<div style="font-family: Arial, sans-serif; font-size: 14px;"><span>Source: webkit2gtk</span><div><span>Severity: important</span></div><div><span>Tags: patch</span></div><div><br></div><div><span>On systems using the proprietary NVIDIA driver, any WebKitGTK application</span></div><div><span>crashes with SIGSEGV the first time page content requires a compositing</span></div><div><span>layer.</span></div><div><br></div><div><span>disable-nvidia-dmabuf.patch adds its isNVIDIA() check before</span></div><div><span>mode.add(RendererBufferTransportMode::SharedMemory), so on NVIDIA the</span></div><div><span>function returns with an empty mode rather than with SharedMemory only:</span></div><div><br></div><div><span> rendererBufferTransportMode() -> empty</span></div><div><span> checkRequirements() -> false (silently, no warning)</span></div><div><span> AcceleratedBackingStore::create() -> nullptr</span></div><div><span> priv->acceleratedBackingStore -> NULL</span></div><div><br></div><div><span>webkitWebViewBaseEnterAcceleratedCompositingMode() then dereferences that</span></div><div><span>pointer, guarded only by an ASSERT that compiles out in release builds:</span></div><div><br></div><div><span> ASSERT(webkitWebViewBase->priv->acceleratedBackingStore);</span></div><div><span> webkitWebViewBase->priv->acceleratedBackingStore->update(layerTreeContext);</span></div><div><br></div><div><span>Backtrace (libwebkit2gtk-4.1-0 2.52.3-0ubuntu0.24.04.1 with dbgsym):</span></div><div><br></div><div><span> #0 AcceleratedBackingStore::update() AcceleratedBackingStore.cpp:808</span></div><div><span> #1 WebPageProxy::enterAcceleratedCompositingMode()</span></div><div><span> #2 DrawingAreaProxyCoordinatedGraphics::enterAcceleratedCompositingMode()</span></div><div><span> #3 DrawingAreaProxy::didReceiveMessage()</span></div><div><span> <- IPC Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode</span></div><div><br></div><div><span>The intent of the patch is to disable the hardware DMABuf transport, not the</span></div><div><span>software one. Moving the check three lines down keeps SharedMemory, which is</span></div><div><span>what the backing store needs, and puts NVIDIA on the same path as the</span></div><div><span>existing WEBKIT_DMABUF_RENDERER_FORCE_SHM escape hatch immediately below it:</span></div><div><br></div><div><span>--- a/debian/patches/disable-nvidia-dmabuf.patch</span></div><div><span>+++ b/debian/patches/disable-nvidia-dmabuf.patch</span></div><div><span>@@</span></div><div><span>- if (isNVIDIA())</span></div><div><span>- return;</span></div><div><span>-</span></div><div><span> mode.add(RendererBufferTransportMode::SharedMemory);</span></div><div><br></div><div><span>+ if (isNVIDIA())</span></div><div><span>+ return;</span></div><div><span>+</span></div><div><span> const char* forceSHM = getenv("WEBKIT_DMABUF_RENDERER_FORCE_SHM");</span></div><div><br></div><div><span>Verification on affected hardware (GeForce RTX 3050 Ti, driver 580.173.02,</span></div><div><span>X11, Ubuntu 24.04, libwebkit2gtk-4.1-0 2.52.3-0ubuntu0.24.04.1). Values read</span></div><div><span>from the running process and from the core dump:</span></div><div><br></div><div><span> mode = {} (current) create() = 0x0 -> SIGSEGV</span></div><div><span> mode = {SHM, HW} (WEBKIT_FORCE_DMABUF_RENDERER=1) no crash, blank window</span></div><div><span> mode = {SharedMemory} renders, no crash</span></div><div><br></div><div><span>The third row is the state the proposed change produces. I reproduced it with</span></div><div><span>WEBKIT_FORCE_DMABUF_RENDERER=1 WEBKIT_DMABUF_RENDERER_FORCE_SHM=1 rather than</span></div><div><span>by rebuilding the package, so the resulting mode is identical but isNVIDIA()</span></div><div><span>is short-circuited instead of running and returning afterwards. I have not</span></div><div><span>built a patched webkit2gtk to confirm the built artifact.</span></div><div><br></div><div><span>I could not determine why the check was originally placed before the</span></div><div><span>SharedMemory line. One possibility is that an empty mode still had a usable</span></div><div><span>fallback when the patch was written and that fallback has since been removed;</span></div><div><span>if SharedMemory must also be disabled on NVIDIA for a reason I am not aware</span></div><div><span>of, then the fix belongs instead in the null handling in</span></div><div><span>webkitWebViewBaseEnterAcceleratedCompositingMode().</span></div><div><br></div><div><span>Existing references: Debian #1039720, WebKit #262607, WebKit PR 18614 (which</span></div><div><span>does not appear to have landed upstream -- the 2.52.3 tag has no isNVIDIA()).</span></div><div><br></div><div><span>Workaround for affected users, forcing EGL to Mesa so isNVIDIA() is false:</span></div><div><br></div><span> __EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json</span><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div>
<div style="font-family: Arial, sans-serif; font-size: 14px;" class="protonmail_signature_block">
<div class="protonmail_signature_block-user">
<div><span>Kyle W. Santiago</span></div><div>CTO<br></div><div><a href="mailto:kyle@privkey.io" rel="noreferrer nofollow noopener" title="kyle@privkey.io">kyle@privkey.io</a><br></div><div><br></div><div><span><a href="https://privkey.io/" title="https://privkey.io/" target="_blank" rel="noreferrer nofollow noopener">Website</a> | <a href="https://github.com/privkeyio" title="GitHub">GitHub</a> | <a href="https://www.linkedin.com/in/kwsantiago/" title="LinkedIn" rel="noreferrer nofollow noopener">LinkedIn</a> | <a href="https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x23ae8a8ea7e24e38" title="PGP" rel="noreferrer nofollow noopener">PGP</a></span></div>
</div>
<div class="protonmail_signature_block-proton protonmail_signature_block-empty">
</div>
</div>