[BUG] Rofi crashes when attempting to render on wayland within cairo/pixman after a while

[enticedwanderer]

Rofi version (rofi -v or git commit in case of build issue)

Version: 2.0.0-42-g904d6c4f (makepkg) rofi-git from AUR

Configuration

https://gist.github.com/enticedwanderer/b0a9fb31cd87b89e00eaa3f02d5142b8

Theme

https://gist.github.com/enticedwanderer/59ddfc651afc46fd8cfc5e54c2edb643

Timing report

https://gist.github.com/enticedwanderer/81d643ede5f9d1fd88c7aaff33139641

Launch command

rofi -no-config -no-plugins -show drun

Step to reproduce

Run rofi in any way that requires it to display a menu on screen (not including -help -dump-config etc. that only prints to the console).

Expected behavior

Display menu, run a plugin, the usual command behavior.

Actual behavior

Core dumps.

Additional information

[2026-01-05T23:31:06-0500] [ALPM] removed rofi-lbonn-wayland-git (1.7.8.wayland1.r23.g3bec3fac-1)
[2026-01-05T23:31:06-0500] [ALPM] installed rofi (2.0.0-1)

• I was running rofi-lbonn-wayland-git until recently, when a system upgrade switched me over to official rofi (now with the wayland support merged in from lbonn)
• Rofi core dumps on any invocation (beside --help -dump-config etc)
• This includes running it as rofi -no-config -no-plugins
• Pixman or cairo wasn't upgraded recently at all. I've tried downgrading these but it didn't change anything.
• Reboot makes rofi work for a while. Usually when I come back later it start core dumping.
• I've tried switching from official ArchLinux package (on version 2.0.0-1) to git latest from the github in AUR (2.0.0.r42.g904d6c4f-1). Nothing changes. Same trace. So likely still an outstanding issue.
• Trying to recompile and go back to rofi-lbonn-wayland-git however does not help at all.

I'm wondering if this is somehow reproducing a bug elsewhere in cairo/pixman. Like a leak for example. And it doesn't show until later. I've looked at other packages that got upgraded but didn't notice anything suspicious or that would be related, except Hyprland itself. However, no other piece of software is running into any issues, only rofi.

Coredump

Jan 06 12:22:58 balrog systemd-coredump[1849835]: [🡕] Process 1849830 (rofi) of user 1000 dumped core.

                                                  Stack trace of thread 1849830:
                                                  #0  0x00007f9050b10580 n/a (libpixman-1.so.0 + 0x78580)
                                                  #1  0x00007f9050aa772a pixman_fill (libpixman-1.so.0 + 0xf72a)
                                                  #2  0x00007f90516ab657 n/a (libcairo.so.2 + 0x24657)
                                                  #3  0x00007f90516ef421 n/a (libcairo.so.2 + 0x68421)
                                                  #4  0x00007f90516f0065 n/a (libcairo.so.2 + 0x69065)
                                                  #5  0x00007f90516a6691 n/a (libcairo.so.2 + 0x1f691)
                                                  #6  0x00007f90516f982f n/a (libcairo.so.2 + 0x7282f)
                                                  #7  0x00007f90516add0e n/a (libcairo.so.2 + 0x26d0e)
                                                  #8  0x00007f9051705841 cairo_paint (libcairo.so.2 + 0x7e841)
                                                  #9  0x0000558ed62897cf n/a (/usr/bin/rofi + 0x5e7cf)
                                                  #10 0x0000558ed628a689 n/a (/usr/bin/rofi + 0x5f689)
                                                  #11 0x00007f9051829f8d n/a (libglib-2.0.so.0 + 0x5ef8d)
                                                  #12 0x00007f905182b657 n/a (libglib-2.0.so.0 + 0x60657)
                                                  #13 0x00007f905182ba17 g_main_loop_run (libglib-2.0.so.0 + 0x60a17)
                                                  #14 0x0000558ed6241162 main (/usr/bin/rofi + 0x16162)
                                                  #15 0x00007f9050e27635 n/a (libc.so.6 + 0x27635)
                                                  #16 0x00007f9050e276e9 __libc_start_main (libc.so.6 + 0x276e9)
                                                  #17 0x0000558ed6241285 _start (/usr/bin/rofi + 0x16285)

