Bug 266875 – [GTK] Reproducible crash on invalid web process message DrawingArea_CommitTransientZoom

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKitGTK

[Kdwk]

Created attachment 469199 [details]
gdb (bt full; c).txt

Crash on reddit.com


Epiphany Technology Preview 45.0-72-g45ecf0688+/ WebKitGTK 2.43.3

[Michael Catanzaro]

Invalid web process message... normally this indicates that the UI process version does not match the web process version, i.e. that you updated WebKit while it's running. This is supposed to be impossible to do with flatpak. I'm fairly confident you've found another bug in flatpak itself. The newer updated runtime is not supposed to get used until you restart the app.

It's also theoretically possible that we have messed up some IPC message, but this seems less likely. You've already proved that flatpak is severely broken in bug #265349 and this seems like another symptom of the same. Accordingly, I'm going to mark this one as a duplicate even though the symptom is different.

It's also notable that you reported this at the same time as bug #266874, which is a dup of bug #265349.

*** This bug has been marked as a duplicate of bug 265349 ***

[Michael Catanzaro]

*** Bug 266886 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

(In reply to Michael Catanzaro from comment #1)
> It's also theoretically possible that we have messed up some IPC message,
> but this seems less likely.

It seems this is the case. Here is Kdwk's reproducer from bug #266886:

"""
I opened this bug a while ago but that was closed as a duplicate of the 'Flatpak is broken' bug. However, this does not seem to be a symptom of the WebKit being updated while the app is running. I am able to reliably reproduce by:

1. Go to reddit.com and open a post
2. Use 2 fingers on a touchpad to zoom in
3. Try to anything else
4. The page would hang and soon crash

Epiphany Tech Preview 45.0-73-gce94d4cd5+/ WebKitGTK 2.43.3
"""

[Adrian Vovk]

Epiphany 45.2 (Flatpak)
WebKitGTK 2.44.0
GStreamer 1.22.10

After updating Epiphany, I started experiencing this bug. Same symptoms: zoom in w/ trackpad gesture -> frozen tab and (ultimately) frozen epiphany -> crash of tab & (most of the time) I have to kill epiphany and restart it.

Here's the invalid message, from the system log:
  org.gnome.Epiphany.desktop[30686]: Received invalid message: 'DrawingArea_CommitTransientZoom'
	
That's the only thing printed when I trigger the bug. What follows is a SIGABRT. I made sure to completely kill the Epiphany flatpak before reproducing the bug

[Adrian Vovk]

Some clarifications on the behavior:
- I can reproduce on any website, not just Reddit
- It freezes immediately after I let go of the pinch-to-zoom gesture. Confirmed by trying to pinch-to-zoom on a page with a GIF on it. While I'm in the middle of the gesture I can pinch in/out no problem. It's just when I let go. This seems to track with the name of the missing message

[Michael Catanzaro]

(In reply to Adrian Vovk from comment #4)
> Here's the invalid message, from the system log:
>   org.gnome.Epiphany.desktop[30686]: Received invalid message:
> 'DrawingArea_CommitTransientZoom'

Hey Kdwk, can you confirm you see this invalid message please? I assume so, since your reproducer involves zooming.

[Kdwk]

I can confirm

[Philippe Normand]

*** Bug 271516 has been marked as a duplicate of this bug. ***

[Philippe Normand]

Might be a regression introduced by https://commits.webkit.org/272128@main ... The message was made async but Source/WebKit/UIProcess/CoordinatedGraphics/DrawingAreaProxyCoordinatedGraphics.cpp wasn't adapted accordingly (should use `sendWithAsyncReply()` instead of `send()`, iiuc).

[Philippe Normand]

Pull request: https://github.com/WebKit/WebKit/pull/26372

[EWS]

Committed 276608@main (7e81143103b9): <https://commits.webkit.org/276608@main>

Reviewed commits have been landed. Closing PR #26372 and removing active labels.

[Kdwk]

Unfortunately this issue is not fixed by the PR.

[Philippe Normand]

(In reply to Kdwk from comment #12)
> Unfortunately this issue is not fixed by the PR.

I tested it here in MiniBrowser before submitting the PR. Is the crash the same?

[Kdwk]

Yes, the crash is the same

[Philippe Normand]

Works fine here, I can now pinch-zoom without any trouble... on reddit or anywhere. shrug :)

[Adrian Perez]

I have backported the fix to the 2.44 release branch, it will be part of
the 2.44.1 release.

[Michael Catanzaro]

(In reply to Kdwk from comment #12)
> Unfortunately this issue is not fixed by the PR.

Discussed on Matrix and determined something is wrong with Kdwk's build. This is fixed.

[Michael Catanzaro]

*** Bug 271466 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

*** Bug 272905 has been marked as a duplicate of this bug. ***

[Bret Joseph]

I am still experiencing this of Ubuntu Noble Numbat (development branch)

libwebkitgtk-6.0.so.4.5.4

[Philippe Normand]

(In reply to Bret Joseph from comment #20)
> I am still experiencing this of Ubuntu Noble Numbat (development branch)
> 
> libwebkitgtk-6.0.so.4.5.4

Please check if you have this version: 2.44.2-0ubuntu0.24.04.1

[Bret Joseph]

(In reply to Philippe Normand from comment #21)
> (In reply to Bret Joseph from comment #20)
> > I am still experiencing this of Ubuntu Noble Numbat (development branch)
> > 
> > libwebkitgtk-6.0.so.4.5.4
> 
> Please check if you have this version: 2.44.2-0ubuntu0.24.04.1

Yes I have 2.44.2-0ubuntu0.24.04.1

[Bret Joseph]

Actually updated and upgraded maybe I had previous version. It seems I might have been using an updated version

[Philippe Normand]

So it works now?

[Bret Joseph]

(In reply to Philippe Normand from comment #24)
> So it works now?

yes its working fine