Bug#1149690: libwebkit2gtk-4.1-0: evolution does not start
Baptiste
baptiste at struegel.net
Fri Oct 2 11:01:04 BST 2026
Package: libwebkit2gtk-4.1-0
Version: 2.52.6-1~deb13u1
Severity: normal
Tags: upstream patch
Dear Maintainer,
Disclaimer: this bug report has been wroten with the help of a locally-run LLM.
After a reinstallation of my Debian system yesterday 2026-10-01 I found out evolution does not start anymore.
It was working 2 or 3 days ago. Nothing changed, same system: Debian Trixie on ZFS root filesystem, has been reinstalled in the same way (fixing a few partition sizes discrepancies). evolution could not start after reinstall. Local LLM helped to troubleshoot and identified libwebkit2gtk-4.1-0 update release on 2026-10-01? After rollback to previous version, evolution could start again.
I am available for further information. Sorry for bad English and LLM use.
Summary
-------
Any WebKitGTK application aborts with SIGABRT at web process launch when the
environment variable PULSE_SERVER is set to a "unix:" path. The abort happens
before the web process is spawned, so the application dies immediately at
startup. Not reproducible with 2.52.6-1~deb13u1, which is the previous
version in trixie-security.
How to reproduce
----------------
Any WebKitGTK app that creates a WebView, e.g. Evolution:
PULSE_SERVER=unix:/run/user/1000/pulse/native evolution; echo $?
-> Abandon (SIGABRT), exit status 134
Without PULSE_SERVER in the environment the same app starts normally.
Minimal reproducer with python3-gi:
import gi; gi.require_version('Gtk','3.0'); gi.require_version('WebKit2','4.1')
from gi.repository import Gtk, WebKit2
v = WebKit2.WebView(); v.load_html("<html><body>x</body></html>", None)
run with a WebKit 2.54 library (LD_LIBRARY_PATH) and PULSE_SERVER=unix:...
Root cause
----------
Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp, bindPulse():
const char* pulseServer = g_getenv("PULSE_SERVER");
if (pulseServer) {
auto pulseServerString = CStringView::unsafeFromUTF8(pulseServer);
if (startsWith(pulseServerString.span(), "unix:"_s))
bindIfExists(args, CStringView::fromUTF8(pulseServerString.span().subspan(5)), BindFlags::ReadWrite);
// else it uses tcp
}
CStringView::span() returns the span *without* the trailing NUL, so
span().subspan(5) — the path after "unix:" — is not NUL terminated.
CStringView::fromUTF8(std::span) contains
RELEASE_ASSERT(spanWithNullTerminator[spanWithNullTerminator.size() - 1] == '\0');
(Source/WTF/wtf/text/CStringView.h, line 60), so the assertion fails and the
process calls abort(). This is reached while assembling the bubblewrap
sandbox arguments for the web process, which is why the crash happens on the
first WebView that needs a web process.
Backtrace (strace -k, Evolution 3.56.2, webkit2gtk 2.54.0-1~deb13u1):
tgkill(pid, pid, SIGABRT)
> libc.so.6(abort+0x22)
> libwebkit2gtk-4.1.so.0.24.3() [0x7323fb] <- WTF crash helper
> libwebkit2gtk-4.1.so.0.24.3() [0xa1e516] <- CStringView::fromUTF8
(WTFCrashWithInfo line=60, file=.../wtf/text/CStringView.h)
...
> libwebkit2gtk-4.1.so.0.24.3(webkit_web_view_run_javascript+0x2e)
> libevolution-util.so.0.0.0(e_web_view_jsc_run_script+0xe0)
> libevolution-util.so.0.0.0(e_web_view_update_fonts_settings+0x53e)
Upstream status
---------------
Current upstream master no longer contains the CStringView span arithmetic,
it uses plain C pointer arithmetic which keeps the terminator:
if (g_str_has_prefix(pulseServer, "unix:"))
bindIfExists(args, pulseServer + 5, BindFlags::ReadWrite);
(Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp, current tree.)
So the bug is specific to the 2.54.0 release and already fixed upstream;
please consider backporting that change (or importing 2.54.1) for trixie.