                                                  Stack trace of thread 1849831:
                                                  #0  0x00007f9050f1872d syscall (libc.so.6 + 0x11872d)
                                                  #1  0x00007f905185a82e g_cond_wait (libglib-2.0.so.0 + 0x8f82e)
                                                  #2  0x00007f90517f11cd n/a (libglib-2.0.so.0 + 0x261cd)
                                                  #3  0x00007f9051863487 n/a (libglib-2.0.so.0 + 0x98487)
                                                  #4  0x00007f90518628bc n/a (libglib-2.0.so.0 + 0x978bc)
                                                  #5  0x00007f9050e9698b n/a (libc.so.6 + 0x9698b)
                                                  #6  0x00007f9050f1a9cc n/a (libc.so.6 + 0x11a9cc)

                                                  Stack trace of thread 1849833:
                                                  #0  0x00007f9050f1872d syscall (libc.so.6 + 0x11872d)
                                                  #1  0x00007f905185a82e g_cond_wait (libglib-2.0.so.0 + 0x8f82e)
                                                  #2  0x00007f90517f11cd n/a (libglib-2.0.so.0 + 0x261cd)
                                                  #3  0x00007f90517f123d g_async_queue_pop (libglib-2.0.so.0 + 0x2623d)
                                                  #4  0x00007f90508c251c n/a (libpangoft2-1.0.so.0 + 0xc51c)
                                                  #5  0x00007f90518628bc n/a (libglib-2.0.so.0 + 0x978bc)
                                                  #6  0x00007f9050e9698b n/a (libc.so.6 + 0x9698b)
                                                  #7  0x00007f9050f1a9cc n/a (libc.so.6 + 0x11a9cc)

                                                  Stack trace of thread 1849832:
                                                  #0  0x00007f9050e9f002 n/a (libc.so.6 + 0x9f002)
                                                  #1  0x00007f9050e9316c n/a (libc.so.6 + 0x9316c)
                                                  #2  0x00007f9050e931b4 n/a (libc.so.6 + 0x931b4)
                                                  #3  0x00007f9050f0d9f6 ppoll (libc.so.6 + 0x10d9f6)
                                                  #4  0x00007f905182b784 n/a (libglib-2.0.so.0 + 0x60784)
                                                  #5  0x00007f905182b865 g_main_context_iteration (libglib-2.0.so.0 + 0x60865)
                                                  #6  0x00007f905182b8b2 n/a (libglib-2.0.so.0 + 0x608b2)
                                                  #7  0x00007f90518628bc n/a (libglib-2.0.so.0 + 0x978bc)
                                                  #8  0x00007f9050e9698b n/a (libc.so.6 + 0x9698b)
                                                  #9  0x00007f9050f1a9cc n/a (libc.so.6 + 0x11a9cc)
                                                  ELF object binary architecture: AMD x86-64

Full debug trace

Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `/usr/bin/rofi'.
Program terminated with signal SIGBUS, Bus error.
#0  _mm_store_si128 (__P=0x7f8c304a0000, __B=...) at /usr/lib/gcc/x86_64-pc-linux-gnu/15.1.1/include/emmintrin.h:737

⚠️ warning: 737 /usr/lib/gcc/x86_64-pc-linux-gnu/15.1.1/include/emmintrin.h: No such file or directory
[Current thread is 1 (Thread 0x7f8c34a3eac0 (LWP 1915126))]
(gdb) thread apply all bt

