   597b50961118 i   resource:///org/gnome/shell/ui/init.js:20

Line 149 in liveAltTab.js is the this._switcherList.highlight(num); call inside _select(), right after building a Clutter.Clone from the target window's actor:

let clone = new Clutter.Clone({ source: actor });
clone.position = actor.position;
let space = Tiling.spaces.spaceOfWindow(to);
if (space.indexOf(to) !== -1) {
    clone.x = Tiling.ensuredX(to, space) + space.monitor.x;
    clone.x -= frame.x - actor.x;
}
this.clone = clone;
Main.uiGroup.insert_child_above(clone, this.fog);
this._selectedIndex = num;
this._switcherList.highlight(num);   // <-- crash site, line 149

A system-level apport crash report (with full core dump) was captured for this exact crash. gdb backtrace on the native side:

#0  __pthread_kill_implementation ...
...
#6  ??? () at /usr/lib/x86_64-linux-gnu/libmutter-18.so.0
#7  ??? () at /usr/lib/x86_64-linux-gnu/libmutter-18.so.0
#8  ??? () at /usr/lib/x86_64-linux-gnu/libffi.so.8
...
#11 ??? () at /usr/lib/x86_64-linux-gnu/libgjs.so.0
...
#13 ??? () at /usr/lib/x86_64-linux-gnu/libmozjs-140.so.0

i.e. a JS call through GJS/libffi into a native Mutter/Clutter method segfaults. Consistent with highlight() (or something it triggers, e.g. layout/paint) touching a window/actor that no longer exists - plausibly because the window being alt-tabbed to/through was closed or otherwise invalidated mid-cycle, leaving actor/to stale before the Clutter.Clone this code just built is used.

No debug symbols were installed for mutter/gjs/mozjs at capture time, so the native frames are unresolved (???). Happy to reinstall with -dbgsym packages and re-attach gdb if that's useful upstream - let me know.

Repro

Not reliably reproducible on demand yet (appears to depend on window state during the live Alt-Tab preview - e.g. an app closing, unmapping, or a workspace/space change while cycling). It has recurred several times over the past few days on this machine, each time under normal desktop use while alt-tabbing.

Checked, not the cause

Verified this is not: idle/screen-lock (lock is disabled on this system), an OOM kill, or a coredump-storage artifact - journalctl -k shows no OOM events, and lock-enabled is false. Also checked the develop branch (14 commits ahead of v50.0.1) for any recent changes to liveAltTab.js - there are none, so this looks unfixed/unreported.

Happy to provide the full apport crash report or run further diagnostics if useful.