Bug 278986 – [Skia] Watchdog thread crash when opening drop-down menu entry due to deadlock in PlatformDisplay::invalidateSkiaGLContexts

• Status: NEW
• Component: WebKitGTK

[darkblaze69]

Created attachment 472391 [details]
gdb-95711.log

* Arch Linux
* gtk4 4.15.6-r104-g5f1ec18550
* webkitgtk-6.0 2.45.6-r1349-gb53fec47fe5a
* epiphany 47.rc

Crash when opening drop-down menu entry.

#0  g_log_structured_array (log_level=log_level@entry=G_LOG_LEVEL_ERROR, fields=fields@entry=0x7ff7e33fedc0, 
    n_fields=3) at ../glib/glib/gmessages.c:426
#1  0x00007ff9af74a887 in g_log_default_handler (log_domain=log_domain@entry=0x0, log_level=log_level@entry=6, 
    message=message@entry=0x7ff9b5b0f350 <.L.str.63> "WebProcess didn't exit as expected after the UI process connection was closed", unused_data=unused_data@entry=0x0) at ../glib/glib/gmessages.c:3357
#2  0x00007ff9989cf723 in trap_handler (log_domain=log_domain@entry=0x0, log_level=log_level@entry=6, 
    message=message@entry=0x7ff9b5b0f350 <.L.str.63> "WebProcess didn't exit as expected after the UI process connection was closed", user_data=user_data@entry=0x0) at ../epiphany/lib/ephy-debug.c:104
#3  0x00007ff9af74ab0c in g_logv (log_domain=0x0, log_level=G_LOG_LEVEL_ERROR, format=<optimized out>, 
    args=args@entry=0x7ff7e33fef30) at ../glib/glib/gmessages.c:1246
#4  0x00007ff9af74ae94 in g_log (log_domain=<optimized out>, log_level=<optimized out>, format=<optimized out>)
    at ../glib/glib/gmessages.c:1315
#5  0x00007ff9b63efa9a in operator() ()
    at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WebKit/WebProcess/WebProcess.cpp:276
#6  call () at WTF/Headers/wtf/Function.h:53
#7  0x00007ff9b38a4cff in operator() () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/Function.h:82
#8  operator() () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/RunLoop.cpp:179
#9  call () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/Function.h:53
#10 0x00007ff9b394bbd3 in operator() ()
    at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:177
#11 __invoke () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:169
#12 0x00007ff9b394ac20 in operator() ()
    at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:53
#13 __invoke () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:45
#14 0x00007ff9af745459 in g_main_dispatch (context=0x7ff6f8000e70) at ../glib/glib/gmain.c:3357
#15 0x00007ff9af7a80d7 in g_main_context_dispatch_unlocked (context=0x7ff6f8000e70) at ../glib/glib/gmain.c:4208
#16 g_main_context_iterate_unlocked.isra.0 (context=0x7ff6f8000e70, block=block@entry=1, dispatch=dispatch@entry=1, 
    self=<optimized out>) at ../glib/glib/gmain.c:4273
#17 0x00007ff9af746187 in g_main_loop_run (loop=0x7ff6f80013c0) at ../glib/glib/gmain.c:4475
#18 0x00007ff9b394b27f in run () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:108
#19 0x00007ff9b38e6319 in operator() () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/Function.h:82
#20 entryPoint () at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/Threading.cpp:266
#21 0x00007ff9b394f21a in WTF::wtfThreadEntryPoint(void*) ()
    at /usr/src/debug/webkitgtk-6.0/WebKit/Source/WTF/wtf/posix/ThreadingPOSIX.cpp:239
#22 0x00007ff9af0a339d in start_thread (arg=<optimized out>) at pthread_create.c:447
#23 0x00007ff9af1282a4 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:100

[Michael Catanzaro]

This is a web process watchdog thread crash, due to a deadlock in PlatformDisplaySkia. The watchdog thread crashes the web process if it has been stuck for more than 10 seconds after the UI process exits.

It sounds like the UI process crashed as well? If so, please report a second bug for that.

[Michael Catanzaro]

Ah, I presume the UI process crash is bug #278987.

[darkblaze69]

maybe related to this also? https://gitlab.gnome.org/GNOME/gtk/-/issues/6981#note_2214508

[Michael Catanzaro]

No, that bug is a crash. This one is a deadlock in PlatformDisplaySkia.

[Carlos Garcia Campos]

What are the steps to reproduce this?

[Michael Catanzaro]

I was able to reproduce this several times just now by following the reproduction steps for bug #278987. However, it does not crash reliably. It's random, and usually it doesn't happen.