Bug 280239 – Webkit crashes inside Telegram's webview on Wayland

• Status: NEW
• Component: WebKitGTK

Webkit crashes when displaying content inside Telegram's new Mini apps feature on Wayland. It results in an empty window while /usr/lib/webkit2gtk-4.1/WebKitWebProcess crashes in the background.
This does not happen on X11 or XWayland.

Backtrace: 

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
        tid = <optimized out>
        ret = 0
        pd = <optimized out>
        old_mask = {__val = {140721199857392}}
        ret = <optimized out>
#1  0x00007739a06a5463 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:78
No locals.
#2  0x00007739a064c120 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
        ret = <optimized out>
#3  0x00007739a06334c3 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, sa_mask = {__val = {131089458712501, 
              131089461525652, 131089389553536, 0, 0, 140721199857704, 131089387544456, 140721199857704, 140721199857632, 
              140721199857568, 131089387133340, 140721199858080, 131089068234717, 140721199857616, 131089272273781, 
              140721199857704}}, sa_flags = 891371560, sa_restorer = 0x7ffc35213fd0}
#4  0x00007739a36ef49e in WebCore::PlatformDisplayDefault::create ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebCore/platform/graphics/egl/PlatformDisplayDefault.cpp:41
No locals.
#5  0x00007739a14c2c79 in WebKit::WebProcess::initializePlatformDisplayIfNeeded ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/WebProcess/glib/WebProcessGLib.cpp:164
No locals.
#6  0x00007739a14ab156 in WebKit::DrawingAreaCoordinatedGraphics::updatePreferences ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/DrawingAreaCoordinatedGraphics.cpp:214
No locals.
#7  0x00007739a148f945 in WebKit::WebPage::updateAfterDrawingAreaCreation ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/WebProcess/WebPage/WebPage.cpp:1093
No locals.
#8  WebKit::WebPage::WebPage () at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/WebProcess/WebPage/WebPage.cpp:808
--Type <RET> for more, q to quit, c to continue without paging--c
No locals.
#9  0x00007739a148fff0 in WebKit::WebPage::create ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/WebProcess/WebPage/WebPage.cpp:489
No locals.
#10 0x00007739a124b907 in WebKit::WebProcess::createWebPage ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/WebProcess/WebProcess.cpp:900
No locals.
#11 0x00007739a0c2c2f1 in IPC::callMemberFunction<WebKit::WebProcess, WebKit::WebProcess, void (WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters> >(WebKit::WebProcess*, void (WebKit::WebProcess::*)(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>&&)::{lambda((auto:1&&)...)#1}::operator()<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>&&, WebKit::WebPageCreationParameters&&) const ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Platform/IPC/HandleMessage.h:135
No locals.
#12 std::__invoke_impl<void, IPC::callMemberFunction<WebKit::WebProcess, WebKit::WebProcess, void (WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters> >(WebKit::WebProcess*, void (WebKit::WebProcess::*)(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>&&)::{lambda((auto:1&&)...)#1}, WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>(std::__invoke_other, IPC::callMemberFunction<WebKit::WebProcess, WebKit::WebProcess, void (WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters> >(WebKit::WebProcess*, void (WebKit::WebProcess::*)(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>&&)::{lambda((auto:1&&)...)#1}&&, WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>&&, WebKit::WebPageCreationParameters&&) () at /usr/include/c++/14.2.1/bits/invoke.h:61
No locals.
#13 std::__invoke<IPC::callMemberFunction<WebKit::WebProcess, WebKit::WebProcess, void (WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters> >(WebKit::WebProcess*, void (WebKit::WebProcess::*)(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>&&)::{lambda((auto:1&&)...)#1}, WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>(IPC::callMemberFunction<WebKit::WebProcess, WebKit::WebProcess, void (WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters> >(WebKit::WebProcess*, void (WebKit::WebProcess::*)(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>&&)::{lambda((auto:1&&)...)#1}&&, WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>&&, WebKit::WebPageCreationParameters&&) () at /usr/include/c++/14.2.1/bits/invoke.h:96
No locals.
#14 std::__apply_impl<IPC::callMemberFunction<WebKit::WebProcess, WebKit::WebProcess, void (WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters> >(WebKit::WebProcess*, void (WebKit::WebProcess::*)(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>&&)::{lambda((auto:1&&)...)#1}, std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>, 0ul, 1ul>(IPC::callMemberFunction<WebKit::WebProcess, WebKit::WebProcess, void (WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters> >(WebKit::WebProcess*, void (WebKit::WebProcess::*)(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>&&)::{lambda((auto:1&&)...)#1}&&, std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters>&&, std::integer_sequence<unsigned long, 0ul, 1ul>) ()
    at /usr/include/c++/14.2.1/tuple:2921
No locals.
#15 _ZSt5applyIZN3IPC18callMemberFunctionIN6WebKit10WebProcessES3_FvN3WTF23ObjectIdentifierGenericIN7WebCore18PageIdentifierTypeENS4_38ObjectIdentifierMainThreadAccessTraitsImEEmLNS4_33SupportsObjectIdentifierNullStateE1EEEONS2_25WebPageCreationParametersEESt5tupleIJSB_SC_EEEEvPT_MT0_T1_OT2_EUlDpOT_E_TkSt12__tuple_likeSG_EDcOSH_OSJ_ () at /usr/include/c++/14.2.1/tuple:2936
No locals.
