Raspberry Pi: webkit2gtk apps crash with SIGSEGV in v3d_load_utile

[Daniel van Vugt]

[ Impact ]

webkit2gtk apps crash immediately with SIGSEGV on Raspberry Pi in Xorg sessions. Including the installer, yelp and MiniBrowser.

[ Test Plan ]

1. Log into a Xorg session on a Raspberry Pi 4/400.

2. Open the default Help app by clicking the question mark icon in the dock or by running 'yelp'.

3. Verify it didn't crash.

[ Where problems could occur ]

Anywhere in webkit2gtk apps such as the OEM installer, Help app (yelp).

[ Original description ]

MiniBrowser crashed immediately on Raspberry Pi 400.

ProblemType: Crash
DistroRelease: Ubuntu 24.04
Package: libwebkit2gtk-4.1-0 2.44.0-2
ProcVersionSignature: Ubuntu 6.8.0-1002.2-raspi 6.8.1
Uname: Linux 6.8.0-1002-raspi aarch64
ApportVersion: 2.28.0-0ubuntu1
Architecture: arm64
CasperMD5CheckResult: unknown
CloudArchitecture: aarch64
CloudID: none
CloudName: none
CloudPlatform: none
CloudSubPlatform: config
CurrentDesktop: ubuntu:GNOME
Date: Thu Apr 18 17:32:12 2024
ExecutablePath: /usr/lib/aarch64-linux-gnu/webkit2gtk-4.1/MiniBrowser
JournalErrors: -- No entries --
ProcCmdline: ./MiniBrowser
ProcEnviron:
 LANG=C.UTF-8
 PATH=(custom, no user)
 SHELL=/bin/bash
 TERM=xterm-256color
 XDG_RUNTIME_DIR=<set>
Signal: 11
SignalName: SIGSEGV
SourcePackage: webkit2gtk
StacktraceTop:
 ?? () from /usr/lib/aarch64-linux-gnu/dri/vc4_dri.so
 ?? () from /usr/lib/aarch64-linux-gnu/dri/vc4_dri.so
 ?? () from /usr/lib/aarch64-linux-gnu/dri/vc4_dri.so
 ?? () from /lib/aarch64-linux-gnu/libgbm.so.1
 ?? () from /lib/aarch64-linux-gnu/libwebkit2gtk-4.1.so.0
Title: MiniBrowser crashed with SIGSEGV
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo users
separator:

[Daniel van Vugt (vanvugt)]

#0 0x0000ffff7721ad7c in v3d_load_utile (gpu_stride=16, gpu=0xffff2840e000,
    cpu_stride=4096, cpu=0xffff1e880f90)
    at ../src/broadcom/common/v3d_cpu_tiling.h:108
#1 v3d_move_pixels_general_percpp (gpu=0xffff28126000, cpu=0xffff1e800010,
    cpu_stride=4096, cpp=4, image_h=768, box=0xaaaaf986a674,
    get_pixel_offset=0xffff7721a930 <v3d_get_uif_xor_pixel_offset>,
    is_load=true, gpu_stride=<optimized out>)
    at ../src/broadcom/common/v3d_tiling.c:289
#2 0x0000ffff771dc420 in v3d_resource_transfer_map (pctx=<optimized out>,
    prsc=0xaaaaf9963be0, level=<optimized out>, usage=<optimized out>,
    box=<optimized out>, pptrans=<optimized out>)
    at ../src/gallium/drivers/v3d/v3d_resource.c:327
#3 0x0000ffff762fcb40 in pipe_texture_map (transfer=0xffffc86d4490, h=730,
    w=1024, y=0, x=0, access=1, layer=0, level=0, resource=<optimized out>,
    context=0xaaaaf98e8c40) at ../src/gallium/auxiliary/util/u_inlines.h:557
#4 dri2_map_image (context=0xaaaaf9964910, image=0xaaaaf985df70, x0=0, y0=0,
    width=1024, height=730, flags=1, stride=0xffffc86d459c,
    data=0xffffc86d45a0) at ../src/gallium/frontends/dri/dri2.c:1964
#5 0x0000ffff847a46a8 in gbm_dri_bo_map (_bo=0xaaaaf9872e20, x=0, y=0,
    width=1024, height=730, flags=1, stride=0xffffc86d459c,
    map_data=0xffffc86d45a0) at ../src/gbm/backends/dri/gbm_dri.c:1122
#6 0x0000ffff89d7f644 in WebKit::AcceleratedBackingStoreDMABuf::BufferGBM::didUpdateContents ()
    at /usr/src/webkit2gtk-2.44.0-2/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreDMABuf.cpp:368
#7 0x0000ffff89d809fc in WebKit::AcceleratedBackingStoreDMABuf::frame ()
    at /usr/src/webkit2gtk-2.44.0-2/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreDMABuf.cpp:531

[Daniel van Vugt (vanvugt)]

See also bug 2060938.

[Apport retracing service (apport)]

Thank you for your report!

However, processing it in order to get sufficient information for the
developers failed as the report has a core dump which is invalid. The
corruption may have happened on the system which the crash occurred or during
transit.

Thank you for your understanding, and sorry for the inconvenience!

[Launchpad Janitor (janitor)]

This bug was fixed in the package webkit2gtk - 2.44.2-1ubuntu1

---------------
webkit2gtk (2.44.2-1ubuntu1) oracular; urgency=medium

  * Convert disable-dmabuf-nvidia.patch to disable-dmabuf.patch,
    adding detection for Broadcom to work around corruption and crashes
    occurring in Raspberry Pi X11 sessions. (LP: #2037015, LP: #2062146)
  * debian/control: Change Maintainer to Ubuntu Developers.

 -- Daniel van Vugt <email address hidden> Wed, 29 May 2024 17:44:52 +0800

[Steve Langasek (vorlon)]

Hello Daniel, or anyone else affected,

Accepted webkit2gtk into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/webkit2gtk/2.44.2-0ubuntu0.24.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Daniel van Vugt (vanvugt)]

Verified fixed on a Raspberry Pi 400 using version 2.44.2-0ubuntu0.24.04.2

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for webkit2gtk has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package webkit2gtk - 2.44.2-0ubuntu0.24.04.2

---------------
webkit2gtk (2.44.2-0ubuntu0.24.04.2) noble; urgency=medium

  * Convert disable-dmabuf-nvidia.patch to disable-dmabuf.patch,
    adding detection for Broadcom to work around corruption and crashes
    occurring in Raspberry Pi X11 sessions. (LP: #2037015, LP: #2062146)

 -- Daniel van Vugt <email address hidden> Tue, 04 Jun 2024 15:34:16 +0800