Source: webkit2gtk
Severity: important
Tags: patch
On systems using the proprietary NVIDIA driver, any WebKitGTK application
crashes with SIGSEGV the first time page content requires a compositing
layer.
disable-nvidia-dmabuf.patch adds its isNVIDIA() check before
mode.add(RendererBufferTransportMode::SharedMemory), so on NVIDIA the
function returns with an empty mode rather than with SharedMemory only:
rendererBufferTransportMode() -> empty
checkRequirements() -> false (silently, no warning)
AcceleratedBackingStore::create() -> nullptr
priv->acceleratedBackingStore -> NULL
webkitWebViewBaseEnterAcceleratedCompositingMode() then dereferences that
pointer, guarded only by an ASSERT that compiles out in release builds:
ASSERT(webkitWebViewBase->priv->acceleratedBackingStore);
webkitWebViewBase->priv->acceleratedBackingStore->update(layerTreeContext);
Backtrace (libwebkit2gtk-4.1-0 2.52.3-0ubuntu0.24.04.1 with dbgsym):
#0 AcceleratedBackingStore::update() AcceleratedBackingStore.cpp:808
#1 WebPageProxy::enterAcceleratedCompositingMode()
#2 DrawingAreaProxyCoordinatedGraphics::enterAcceleratedCompositingMode()
#3 DrawingAreaProxy::didReceiveMessage()
<- IPC Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode
The intent of the patch is to disable the hardware DMABuf transport, not the
software one. Moving the check three lines down keeps SharedMemory, which is
what the backing store needs, and puts NVIDIA on the same path as the
existing WEBKIT_DMABUF_RENDERER_FORCE_SHM escape hatch immediately below it:
--- a/debian/patches/disable-nvidia-dmabuf.patch
+++ b/debian/patches/disable-nvidia-dmabuf.patch
@@
- if (isNVIDIA())
- return;
-
mode.add(RendererBufferTransportMode::SharedMemory);
+ if (isNVIDIA())
+ return;
+
const char* forceSHM = getenv("WEBKIT_DMABUF_RENDERER_FORCE_SHM");
Verification on affected hardware (GeForce RTX 3050 Ti, driver 580.173.02,
X11, Ubuntu 24.04, libwebkit2gtk-4.1-0 2.52.3-0ubuntu0.24.04.1). Values read
from the running process and from the core dump:
mode = {} (current) create() = 0x0 -> SIGSEGV
mode = {SHM, HW} (WEBKIT_FORCE_DMABUF_RENDERER=1) no crash, blank window
mode = {SharedMemory} renders, no crash
The third row is the state the proposed change produces. I reproduced it with
WEBKIT_FORCE_DMABUF_RENDERER=1 WEBKIT_DMABUF_RENDERER_FORCE_SHM=1 rather than
by rebuilding the package, so the resulting mode is identical but isNVIDIA()
is short-circuited instead of running and returning afterwards. I have not
built a patched webkit2gtk to confirm the built artifact.
I could not determine why the check was originally placed before the
SharedMemory line. One possibility is that an empty mode still had a usable
fallback when the patch was written and that fallback has since been removed;
if SharedMemory must also be disabled on NVIDIA for a reason I am not aware
of, then the fix belongs instead in the null handling in
webkitWebViewBaseEnterAcceleratedCompositingMode().
Existing references: Debian #1039720, WebKit #262607, WebKit PR 18614 (which
does not appear to have landed upstream -- the 2.52.3 tag has no isNVIDIA()).
Workaround for affected users, forcing EGL to Mesa so isNVIDIA() is false:
__EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json
Kyle W. Santiago
CTO
[email protected]
[Website](https://privkey.io/) | [GitHub](https://github.com/privkeyio) |
[LinkedIn](https://www.linkedin.com/in/kwsantiago/) |
[PGP](https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x23ae8a8ea7e24e38)
