This is related to bug #305909. We have several reports of memory corruption in an exit handler, when destroying the DRMDeviceManager. We ought to use NeverDestroyed to avoid this. Here is the simplest such stack trace. Some of them are more complicated, but all occur under WebCore::GBMDevice::~GBMDevice: Thread 1 (Thread 0x7fa179b69680 (LWP 2)): #0 0x00007fa184685377 in unlink_chunk (p=0x561035562aa0, av=0x7fa1847f6ac0 <main_arena>) at malloc.c:1591 fd = 0x561035564a00 bk = 0x561000000002 #1 0x00007fa1846854a8 in _int_free_create_chunk (av=av@entry=0x7fa1847f6ac0 <main_arena>, p=p@entry=0x561035560450, size=size@entry=9808, nextchunk=<optimized out>, nextsize=7952) at malloc.c:4375 nextinuse = <optimized out> bck = <optimized out> fwd = <optimized out> #2 0x00007fa184686636 in _int_free_merge_chunk (av=0x7fa1847f6ac0 <main_arena>, p=0x561035560450, size=9808) at malloc.c:4354 nextchunk = <optimized out> nextsize = <optimized out> #3 0x00007fa184686794 in _int_free_chunk (av=0x7fa1847f6ac0 <main_arena>, p=<optimized out>, size=<optimized out>, have_lock=<optimized out>, have_lock@entry=0) at malloc.c:4278 err = 0 #4 0x00007fa184689356 in __GI___libc_free (mem=<optimized out>) at malloc.c:3353 p = <optimized out> size = <optimized out> #5 0x00007fa11c1d0288 in dri_destroy (gbm=0x561035435f20) at ../src/gbm/backends/dri/gbm_dri.c:1183 dri = 0x561035435f20 i = <optimized out> #6 0x00007fa17ff0c714 in _gbm_device_destroy (gbm=<optimized out>) at ../src/gbm/main/backend.c:171 backend_desc = 0x5610353eba90 #7 0x00007fa184bc284c in WebCore::GBMDevice::~GBMDevice (this=0x7fa16f000b90) at /usr/src/debug/webkitgtk-2.52.3-1.fc45.x86_64/Source/WebCore/platform/graphics/gbm/GBMDevice.cpp:63 #8 WTF::ThreadSafeRefCounted<WebCore::GBMDevice, (WTF::DestructionThread)1>::deref() const::{lambda()#1}::operator()() const (this=<optimized out>) at WTF/Headers/wtf/ThreadSafeRefCounted.h:102 #9 WTF::Detail::CallableWrapper<WTF::ThreadSafeRefCounted<WebCore::GBMDevice, (WTF::DestructionThread)1>::deref() const::{lambda()#1}, void>::call() (this=<optimized out>) at WTF/Headers/wtf/Function.h:59 #10 0x00007fa187685448 in WTF::ThreadSafeRefCounted<WebCore::GBMDevice, (WTF::DestructionThread)1>::deref (this=0x7fa16f000b90) at WTF/Headers/wtf/ThreadSafeRefCounted.h:101 #11 WTF::DefaultRefDerefTraits<WebCore::GBMDevice>::derefIfNotNull (ptr=0x7fa16f000b90) at WTF/Headers/wtf/Ref.h:64 #12 WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> >::~RefPtr (this=0x7fa16f01c328) at WTF/Headers/wtf/RefPtr.h:66 #13 std::_Optional_payload_base<WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> > >::_M_destroy (this=0x7fa16f01c328) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/optional:323 #14 std::_Optional_payload_base<WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> > >::_M_reset (this=0x7fa16f01c328) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/optional:354 #15 std::_Optional_payload<WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> >, false, false, false>::~_Optional_payload (this=0x7fa16f01c328) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/optional:477 #16 std::_Optional_base<WTF::RefPtr<WebCore::GBMDevice, WTF::RawPtrTraits<WebCore::GBMDevice>, WTF::DefaultRefDerefTraits<WebCore::GBMDevice> >, false, false>::~_Optional_base (this=0x7fa16f01c328) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/optional:501 #17 WebCore::DRMDeviceManager::{unnamed type#1}::~DRMDeviceManager() (this=0x7fa16f01c300) at /usr/src/debug/webkitgtk-2.52.3-1.fc45.x86_64/Source/WebCore/platform/graphics/gbm/DRMDeviceManager.h:55 #18 0x00007fa18768532e in WebCore::DRMDeviceManager::~DRMDeviceManager (this=0x7fa16f01c300) at /usr/src/debug/webkitgtk-2.52.3-1.fc45.x86_64/Source/WebCore/platform/graphics/gbm/DRMDeviceManager.cpp:44 #19 std::default_delete<WebCore::DRMDeviceManager>::operator() (this=0x7fa189da3768 <_ZZN7WebCore16DRMDeviceManager9singletonEvE9s_manager.llvm.12492648584019885231>, __ptr=0x7fa16f01c300) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/bits/unique_ptr.h:92 #20 std::unique_ptr<WebCore::DRMDeviceManager, std::default_delete<WebCore::DRMDeviceManager> >::~unique_ptr (this=0x7fa189da3768 <_ZZN7WebCore16DRMDeviceManager9singletonEvE9s_manager.llvm.12492648584019885231>) at /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../include/c++/16/bits/unique_ptr.h:398 __ptr = @0x7fa189da3768: 0x7fa16f01c300 #21 0x00007fa184621d81 in __run_exit_handlers (status=0, listp=0x7fa1847f6680 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:118 atfct = <optimized out> onfct = <optimized out> cxafct = <optimized out> arg = <optimized out> f = <optimized out> new_exitfn_called = 2804 cur = 0x7fa1847f7fa0 <initial> #22 0x00007fa184621e5e in __GI_exit (status=<optimized out>) at exit.c:148 #23 0x00007fa184608688 in __libc_start_call_main (main=main@entry=0x5610307134a0 <main(int, char**)>, argc=argc@entry=3, argv=argv@entry=0x7ffcc92bfaa8) at ../sysdeps/nptl/libc_start_call_main.h:83 result = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -4672943008369691645, 140723683588776, 3, 140331781521440, 94627532201312, -4672943008323554301, -4639616356607544317}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x7ffcc92bfaa8}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> #24 0x00007fa184608798 in __libc_start_main_impl (main=0x5610307134a0 <main(int, char**)>, argc=3, argv=0x7ffcc92bfaa8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffcc92bfa98) at ../csu/libc-start.c:360 #25 0x00005610307133d5 in _start ()