Thread 5 (Thread 0x7f8c31ecb6c0 (LWP 1915130)):
#0  syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1  0x00007f8c35b7482e in g_cond_wait_impl (cond=0x55994700e6f8, mutex=0x55994700e6f0) at ../glib/glib/gthread-posix.c:1026
#2  g_cond_wait (cond=0x55994700e6f8, mutex=0x55994700e6f0) at ../glib/glib/gthread.c:1686
#3  0x00007f8c35b0b1cd in g_async_queue_pop_intern_unlocked (queue=0x55994700e6f0, wait=1, end_time=-1) at ../glib/glib/gasyncqueue.c:376
#4  0x00007f8c35b0b23d in g_async_queue_pop (queue=queue@entry=0x55994700e6f0) at ../glib/glib/gasyncqueue.c:410
#5  0x00007f8c34bd851c in fc_thread_func (data=0x55994700e6f0) at ../pango/pango/pangofc-fontmap.c:997
#6  0x00007f8c35b7c8bc in g_thread_proxy (data=0x559947016c20) at ../glib/glib/gthread.c:893
#7  0x00007f8c3509698b in start_thread (arg=<optimized out>) at pthread_create.c:448
#8  0x00007f8c3511a9cc in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Thread 4 (Thread 0x7f8c32ecd6c0 (LWP 1915128)):
#0  __syscall_cancel_arch () at ../sysdeps/unix/sysv/linux/x86_64/syscall_cancel.S:56
#1  0x00007f8c3509316c in __internal_syscall_cancel (a1=<optimized out>, a2=<optimized out>, a3=<optimized out>, a4=<optimized out>, a5=a5@entry=8, a6=a6@entry=0, nr=271) at cancellation.c:49
#2  0x00007f8c350931b4 in __syscall_cancel (a1=<optimized out>, a2=<optimized out>, a3=<optimized out>, a4=<optimized out>, a5=a5@entry=8, a6=a6@entry=0, nr=271) at cancellation.c:75
#3  0x00007f8c3510d9f6 in __GI_ppoll (fds=fds@entry=0x7f8c2c000be0, nfds=nfds@entry=1, timeout=<optimized out>, timeout@entry=0x0, sigmask=sigmask@entry=0x0) at ../sysdeps/unix/sysv/linux/ppoll.c:42
#4  0x00007f8c35b45784 in ppoll (__fds=0x7f8c2c000be0, __nfds=1, __timeout=0x0, __ss=0x0) at /usr/include/bits/poll2.h:101
#5  g_main_context_poll_unlocked (priority=<optimized out>, context=0x559946fd5610, timeout_usec=<optimized out>, fds=0x7f8c2c000be0, n_fds=1) at ../glib/glib/gmain.c:4811
#6  g_main_context_iterate_unlocked (context=context@entry=0x559946fd5610, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4485
#7  0x00007f8c35b45865 in g_main_context_iteration (context=0x559946fd5610, may_block=may_block@entry=1) at ../glib/glib/gmain.c:4556
#8  0x00007f8c35b458b2 in glib_worker_main (data=<optimized out>) at ../glib/glib/gmain.c:6764
#9  0x00007f8c35b7c8bc in g_thread_proxy (data=0x559946fd5830) at ../glib/glib/gthread.c:893
#10 0x00007f8c3509698b in start_thread (arg=<optimized out>) at pthread_create.c:448
#11 0x00007f8c3511a9cc in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Thread 3 (Thread 0x7f8c326cc6c0 (LWP 1915129)):
