Crash: SIGSEGV inside fontconfig FcFontSort — concurrent font fallback from multiple surface render threads is unserialized (Linux/GTK)

[aicccode]

Issue Description

On Linux (GTK, gtk-single-instance), Ghostty intermittently crashes with SIGSEGV, taking down ALL windows at once (single process). It happens reliably during bursts of varied terminal output that trigger frequent font fallback — most notably while installing software (apt/dnf/npm/etc. printing progress bars, box-drawing, package names in mixed scripts, symbols, emoji), and especially with two or more windows open.

I captured several coredumps. In every one, the faulting thread bottoms out inside fontconfig's FcFontSort (symbolized as the FcFontMatch region in the statically-linked libfontconfig). The faulting instruction dereferences pattern + pattern->elts_offset (FcPatternElts), and that address is UNMAPPED — i.e. fontconfig's mmap'd font cache was concurrently corrupted / munmap'd while FcFontSort was iterating a pattern.

Root cause (verified against v1.3.1 source): Ghostty does NOT serialize fontconfig access. src/font/discovery.zig's Fontconfig struct has no lock; discover() calls substituteWithPat + fontSort, and the iterator's deinit() calls set.destroy() / pattern.destroy(), all with no synchronization. src/font/DeferredFace.zig also calls fontconfig with no lock: loadFontconfig (FcPatternGet file/index), hasCodepoint (FcCharSetHasChar / FcLangSetHasLang), familyName, name, and Fontconfig.deinit (FcPatternDestroy). FcConfig and the shared mmap'd caches are not thread-safe, so when one surface's render thread destroys a pattern (dropping a cache refcount → munmap) while another surface's render thread is inside FcFontSort, fontconfig's internal state is corrupted and it segfaults dereferencing the now-unmapped pattern.

This is a race, so it is not 100% deterministic, but it is frequent in daily use with multiple windows under heavy output.

A process-wide lock that serializes ALL fontconfig calls (both the discovery path and every DeferredFace fontconfig call) eliminates the crash. I have such a patch running locally and have not been able to reproduce the crash since. Happy to open a PR.

Expected Behavior

Ghostty does not crash. Concurrent font discovery / fallback from multiple surface render threads is serialized so it cannot corrupt fontconfig's shared state.

Actual Behavior

Ghostty SIGSEGVs inside fontconfig FcFontSort and the entire process dies, closing all windows simultaneously. Triggered by font fallback during heavy/varied output.

Reproduction Steps

1. Build/run Ghostty on Linux with the GTK app runtime and the fontconfig_freetype font engine (default on Linux).
2. Open two or more windows (gtk-single-instance, so they share one process and one FcConfig).
3. In each window, generate heavy varied output that forces font fallback — e.g. run a package install (apt/dnf/npm), cat a file mixing CJK / emoji / box-drawing / Nerd Font glyphs, or stream a large colorful log.
4. Intermittently (a race), the process SIGSEGVs and all windows close at once.

Ghostty Logs

SIGSEGV. Coredump backtrace of the faulting thread (binary is a stripped ReleaseFast build; frames symbolized via objdump against the statically-linked libfontconfig and ghostty's own .text):

    #0  <FcFontSort internals>   faulting insn `mov (%rdx,%r9,1),%r11d`
                                 base = pattern + pattern->elts_offset  → UNMAPPED page
    #1  FcFontSort
    #2  FcFontSort
    #3  ghostty: font.discovery.Fontconfig.discover   (src/font/discovery.zig)

All inspected coredumps crash at the same fontconfig site, reached from the samediscover() call site. A debug build would show the inner frames as FcFontSetSort /FcCompareValueList. I can attach a full coredump / debug-build trace on request.

Ghostty Version

Ghostty 1.3.1 (built from source)
  Build Config
    - Zig version : 0.15.2
    - build mode  : .ReleaseFast
    - app runtime : .gtk
    - font engine : .fontconfig_freetype
    - renderer    : renderer.generic.Renderer(renderer.OpenGL)
    - libxev      : io_uring
    - kernel      : 6.8.0-124-generic

OS Version Information

Ubuntu 24.04.4 LTS (Noble Numbat)

(Linux only) Display Server

X11

(Linux only) Desktop Environment/Window Manager

KDE Plasma Version 5.27.12 KDE Frameworks Version 5.115.0

Minimal Ghostty Configuration

Reproducible with default/empty configuration — independent of font-family/theme.

Additional Relevant Configuration

GPU / Renderer info
GPU: Intel Iris Xe Graphics (Raptor Lake-P)
Driver/GL: Mesa 25.2.8-0ubuntu0.24.04.2, OpenGL 4.6
Renderer: OpenGL (GTK)

I acknowledge that:

• I have reviewed the FAQ and confirm that my issue is NOT among them.
• I have searched the Ghostty repository (both open and closed Discussions and Issues) and confirm this is not a duplicate of an existing issue or discussion.
• I have checked the "Preview" tab on all text fields to ensure that everything looks right, and have wrapped all configuration and code in code blocks with a group of three backticks (```) on separate lines.

[pluiedev]

We don't entertain AI slop reports.