315577 2026-05-26 10:36:23 -0700 [GTK] Memory corruption when destroying DRMDeviceManager in exit handler 2026-06-16 15:51:40 -0700 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build PC Linux NEW https://bugzilla.redhat.com/show_bug.cgi?id=2464924 https://bugzilla.redhat.com/show_bug.cgi?id=2481565 https://bugzilla.redhat.com/show_bug.cgi?id=2480975 https://bugs.webkit.org/show_bug.cgi?id=305909 https://bugzilla.redhat.com/show_bug.cgi?id=2478138 P2 Normal --- 1 mcatanzaro webkit-unassigned bugs-noreply mcatanzaro zimmermann oldest_to_newest 2214155 0 mcatanzaro 2026-05-26 10:36:23 -0700 This is related to bug #305909. We have several reports of memory corruption in an exit handler, when destroying the DRMDeviceManager. We ought to use NeverDestroyed to avoid this. Here is the simplest such stack trace. Some of them are more complicated, but all occur under WebCore::GBMDevice::~GBMDevice: Thread 1 (Thread 0x7fa179b69680 (LWP 2)): #0 0x00007fa184685377 in unlink_chunk (p=0x561035562aa0, av=0x7fa1847f6ac0 <main_arena>) at malloc.c:1591 fd = 0x561035564a00 bk = 0x561000000002 #1 0x00007fa1846854a8 in _int_free_create_chunk (av=av@entry=0x7fa1847f6ac0 <main_arena>, p=p@entry=0x561035560450, size=size@entry=9808, nextchunk=<optimized out>, nextsize=7952) at malloc.c:4375 nextinuse = <optimized out> bck = <optimized out> fwd = <optimized out> #2 0x00007fa184686636 in _int_free_merge_chunk (av=0x7fa1847f6ac0 <main_arena>, p=0x561035560450, size=9808) at malloc.c:4354 nextchunk = <optimized out> nextsize = <optimized out> #3 0x00007fa184686794 in _int_free_chunk (av=0x7fa1847f6ac0 <main_arena>, p=<optimized out>, size=<optimized out>, have_lock=<optimized out>, have_lock@entry=0) at malloc.c:4278 err = 0 #4 0x00007fa184689356 in __GI___libc_free (mem=<optimized out>) at malloc.c:3353 p = <optimized out> size = <optimized out> #5 0x00007fa11c1d0288 in dri_destroy (gbm=0x561035435f20) at ../src/gbm/backends/dri/gbm_dri.c:1183 dri = 0x561035435f20 i = <optimized out> #6 0x00007fa17ff0c714 in _gbm_device_destroy (gbm=<optimized out>) at ../src/gbm/main/backend.c:171 backend_desc = 0x5610353eba90 #7 0x00007fa184bc284c in WebCore::GBMDevice::~GBMDevice (this=0x7fa16f000b90) at /usr/src/debug/webkitgtk-2.52.3-1.fc45.x86_64/Source/WebCore/platform/graphics/gbm/GBMDevice.cpp:63 #8 WTF::ThreadSafeRefCounted<WebCore::GBMDevice, (WTF::DestructionThread)1>::deref() const::{lambda()#1}::operator()() const (this=<optimized out>) at WTF/Headers/wtf/ThreadSafeRefCounted.h:102 #9 WTF::Detail::CallableWrapper<WTF::ThreadSafeRefCounted<WebCore::GBMDevice, (WTF::DestructionThread)1>::deref() const::{lambda()#1}, void>::call() (this=<optimized out>) at WTF/Headers/wtf/Function.h:59 #10 0x00007fa187685448 in WTF::ThreadSafeRefCounted<WebCore::GBMDevice, (WTF::DestructionThread)1>::deref (this=0x7fa16f000b90) at WTF/Headers/wtf/ThreadSafeRefCounted.h:101 #11 WTF::DefaultRefDerefTraits<WebCore::GBMDevice>::derefIfNotNull (ptr=0x7fa16f000b90) at WTF/Headers/wtf/Ref.h:64 #12 WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> >::~RefPtr (this=0x7fa16f01c328) at WTF/Headers/wtf/RefPtr.h:66 #13 std::_Optional_payload_base<WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> > >::_M_destroy (this=0x7fa16f01c328) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/optional:323 #14 std::_Optional_payload_base<WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> > >::_M_reset (this=0x7fa16f01c328) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/optional:354 #15 std::_Optional_payload<WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> >, false, false, false>::~_Optional_payload (this=0x7fa16f01c328) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/optional:477 #16 std::_Optional_base<WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> >, false, false>::~_Optional_base (this=0x7fa16f01c328) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/optional:501 #17 WebCore::DRMDeviceManager::{unnamed type#1}::~DRMDeviceManager() (this=0x7fa16f01c300) at /usr/src/debug/webkitgtk-2.52.3-1.fc45.x86_64/Source/WebCore/platform/graphics/gbm/DRMDeviceManager.h:55 #18 0x00007fa18768532e in WebCore::DRMDeviceManager::~DRMDeviceManager (this=0x7fa16f01c300) at /usr/src/debug/webkitgtk-2.52.3-1.fc45.x86_64/Source/WebCore/platform/graphics/gbm/DRMDeviceManager.cpp:44 #19 std::default_delete<WebCore::DRMDeviceManager>::operator() (this=0x7fa189da3768 <_ZZN7WebCore16DRMDeviceManager9singletonEvE9s_manager.llvm.12492648584019885231>, __ptr=0x7fa16f01c300) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/bits/unique_ptr.h:92 #20 std::unique_ptr<WebCore::DRMDeviceManager, std::default_delete<WebCore::DRMDeviceManager> >::~unique_ptr (this=0x7fa189da3768 <_ZZN7WebCore16DRMDeviceManager9singletonEvE9s_manager.llvm.12492648584019885231>) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/bits/unique_ptr.h:398 __ptr = @0x7fa189da3768: 0x7fa16f01c300 #21 0x00007fa184621d81 in __run_exit_handlers (status=0, listp=0x7fa1847f6680 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:118 atfct = <optimized out> onfct = <optimized out> cxafct = <optimized out> arg = <optimized out> f = <optimized out> new_exitfn_called = 2804 cur = 0x7fa1847f7fa0 <initial> #22 0x00007fa184621e5e in __GI_exit (status=<optimized out>) at exit.c:148 #23 0x00007fa184608688 in __libc_start_call_main (main=main@entry=0x5610307134a0 <main(int, char**)>, argc=argc@entry=3, argv=argv@entry=0x7ffcc92bfaa8) at ../sysdeps/nptl/libc_start_call_main.h:83 result = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -4672943008369691645, 140723683588776, 3, 140331781521440, 94627532201312, -4672943008323554301, -4639616356607544317}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x7ffcc92bfaa8}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> #24 0x00007fa184608798 in __libc_start_main_impl (main=0x5610307134a0 <main(int, char**)>, argc=3, argv=0x7ffcc92bfaa8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffcc92bfa98) at ../csu/libc-start.c:360 #25 0x00005610307133d5 in _start () 2214763 1 mcatanzaro 2026-05-26 16:49:05 -0700 One user reports: """ I just closed Proton Authenticator application (installed from file ProtonAuthenticator-1.1.5-1.x86_64.rpm) and it shows an error. Application closed normally from my perspective. It does not do this all the time i close this application. Instead, the way to reproduce the crash is this: - open the app, resize it, move it to another monitor, close the app. """ I don't have a spare monitor, so I haven't tested this. 2221388 2 mcatanzaro 2026-06-16 15:51:08 -0700 I found a reproducer, but it's not one that I can share. :( Loading a particular email in an experimental nonpublic email client triggers a UI process crash, and then this web process crash occurs consequently. 2221389 3 mcatanzaro 2026-06-16 15:51:40 -0700 (The UI process crash is an application bug, not a WebKit bug.)