#0  __syscall_cancel_arch () at ../sysdeps/unix/sysv/linux/x86_64/syscall_cancel.S:56
#1  0x00007f8c3509316c in __internal_syscall_cancel (a1=<optimized out>, a2=<optimized out>, a3=<optimized out>, a4=<optimized out>, a5=a5@entry=8, a6=a6@entry=0, nr=271) at cancellation.c:49
#2  0x00007f8c350931b4 in __syscall_cancel (a1=<optimized out>, a2=<optimized out>, a3=<optimized out>, a4=<optimized out>, a5=a5@entry=8, a6=a6@entry=0, nr=271) at cancellation.c:75
#3  0x00007f8c3510d9f6 in __GI_ppoll (fds=fds@entry=0x7f8c24000c20, nfds=nfds@entry=2, timeout=<optimized out>, timeout@entry=0x0, sigmask=sigmask@entry=0x0) at ../sysdeps/unix/sysv/linux/ppoll.c:42
#4  0x00007f8c35b45784 in ppoll (__fds=0x7f8c24000c20, __nfds=2, __timeout=0x0, __ss=0x0) at /usr/include/bits/poll2.h:101
#5  g_main_context_poll_unlocked (priority=<optimized out>, context=0x559946fe2a90, timeout_usec=<optimized out>, fds=0x7f8c24000c20, n_fds=2) at ../glib/glib/gmain.c:4811
#6  g_main_context_iterate_unlocked (context=0x559946fe2a90, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4485
#7  0x00007f8c35b45a17 in g_main_loop_run (loop=0x559946fe2c80) at ../glib/glib/gmain.c:4695
#8  0x00007f8c358e92e4 in gdbus_shared_thread_func (user_data=0x559946fe1f80) at ../glib/gio/gdbusprivate.c:284
#9  0x00007f8c35b7c8bc in g_thread_proxy (data=0x559946fe2ca0) at ../glib/glib/gthread.c:893
#10 0x00007f8c3509698b in start_thread (arg=<optimized out>) at pthread_create.c:448
#11 0x00007f8c3511a9cc in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Thread 2 (Thread 0x7f8c336ce6c0 (LWP 1915127)):
#0  syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1  0x00007f8c35b7482e in g_cond_wait_impl (cond=0x559946fd5288, mutex=0x559946fd5280) at ../glib/glib/gthread-posix.c:1026
#2  g_cond_wait (cond=0x559946fd5288, mutex=0x559946fd5280) at ../glib/glib/gthread.c:1686
#3  0x00007f8c35b0b1cd in g_async_queue_pop_intern_unlocked (queue=0x559946fd5280, wait=1, end_time=-1) at ../glib/glib/gasyncqueue.c:376
#4  0x00007f8c35b7d487 in g_thread_pool_spawn_thread (data=<optimized out>) at ../glib/glib/gthreadpool.c:297
#5  0x00007f8c35b7c8bc in g_thread_proxy (data=0x559946fd52f0) at ../glib/glib/gthread.c:893
#6  0x00007f8c3509698b in start_thread (arg=<optimized out>) at pthread_create.c:448
#7  0x00007f8c3511a9cc in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Thread 1 (Thread 0x7f8c34a3eac0 (LWP 1915126)):
#0  _mm_store_si128 (__P=0x7f8c304a0000, __B=...) at /usr/lib/gcc/x86_64-pc-linux-gnu/15.1.1/include/emmintrin.h:737
#1  save_128_aligned (dst=0x7f8c304a0000, data=...) at ../pixman-0.46.4/pixman/pixman-sse2.c:381
