Bug 223108 – [GTK] GTK4 crashes with XVFB: GLXBadWindow

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Lauro Moura]

A large number of tests are crashing in the GTK4 bot with GLXBadWindow errors when using `--display-server=xvfb`, which is the current setup used there. Running locally also triggers the crash. The list below had no crashes running locally with the weston display server, just 3 failures.

http/tests/dom/noreferrer-window-not-targetable.html
http/tests/dom/noopener-window-not-targetable2.html
http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/proper-uir-on-navigation.html
http/tests/security/frameNavigation/inactive-function-in-popup-navigate-child.html
http/tests/security/frameNavigation/not-opener.html
http/tests/security/credentials-from-different-domains.html
http/tests/appcache/identifier-test.html
http/wpt/fetch/fetch-in-pagehide.html
imported/w3c/web-platform-tests/content-security-policy/inheritance/window.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-non-integer-innerheight.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-non-integer-left.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-negative-screenx-screeny.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-negative-top-left.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-negative-width-height.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/no_window_open_when_term_nesting_level_nonzero.window.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-non-integer-innerwidth.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-non-integer-screenx.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-negative-innerwidth-innerheight.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-non-integer-height.html
imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/top-level-data-url.window.html
imported/w3c/web-platform-tests/html/browsers/windows/noreferrer-window-name.html
imported/w3c/web-platform-tests/html/browsers/windows/auxiliary-browsing-contexts/opener-setter.html
imported/w3c/web-platform-tests/html/browsers/windows/auxiliary-browsing-contexts/opener.html
imported/w3c/web-platform-tests/html/browsers/windows/targeting-cross-origin-nested-browsing-contexts.sub.html
imported/w3c/web-platform-tests/html/browsers/windows/targeting-cross-origin-nested-browsing-contexts.html
imported/w3c/web-platform-tests/fetch/security/embedded-credentials.tentative.sub.html

The actual number must be larger, as the bot is exiting earlier due to these crashes.

Thread 1 trace:

Thread 1 (Thread 0x7f2982211f00 (LWP 69)):
#0  0x00007f29889abb5e in WTFCrash () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-5.0.so.18
#1  0x00007f298b94c86a in WebCore::XErrorTrapper::errorEvent(XErrorEvent*) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#2  0x00007f298b94c8f7 in WebCore::XErrorTrapper::XErrorTrapper(_XDisplay*, WebCore::XErrorTrapper::Policy, WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&)::{lambda(_XDisplay*, XErrorEvent*)#1}::_FUN(_XDisplay*, XErrorEvent*) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#3  0x00007f29836f155b in _XError (dpy=dpy@entry=0x55d8c1c8e3a0, rep=rep@entry=0x55d8c32ec430) at ../../src/XlibInt.c:1491
#4  0x00007f29836ee2c7 in handle_error (dpy=0x55d8c1c8e3a0, err=0x55d8c32ec430, in_XReply=<optimized out>) at ../../src/xcb_io.c:199
#5  0x00007f29836ee365 in handle_response (dpy=dpy@entry=0x55d8c1c8e3a0, response=0x55d8c32ec430, in_XReply=in_XReply@entry=1) at ../../src/xcb_io.c:324
#6  0x00007f29836ef2ed in _XReply (dpy=dpy@entry=0x55d8c1c8e3a0, rep=rep@entry=0x7fff0f7fe020, extra=extra@entry=0, discard=discard@entry=1) at ../../src/xcb_io.c:634
#7  0x00007f29836eab1f in XSync (dpy=0x55d8c1c8e3a0, discard=0) at ../../src/Sync.c:44
#8  0x00007f2989c8d1c6 in WebKit::AcceleratedBackingStoreX11::update(WebKit::LayerTreeContext const&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#9  0x00007f2989c02718 in webkitWebViewBasePageClosed(_WebKitWebViewBase*) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#10 0x00007f2989b1857b in WebKit::WebPageProxy::close() [clone .part.0] () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#11 0x000055d8c0487a09 in WTR::closeOtherPage(OpaqueWKPage const*, void const*) ()
#12 0x00007f29896f0a25 in WebKit::WebPageProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#13 0x00007f29899eab6b in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#14 0x00007f2989b2765f in non-virtual thunk to WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#15 0x00007f29899e38ad in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#16 0x00007f29899e42a8 in IPC::Connection::dispatchIncomingMessages() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#17 0x00007f29889ceadb in WTF::RunLoop::performWork() () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-5.0.so.18
#18 0x00007f2988a42b09 in WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-5.0.so.18
#19 0x00007f2988a435ef in WTF::RunLoop::{lambda(_GSource*, int (*)(void*), void*)#1}::_FUN(_GSource*, int (*)(void*), void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-5.0.so.18
#20 0x00007f298dc6cdbf in g_main_dispatch (context=0x55d8c1ce07a0) at ../glib/gmain.c:3337
#21 g_main_context_dispatch (context=0x55d8c1ce07a0) at ../glib/gmain.c:4055
#22 0x00007f298dc6d168 in g_main_context_iterate (context=0x55d8c1ce07a0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4131
#23 0x00007f298dc6d483 in g_main_loop_run (loop=0x55d8c2228db0) at ../glib/gmain.c:4329
#24 0x00007f2988a43738 in WTF::RunLoop::run() () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-5.0.so.18
#25 0x000055d8c04c2a89 in WTR::TestController::platformRunUntil(bool&, WTF::Seconds) ()
#26 0x000055d8c04aa791 in WTR::TestInvocation::invoke() ()
#27 0x000055d8c0491f2a in WTR::TestController::runTest(char const*) ()
#28 0x000055d8c04925ff in WTR::TestController::runTestingServerLoop() ()
#29 0x000055d8c0493dc8 in WTR::TestController::TestController(int, char const**) ()
#30 0x000055d8c048335c in main ()

