ext_background_effect_surface_v1 destroy sequence causes fatal Wayland protocol error (Dolphin crash)

[Aaxper]

Some apps (notably the Dolphin file manager) crash when performing certain actions, particularly closing dialogue menus. This error was found on the Niri WIP branch, but I was directed by YaLTeR (the creator of Niri) to repost it here.

Error output:

[destroyed object]: error 0: wl_surface was destroyed
The Wayland connection experienced a fatal error: Protocol error

WAYLAND_DEBUG=1 trace:

Relevant section:

-> ext_background_effect_surface_v1#55.destroy()
-> wl_compositor#4.create_surface(new id wl_surface#54)
...
wl_display#1.delete_id(36)                                               <- surface deleted by server
wl_display#1.error(nil, 0, "wl_surface was destroyed")                   <- nil reference

Last 50 lines

[1108851.450] {Default Queue} wl_pointer#22.motion(352486620, 202.50000000, 526.50000000)
[1108851.488] {Default Queue} wl_pointer#22.frame()
[1108858.603] {Default Queue} wl_pointer#22.motion(352486627, 199.50000000, 528.00000000)
[1108858.665] {Default Queue} wl_pointer#22.frame()
[1108866.582] {Default Queue} wl_pointer#22.motion(352486635, 198.00000000, 529.50000000)
[1108866.639] {Default Queue} wl_pointer#22.frame()
[1108873.714] {Default Queue} wl_pointer#22.motion(352486642, 195.00000000, 531.00000000)
[1108873.776] {Default Queue} wl_pointer#22.frame()
[1108882.543] {Default Queue} wl_pointer#22.motion(352486650, 193.50000000, 532.50000000)
[1108882.601] {Default Queue} wl_pointer#22.frame()
[1108888.391] {Default Queue} wl_pointer#22.motion(352486657, 192.00000000, 532.50000000)
[1108888.450] {Default Queue} wl_pointer#22.frame()
[1108896.601] {Default Queue} wl_pointer#22.motion(352486665, 190.50000000, 532.50000000)
[1108896.659] {Default Queue} wl_pointer#22.frame()
[1108903.481] {Default Queue} wl_pointer#22.motion(352486672, 190.50000000, 534.00000000)
[1108903.535] {Default Queue} wl_pointer#22.frame()
[1108911.704] {Default Queue} wl_pointer#22.motion(352486680, 189.00000000, 534.00000000)
[1108911.764] {Default Queue} wl_pointer#22.frame()
[1108957.395] {Default Queue} wl_pointer#22.motion(352486725, 187.50000000, 535.50000000)
[1108957.453] {Default Queue} wl_pointer#22.frame()
[1108962.947] {Default Queue} wl_pointer#22.motion(352486732, 186.00000000, 537.00000000)
[1108962.972] {Default Queue} wl_pointer#22.frame()
[1108977.894] {Default Queue} wl_pointer#22.motion(352486747, 184.50000000, 538.50000000)
[1108977.920] {Default Queue} wl_pointer#22.frame()
[1108992.993] {Default Queue} wl_pointer#22.motion(352486762, 184.50000000, 540.00000000)
[1108993.022] {Default Queue} wl_pointer#22.frame()
[1109000.907] {Default Queue} wl_pointer#22.motion(352486770, 183.00000000, 540.00000000)
[1109000.933] {Default Queue} wl_pointer#22.frame()
[1109022.993] {Default Queue} wl_pointer#22.motion(352486792, 183.00000000, 541.50000000)
[1109023.037] {Default Queue} wl_pointer#22.frame()
[1109189.314] {Default Queue} wl_pointer#22.button(7422838, 352486957, 272, 1)
[1109189.375] {Default Queue} wl_pointer#22.frame()
[1109189.620] {Default Queue}  -> xdg_popup#47.destroy()
[1109189.641] {Default Queue}  -> xdg_surface#39.destroy()
[1109189.654] {Default Queue}  -> wl_surface#36.attach(nil, 0, 0)
[1109189.665] {Default Queue}  -> wl_surface#36.commit()
[1109189.760] {Default Queue}  -> wl_surface#36.destroy()
[1109189.779] {Default Queue}  -> wp_viewport#37.destroy()
[1109189.787] {Default Queue}  -> wp_fractional_scale_v1#38.destroy()
[1109189.800] {Default Queue}  -> ext_background_effect_surface_v1#55.destroy()
[1109190.151] wl_buffer#45.release()
[1109190.166] wl_buffer#43.release()
[1109190.347] {Display Queue} wl_display#1.delete_id(47)
[1109190.364] {Display Queue} wl_display#1.delete_id(39)
[1109190.376] {Display Queue} wl_display#1.delete_id(36)
[1109190.383] {Display Queue} wl_display#1.delete_id(37)
[1109190.392] {Display Queue} wl_display#1.delete_id(38)
[1109190.398] {Display Queue} wl_display#1.error(nil, 0, "wl_surface was destroyed")
[destroyed object]: error 0: wl_surface was destroyed
The Wayland connection experienced a fatal error: Protocol error