#2  sse2_fill (imp=<optimized out>, bits=<optimized out>, stride=6880, bpp=<optimized out>, x=<optimized out>, y=<optimized out>, width=1720, height=561, filler=0) at ../pixman-0.46.4/pixman/pixman-sse2.c:3386
#3  0x00007f8c34d4e72a in _pixman_implementation_fill (imp=0x559946fc8520, bits=0x7f8c304a0000, stride=1720, bpp=32, x=0, y=0, width=1720, height=562, filler=0) at ../pixman-0.46.4/pixman/pixman-implementation.c:277
#4  pixman_fill (bits=0x7f8c304a0000, stride=1720, bpp=32, x=0, y=0, width=1720, height=562, filler=0) at ../pixman-0.46.4/pixman/pixman.c:792
#5  0x00007f8c359c5657 in fill_boxes (_dst=0x5599473872b0, op=<optimized out>, color=<optimized out>, boxes=<optimized out>) at ../cairo/src/cairo-image-compositor.c:350
#6  0x00007f8c35a09421 in composite_aligned_boxes (compositor=0x7f8c35adcca0 <spans>, extents=0x7ffee6349160, boxes=0x7ffee6348eb0) at ../cairo/src/cairo-spans-compositor.c:628
#7  clip_and_composite_boxes (compositor=0x7f8c35adcca0 <spans>, extents=0x7ffee6349160, boxes=0x7ffee6348eb0) at ../cairo/src/cairo-spans-compositor.c:882
#8  0x00007f8c35a0a065 in _cairo_spans_compositor_mask (_compositor=0x7f8c35adcca0 <spans>, extents=0x7ffee6349160) at ../cairo/src/cairo-spans-compositor.c:999
#9  0x00007f8c359c0691 in _cairo_compositor_paint (compositor=0x7f8c35adcca0 <spans>, surface=0x5599473872b0, op=<optimized out>, source=<optimized out>, clip=<optimized out>) at ../cairo/src/cairo-compositor.c:65
#10 0x00007f8c35a1382f in _cairo_surface_paint (surface=0x5599473872b0, op=CAIRO_OPERATOR_CLEAR, source=0x7f8c35ab0ea0 <_cairo_pattern_clear>, clip=0x0) at ../cairo/src/cairo-surface.c:2204
#11 0x00007f8c359c7d0e in _cairo_gstate_paint (gstate=0x559947387ea0) at ../cairo/src/cairo-gstate.c:1102
#12 0x00007f8c35a1f841 in cairo_paint (cr=cr@entry=0x559947387e70) at ../cairo/src/cairo.c:2230
#13 0x000055991c61d7cf in wayland_rofi_view_update (state=0x55994733b0c0, qr=1) at ../rofi/source/wayland/view.c:322
#14 wayland_rofi_view_update (state=0x55994733b0c0, qr=1) at ../rofi/source/wayland/view.c:302
#15 0x000055991c61e689 in wayland_rofi_view_repaint (data=<optimized out>) at ../rofi/source/wayland/view.c:115
#16 0x00007f8c35b43f8d in g_main_dispatch (context=0x559946ff1e20) at ../glib/glib/gmain.c:3565
#17 0x00007f8c35b45657 in g_main_context_dispatch_unlocked (context=0x559946ff1e20) at ../glib/glib/gmain.c:4425
#18 g_main_context_iterate_unlocked (context=0x559946ff1e20, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4490
#19 0x00007f8c35b45a17 in g_main_loop_run (loop=0x559946fca1c0) at ../glib/glib/gmain.c:4695
#20 0x000055991c5d5162 in main (argc=<optimized out>, argv=<optimized out>) at ../rofi/source/rofi.c:1338