And STDERR before the trace:
 
STDERR: Gdk-Message: 16:34:25.553: Failed to get file transfer portal: Error spawning command line “dbus-launch --autolaunch=9f2b401abdc6c6c1d15ef4a44ac5ea33 --binary-syntax --close-stderrâ€: Child process exited with code 1
STDERR: The program with pid 11538 received an X Window System error.
STDERR: The error was 'GLXBadWindow'.
STDERR:   (Details: serial 4940 error_code 168 request_code 147 minor_code 32)

[Carlos Garcia Campos]

Created attachment 423038 [details]
Patch

[Carlos Garcia Campos]

Ignore the coding style failure, those headers need to be included in that order

[Lauro Moura]

(In reply to Carlos Garcia Campos from comment #1)
> Created attachment 423038 [details]
> Patch

http/tests/security/frameNavigation/not-opener.html

Still crashing:

Thread 1 (Thread 0x7fec9c440f00 (LWP 69)):
#0  0x00007feca2bdab5e in WTFCrash () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-5.0.so.18
#1  0x00007feca3ec0da5 in  () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#2  0x00007feca3ec0dfc in WebKit::HardwareAccelerationManager::singleton() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#3  0x00007feca3ec6c69 in WebKit::WebPreferences::platformInitializeStore() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#4  0x00007feca3d59399 in WebKit::WebPreferences::createWithLegacyDefaults(WTF::String const&, WTF::String const&, WTF::String const&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#5  0x00007feca3d3621f in WebKit::WebPageGroup::WebPageGroup(WTF::String const&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#6  0x00007feca3d36462 in WebKit::WebPageGroup::create(WTF::String const&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#7  0x00007feca3db7218 in WKPageGroupCreateWithIdentifier () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-5.0.so.0
#8  0x000055bf2b67618d in WTR::TestController::initialize(int, char const**) ()
#9  0x000055bf2b676d3e in WTR::TestController::TestController(int, char const**) ()
#10 0x000055bf2b66635c in main ()


Compiling a debug build to get a more complete trace, but likely failing the RELEASE_ASSERT(AcceleratedBackingStore::checkRequirements()); in the HardwareAccelerationManager.

[Carlos Garcia Campos]

Created attachment 423040 [details]
Patch

[Lauro Moura]

(In reply to Carlos Garcia Campos from comment #4)
> Created attachment 423040 [details]
> Patch

checkRequirements does not assert, but reverted back to GLXBadWindow issue from the first comment. Same backtrace.

[Carlos Garcia Campos]

Created attachment 423044 [details]
Patch

[Lauro Moura]

(In reply to Carlos Garcia Campos from comment #6)
> Created attachment 423044 [details]
> Patch

No crashes with 

http/tests/security/frameNavigation/not-opener.html

Running the entire suite to check.

[Carlos Garcia Campos]

Committed r274354 (235223@main): <https://commits.webkit.org/235223@main>