Dolphin destroys a popup and its associated ext_background_effect_surface_v1 object, then creates a new surface for a dialog. Niri then sends a wl_display.error referencing a nil object, which kills the connection. The nil in the error suggests Niri holds a dangling reference to the destroyed surface.

System Information

• niri version: niri 25.11 (v25.11-129-g734d86ec)

• Distro: Arch Linux

• GPU: AMD Radeon 780M

• CPU: AMD Ryzen 7 8845HS

DISCLAIMER: This report was partially written with the assistance of AI because I don't fully understand the bug. However, it was a real issue I encountered independently, and all information appears correct to me.

[Drakulix]

[1109189.760] {Default Queue}  -> wl_surface#36.destroy()
[...]
[1109189.800] {Default Queue}  -> ext_background_effect_surface_v1#55.destroy()

I think the problem here is simply, that Qt destroys the background-effect-surface after the wl_surface.

The protocol allows this, but smithay doesn't seem to handle it correctly.

[Drakulix]

Can you test if #1973 fixes it?

[Aaxper]

Yes, that worked!

[Aaxper]

This appears to still be an issue for certain apps (Kate, pavucontrol-qt, KCalc, maybe others)

WAYLAND_DEBUG=1 output

[2741604.420] {Default Queue} wl_pointer#22.frame()
[2741613.007] {Default Queue} wl_pointer#22.motion(199123616, 293.79687500, 849.09765625)
[2741613.044] {Default Queue} wl_pointer#22.frame()
[2741619.537] {Default Queue} wl_pointer#22.motion(199123623, 292.29687500, 846.09765625)
[2741619.574] {Default Queue} wl_pointer#22.frame()
[2741623.584] wl_buffer#41.release()
[2741627.636]  -> wl_surface#30.frame(new id wl_callback#55)
[2741627.649] {Default Queue}  -> wl_surface#30.offset(0, 0)
[2741627.655] {Default Queue}  -> wl_surface#30.attach(wl_buffer#41, 0, 0)
[2741627.662] {Default Queue}  -> wl_surface#30.damage_buffer(52, 258, 843, 34)
[2741627.667] {Default Queue}  -> wl_surface#30.commit()
[2741627.685] {Default Queue} wl_pointer#22.motion(199123631, 292.29687500, 844.59765625)
[2741627.698] {Default Queue} wl_pointer#22.frame()
[2741634.520] {Default Queue} wl_pointer#22.motion(199123638, 290.79687500, 843.09765625)
[2741634.558] {Default Queue} wl_pointer#22.frame()
[2741642.392] {Default Queue} wl_pointer#22.motion(199123646, 289.29687500, 840.09765625)
[2741642.429] {Default Queue} wl_pointer#22.frame()
[2741644.137] {Display Queue} wl_display#1.delete_id(55)
[2741644.160] wl_callback#55.done(199123648)
[2741649.467] {Default Queue} wl_pointer#22.motion(199123653, 287.79687500, 838.59765625)
[2741649.490] {Default Queue} wl_pointer#22.frame()
[2741657.660] {Default Queue} wl_pointer#22.motion(199123661, 286.29687500, 837.09765625)
[2741657.698] {Default Queue} wl_pointer#22.frame()
[2741666.316] wl_buffer#42.release()
[2741670.467]  -> wl_surface#30.frame(new id wl_callback#55)
[2741670.489] {Default Queue}  -> wl_surface#30.offset(0, 0)
[2741670.499] {Default Queue}  -> wl_surface#30.attach(wl_buffer#42, 0, 0)
[2741670.510] {Default Queue}  -> wl_surface#30.damage_buffer(52, 258, 843, 34)
[2741670.518] {Default Queue}  -> wl_surface#30.commit()
[2741672.025] {Default Queue} wl_pointer#22.motion(199123676, 286.29687500, 835.59765625)
[2741672.052] {Default Queue} wl_pointer#22.frame()
[2741677.976] {Display Queue} wl_display#1.delete_id(55)
[2741678.001] wl_callback#55.done(199123682)
[2741733.679] {Default Queue} wl_pointer#22.button(4076559, 199123736, 272, 1)
[2741733.725] {Default Queue} wl_pointer#22.frame()
[2741734.065] {Default Queue}  -> xdg_popup#47.destroy()
[2741734.103] {Default Queue}  -> xdg_surface#45.destroy()
[2741734.133] {Default Queue}  -> wl_surface#43.attach(nil, 0, 0)
[2741734.158] {Default Queue}  -> wl_surface#43.commit()
[2741734.526] wl_buffer#41.release()
[2741735.281] {Display Queue} wl_display#1.delete_id(47)
[2741735.341] {Display Queue} wl_display#1.delete_id(45)
[2741738.790]  -> wl_surface#30.frame(new id wl_callback#45)
[2741738.805] {Default Queue}  -> wl_surface#30.offset(0, 0)
[2741738.812] {Default Queue}  -> wl_surface#30.attach(wl_buffer#41, 0, 0)
[2741738.820] {Default Queue}  -> wl_surface#30.damage_buffer(477, 1115, 442, 40)
[2741738.827] {Default Queue}  -> wl_surface#30.commit()
[2741744.533] {Default Queue}  -> ext_background_effect_surface_v1#46.destroy()
[2741744.587] {Default Queue}  -> ext_background_effect_manager_v1#52.get_background_effect(new id ext_background_effect_surface_v1#47, wl_surface#43)
[2741744.600] {Default Queue}  -> ext_background_effect_surface_v1#47.set_blur_region(nil)
fish: Process 3073538, 'pavucontrol-qt' from job 1, 'WAYLAND_DEBUG=1 pavucontrol-qt …' terminated by signal SIGSEGV (Address boundary error)