I've checked if the issue exists in the latest stable release

• Yes, I have checked the problem exists in the latest stable version

[DaveDavenport]

What do you mean with 'reboot'?

Reboot makes rofi work for a while. Usually when I come back later it start core dumping.

reboot the machine, or restart rofi?

How long before rofi crashes? I use the same version daily on arch and have not experienced a crash.

[DaveDavenport]

What video card and driver are you using?

[enticedwanderer]

What do you mean with 'reboot'?

Reboot makes rofi work for a while. Usually when I come back later it start core dumping.

reboot the machine, or restart rofi?

Rebooting the machine yeah. Once it gets in this state attempting to start rofi always coredumps.

How long before rofi crashes? I use the same version daily on arch and have not experienced a crash.

A few hours to a day roughly. Haven't gone through many cycles yet. But noticed it didn't work after upgrade/reboot. Then after troubleshooting I rebooted and got surprised it started working with nothing having changed.

What video card and driver are you using?

nvidia-open for discrete card and mesa technically for AMD integrated GPU on Ryzen CPU. Hyprland is configured to lean on nvidia.

Hyprland did get upgraded recently and that's the only thing I haven't tried downgrading yet.

╰─ fastfetch                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ─╯
                  -`                     alex@balrog
                 .o+`                    -----------
                `ooo/                    OS: Arch Linux x86_64
               `+oooo:                   Host: B650 GAMING X AX V2
              `+oooooo:                  Kernel: Linux 6.18.3-arch1-1
              -+oooooo+:                 Uptime: 13 hours, 55 mins
            `/:-:++oooo+:                Packages: 2010 (pacman)
           `/++++/+++++++:               Shell: zsh 5.9
          `/++++++++++++++:              Display (G274QPF E2): 1440x2560 in 27", 180 Hz [External]
         `/+++ooooooooooooo/`            Display (G274QPF E2): 2560x1440 in 27", 180 Hz [External]
        ./ooosssso++osssssso+`           Display (DELA0FA): 3440x1440 in 34", 120 Hz [External]
       .oossssso-````/ossssss+`          WM: Hyprland 0.53.1 (Wayland)
      -osssssso.      :ssssssso.         Cursor: Adwaita
     :osssssss/        osssso+++.        Terminal: kitty 0.45.0
    /ossssssss/        +ssssooo/-        Terminal Font: NotoSansMono-Regular (9pt)
  `/ossssso+/:-        -:/+osssso+-      CPU: AMD Ryzen 7 7800X3D (16) @ 5.05 GHz
 `+sso+:-`                 `.-/+oso:     GPU 1: NVIDIA GeForce RTX 3090 [Discrete]
`++:.                           `-/+/    GPU 2: AMD Raphael [Integrated]
.`                                 `/    Memory: 14.11 GiB / 30.49 GiB (46%)
                                         Swap: 954.43 MiB / 64.00 GiB (1%)
                                         Disk (/): 1.19 TiB / 1.82 TiB (65%) - btrfs
                                         Local IP (enp8s0): 10.0.30.7/24
                                         Locale: en_US.UTF-8

[DaveDavenport]

That is odd, rofi only is short lived. So I wonder what 'state' gets corrupted so it crashes when launched later that only a reboot can fix. Sounds like it triggers something in an external part.

Do you know on what card rofi gets mapped? (I run it myself on AMD without issues)

[DaveDavenport]

@lbonn ideas?

[enticedwanderer]

That is odd, rofi only is short lived. So I wonder what 'state' gets corrupted so it crashes when launched later that only a reboot can fix. Sounds like it triggers something in an external part.

The weird part is that nothing else is unstable on the system or crashing. sigh

Do you know on what card rofi gets mapped? (I run it myself on AMD without issues)

Should be nvidia but I'm not sure how to check since it is shortlived.

[DaveDavenport]

rofi has triggered more 'weird' bugs before, esp. in nvidia drivers that failed on some (perfectly normal) cairo_operations.
The tricky part is to find a way to reliable reproduce, especially because it can take up to a day to occur?

[DaveDavenport]

I used nvtop before to check this.

[enticedwanderer]

Rofi doesn't even show up in the process list in nvtop. Probably because it is just using wlr layers on the compositor (hyprland in my case)? No idea how that actually works.

I've pinned hyprland on the AMD iGPU and rebooted (confirmed in nvtop) and will see if this happens again.

In the mean time I found another (this time maybe actual) bug in rofi (bad free of a malloc) in deconstructor for ssh mode. It happens if that mode is on constantly on exit, so I'll submit that on separate issue.

[DaveDavenport]

hmm I thought I fixed that, might have forgotten to push it to next.. let me check.
(also see #2253)

[enticedwanderer]

Can confirm that pinning hyperland to AMD iGPU didn't resolve the issue. This time it took about 2h before rofi started crashing again. Noticed when I tried to test your ssh-mode fix.

I'm going to try to rollback hyperland to try rule out an issue there.

[enticedwanderer]

After rolling back hyprland, the problem hasn't showed up so far fingers crossed after ~16h, few standby cycles and overnight. Cautiously optimistic.

[enticedwanderer]

So this seems like some bad interaction between what rofi does and 53.0+ version of hyperland. I'm not sure how to proceed on troubleshooting this further. I can open a discussion on hyperland side if you think that will help. Anything in particular that would help you figure out what's going on rofi side here?

[DaveDavenport]

odd one. No idea tbh.. @lbonn you got any ideas?