Workaround
----------
Do not export PULSE_SERVER with a "unix:" value to WebKit applications (or
keep webkit2gtk at 2.52.6-1~deb13u1, which is what users hit by this bug
will end up doing). A TCP-form PULSE_SERVER value does not trigger it.
(END)
* What led up to the situation?
* What exactly did you do (or not do) that was effective (or
ineffective)?
* What was the outcome of this action?
* What outcome did you expect instead?
*** End of the template - remove these template lines ***
-- System Information:
Debian Release: 13.7
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.111+deb13-amd64 (SMP w/32 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libwebkit2gtk-4.1-0 depends on:
ii bubblewrap 0.12.0-1~deb13u1
ii gstreamer1.0-plugins-base 1.26.2-1+deb13u2
ii gstreamer1.0-plugins-good 1.26.2-1+deb13u2
ii libatk1.0-0t64 2.56.2-1+deb13u2
ii libatomic1 14.2.0-19
ii libavif16 1.2.1-1.2
ii libc6 2.41-12+deb13u4
ii libcairo-gobject2 1.18.4-1+b1
ii libcairo2 1.18.4-1+b1
ii libdrm2 2.4.124-2
ii libenchant-2-2 2.8.2+dfsg1-3
ii libepoxy0 1.5.10-2
ii libexpat1 2.8.3-1~deb13u1
ii libflite1 2.2-7
ii libfontconfig1 2.15.0-2.3
ii libfreetype6 2.13.3+dfsg-1+deb13u1
ii libgbm1 25.0.7-2+deb13u1
ii libgcc-s1 14.2.0-19
ii libgcrypt20 1.11.0-7+deb13u1
ii libgdk-pixbuf-2.0-0 2.42.12+dfsg-4+deb13u1
ii libgles2 1.7.0-1+b2
ii libglib2.0-0t64 2.84.4-3~deb13u5
ii libgpg-error0 1.51-4
ii libgstreamer-gl1.0-0 1.26.2-1+deb13u2
ii libgstreamer-plugins-base1.0-0 1.26.2-1+deb13u2
ii libgstreamer1.0-0 1.26.2-2
ii libgtk-3-0t64 3.24.49-3
ii libharfbuzz-icu0 10.2.0-1+deb13u1
ii libharfbuzz0b 10.2.0-1+deb13u1
ii libhyphen0 2.8.8-7+b2
ii libicu76 76.1-4
hi libjavascriptcoregtk-4.1-0 2.52.6-1~deb13u1
ii libjpeg62-turbo 1:2.1.5-4
ii libjxl0.11 0.11.2-0.1~deb13u2
ii liblcms2-2 2.16-2+deb13u2
ii libmanette-0.2-0 0.2.12-1
ii libpango-1.0-0 1.56.3-1
ii libpangocairo-1.0-0 1.56.3-1
ii libpng16-16t64 1.6.48-1+deb13u5
ii libseccomp2 2.6.0-2
ii libsecret-1-0 0.21.7-1
ii libsoup-3.0-0 3.6.5-3
ii libsqlite3-0 3.46.1-7+deb13u2
ii libstdc++6 14.2.0-19
ii libsystemd0 257.13-1~deb13u1
ii libtasn1-6 4.20.0-2+deb13u1
ii libwayland-client0 1.23.1-3
ii libwayland-egl1 1.23.1-3
ii libwayland-server0 1.23.1-3
ii libwebp7 1.5.0-0.1
ii libwebpdemux2 1.5.0-0.1
ii libwebpmux3 1.5.0-0.1
ii libx11-6 2:1.8.12-1
ii libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3
ii libxslt1.1 1.1.35-1.2+deb13u3
ii xdg-dbus-proxy 0.1.6-1+deb13u3
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
Versions of packages libwebkit2gtk-4.1-0 recommends:
ii gstreamer1.0-gl 1.26.2-1+deb13u2
ii gstreamer1.0-libav 1.26.2-1+deb13u1
ii gstreamer1.0-plugins-bad 1.26.2-3+deb13u3
ii libgl1-mesa-dri 25.0.7-2+deb13u1
ii xdg-desktop-portal-gtk 1.15.3-1
Versions of packages libwebkit2gtk-4.1-0 suggests:
ii gstreamer1.0-alsa 1.26.2-1+deb13u2
-- no debconf information
More information about the Pkg-webkit-maintainers
mailing list