#16 IPC::callMemberFunction<WebKit::WebProcess, WebKit::WebProcess, void(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&), std::tuple<WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters> > ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Platform/IPC/HandleMessage.h:133
No locals.
#17 IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess, WebKit::WebProcess, void(WTF::ObjectIdentifierGeneric<WebCore::PageIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long>, unsigned long, (WTF::SupportsObjectIdentifierNullState)1>, WebKit::WebPageCreationParameters&&)> ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Platform/IPC/HandleMessage.h:235
No locals.
#18 0x00007739a0f60b35 in IPC::Connection::dispatchMessage ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Platform/IPC/Connection.cpp:1451
No locals.
#19 IPC::Connection::dispatchMessage ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Platform/IPC/Connection.cpp:1406
No locals.
#20 0x00007739a0f613ce in IPC::Connection::dispatchOneIncomingMessage ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Platform/IPC/Connection.cpp:1518
No locals.
#21 0x000077399fe48cfe in WTF::Function<void()>::operator() ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WTF/wtf/Function.h:82
No locals.
#22 WTF::RunLoop::performWork () at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WTF/wtf/RunLoop.cpp:147
No locals.
#23 0x000077399ff14b0a in operator() () at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WTF/wtf/glib/RunLoopGLib.cpp:80
No locals.
#24 _FUN () at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WTF/wtf/glib/RunLoopGLib.cpp:82
No locals.
#25 0x000077399ff1561c in operator() () at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WTF/wtf/glib/RunLoopGLib.cpp:53
No locals.
#26 _FUN () at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WTF/wtf/glib/RunLoopGLib.cpp:56
No locals.
#27 0x000077399c13e559 in g_main_dispatch (context=0x57411109b0c0) at ../glib/glib/gmain.c:3357
        dispatch = 0x77399ff155c0 <_FUN()>
        prev_source = 0x0
        begin_time_nsec = 62498080611
        was_in_call = 0
        user_data = 0x77397a0180e0
        callback = 0x77399ff14b00 <_FUN()>
        cb_funcs = 0x77399c22f380 <g_source_callback_funcs>
        cb_data = 0x574111280d20
        need_destroy = <optimized out>
        source = 0x5741111f99f0
        current = 0x5741110a4470
        i = 0
        __func__ = "g_main_dispatch"
#28 0x000077399c1a1157 in g_main_context_dispatch_unlocked (context=0x57411109b0c0) at ../glib/glib/gmain.c:4208
No locals.
#29 g_main_context_iterate_unlocked.isra.0 (context=0x57411109b0c0, block=block@entry=1, dispatch=dispatch@entry=1, 
    self=<optimized out>) at ../glib/glib/gmain.c:4273
        max_priority = 2147483647
        timeout_usec = -1
        some_ready = 1
        nfds = 2
        allocated_nfds = <optimized out>
        fds = 0x574111123730
        begin_time_nsec = 62366235340
#30 0x000077399c13f287 in g_main_loop_run (loop=0x5741110831f0) at ../glib/glib/gmain.c:4475
        self = <optimized out>
        __func__ = "g_main_loop_run"
#31 0x000077399ff15c6a in WTF::RunLoop::run ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WTF/wtf/glib/RunLoopGLib.cpp:108
No locals.
#32 0x00007739a14c30a2 in WebKit::AuxiliaryProcessMainBase<WebKit::WebProcess, true>::run ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Shared/AuxiliaryProcessMain.h:72
No locals.
#33 WebKit::AuxiliaryProcessMainBase<WebKit::WebProcess, true>::run ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Shared/AuxiliaryProcessMain.h:59
No locals.
#34 WebKit::AuxiliaryProcessMain<WebKit::WebProcessMainGtk> ()
    at /usr/src/debug/webkit2gtk-4.1/webkitgtk-2.46.0/Source/WebKit/Shared/AuxiliaryProcessMain.h:98
No locals.
#35 0x00007739a0634e08 in __libc_start_call_main (main=main@entry=0x5740dfc31020 <main()>, argc=argc@entry=4, 
    argv=argv@entry=0x7ffc35215128) at ../sysdeps/nptl/libc_start_call_main.h:58
        self = <optimized out>
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140721199862056, -273003310988900872, 4, 0, 131089479036928, 95936143637952, 
                -273003310965832200, -1315840079498951176}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x4, 0x7ffc35215120}, 
            data = {prev = 0x0, cleanup = 0x0, canceltype = 4}}}
        not_first_call = <optimized out>
#36 0x00007739a0634ecc in __libc_start_main_impl (main=0x5740dfc31020 <main()>, argc=4, argv=0x7ffc35215128, 
    init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffc35215118) at ../csu/libc-start.c:360
No locals.
#37 0x00005740dfc31055 in _start ()

System info:
Operating System: Arch Linux 
KDE Plasma Version: 6.1.5
KDE Frameworks Version: 6.6.0
Kernel Version: 6.11.0-arch1-1 (64-bit)
Graphics Platform: Wayland
Processors: 12 × AMD Ryzen 5 7535HS with Radeon Graphics
Memory: 14,9 GB of RAM
Graphics Processor: AMD Radeon 660M

[Michael Catanzaro]

You should see an error message in your journal or terminal:

Could not create default EGL display: %s. Aborting...

Except with an actual reason instead of the %s placeholder. Paste the error message here please.

From terminal: 

> Could not create default EGL display: EGL_BAD_PARAMETER. Aborting...

Also a developer on telegram said this in their issuse tracker: 

> I've got the new webkitgtk and the bug seem to be that webkitgtk is no longer capable of running without EGL. If I run `__EGL_VENDOR_LIBRARY_FILENAMES= epiphany`, epiphany hangs even worse than tdesktop (whole UI). It wasn't happening with webkitgtk 2.44.

[Michael Catanzaro]

EGL has been mandatory for a while (and was always mandatory with Wayland). We're just doing something wrong somewhere.