[YaLTeR]

This can be reproduced when opening and closing a popup when blur for popups is enabled in Kvantum.

[ 291821.697] {Default Queue}  -> ext_background_effect_manager_v1#42.get_background_effect(new id ext_background_effect_surface_v1#56, wl_surface#46)
[ 291821.710] {Default Queue}  -> ext_background_effect_surface_v1#56.set_blur_region(wl_region#57)
[ 291823.489]  -> wl_surface#46.frame(new id wl_callback#52)
[ 291823.497] {Default Queue}  -> wl_surface#46.offset(0, 0)
[ 291823.499] {Default Queue}  -> wl_surface#46.attach(wl_buffer#53, 0, 0)
[ 291823.501] {Default Queue}  -> wl_surface#46.damage_buffer(0, 0, 772, 1156)
[ 291823.503] {Default Queue}  -> wl_surface#46.commit()
(...)
[ 292435.288] {Default Queue} wl_pointer#26.leave(401804, wl_surface#46)
[ 292435.299] {Default Queue} wl_pointer#26.enter(401804, wl_surface#32, 155.85546875, 296.70312500)
[ 292651.842] {Default Queue}  -> xdg_surface#49.destroy()
[ 292651.846] {Default Queue}  -> wl_surface#46.attach(nil, 0, 0)
[ 292651.848] {Default Queue}  -> wl_surface#46.commit()
=== Destroying the BG effect, then immediately creating a new one for the same surface:
[ 292662.480] {Default Queue}  -> ext_background_effect_surface_v1#56.destroy()
[ 292662.492] {Default Queue}  -> ext_background_effect_manager_v1#42.get_background_effect(new id ext_background_effect_surface_v1#52, wl_surface#46)
[ 292662.496] {Default Queue}  -> ext_background_effect_surface_v1#52.set_blur_region(nil)
fish: Job 1, 'WAYLAND_DEBUG=1 kvantummanager …' terminated by signal SIGSEGV (Address boundary error)

[YaLTeR]

I'm actually not sure what's the root cause. The crash is due to Kvantum calling ext_background_effect_manager_v1_destroy on a NULL object.

[YaLTeR]

Seems this was fixed in KDE: https://invent.kde.org/frameworks/kwindowsystem/-/merge_requests/210

I haven't verified this (isn't really in distros yet), but this issue can probably be closed if that was the fix.