Summary: | REGRESSION(273818@main): [GTK] Eclipse crashes when rendering tooltips: gdk_window_create_gl_context: assertion 'GDK_IS_WINDOW (window)' failed in WebKit::AcceleratedBackingStoreDMABuf::ensureGLContext | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Robert Marcano <robert> | ||||||
Component: | WebKitGTK | Assignee: | Carlos Garcia Campos <cgarcia> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Major | CC: | bugs-noreply, mcatanzaro, oreo6391 | ||||||
Priority: | P2 | ||||||||
Version: | Other | ||||||||
Hardware: | PC | ||||||||
OS: | Linux | ||||||||
Attachments: |
|
Description
Robert Marcano
2024-03-22 11:03:19 PDT
Based on Eclipse developers debugging [1], this can be tracked to another WebKitGTK bug with hardware acceleration [2] Bug 239429 comment 11 [1] https://github.com/eclipse-platform/eclipse.platform.swt/issues/1108#issuecomment-2023256520 WEBKIT_DISABLE_COMPOSITING_MODE=1 is another workaround I don't think this looks similar to bug #239429. They already disabled HW acceleration for the next Eclipse release. I will point them to this bug for reference. I will keep a copy of this Eclipse release around just in case someone needs to test on my hardware about this bug. Created attachment 471668 [details] Backtrace of gdk_window_create_gl_context() error with G_DEBUG=fatal-criticals I reproduced this on Void Linux, the backtrace is attached as a text file. After updating to 2.44.x from 2.42.x, in some circumstances gdk_window_create_gl_context() fails where it previously did not with the message "Gdk-CRITICAL **: 21:29:29.313: gdk_window_create_gl_context: assertion 'GDK_IS_WINDOW (window)' failed". Shortly after that, libwebkit2gtk crashes due to a nullptr dereference on the following line: WebKit::AcceleratedBackingStoreDMABuf::ensureGLContext () at ../Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreDMABuf.cpp:537 https://github.com/WebKit/WebKit/blob/webkitgtk-2.44.2/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreDMABuf.cpp#L537 It appears that after updating from 2.42.x to 2.44.x gtk_widget_get_window() can get called here without a realized window, resulting in it returning a nullptr (also while leaving the error pointer null), this gets passed in to gdk_window_create_gl_context() which cannot create a gl context for a null window, which causes libwebkit2gtk to try to abort while printing the message from the error pointer, which results in it dereferencing the null error pointer value and crashing. Btw, this bug affects nyxt as well: https://github.com/atlas-engineer/nyxt/issues/3393 I'm not sure how to reproduce it consistently with nyxt though. Pull request: https://github.com/WebKit/WebKit/pull/29811 Committed 280197@main (847b2a717cfb): <https://commits.webkit.org/280197@main> Reviewed commits have been landed. Closing PR #29811 and removing active labels. |