Skip to content

WEBKIT_DISABLE_DMABUF_RENDERER crashes WebKitGTK on NVIDIA instead of falling back to shared memory #3654

Description

@kwsantiago

webkit_rendering.rs sets WEBKIT_DISABLE_DMABUF_RENDERER=1 on NVIDIA GPUs and on AppImage packaging to avoid the #2338 startup abort, with the stated intent of falling back to the shared-memory buffer path.

On current WebKitGTK that variable no longer falls back. It returns before mode.add(RendererBufferTransportMode::SharedMemory), so the transport mode is left empty, AcceleratedBackingStore::create() returns nullptr, and webkitWebViewBaseEnterAcceleratedCompositingMode() dereferences it, guarded only by an ASSERT, which is compiled out in release builds. The app SIGSEGVs the first time content needs a compositing layer. Switching workspaces does it every time.

#0 AcceleratedBackingStore::update()   AcceleratedBackingStore.cpp:808
#1 WebPageProxy::enterAcceleratedCompositingMode()
#2 DrawingAreaProxyCoordinatedGraphics::enterAcceleratedCompositingMode()
   <- IPC Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode

Measured in the failing process: transport mode 0x00000000, create() returned 0x0, and priv->acceleratedBackingStore is NULL in the core dump. The webview is never disposed (breakpoint on webkitWebViewBaseDispose never fires), so the pointer is null from creation rather than from teardown.

WEBKIT_DMABUF_RENDERER_FORCE_SHM=1 returns after SharedMemory is added. That is the documented intent, no hardware dmabuf path, and it leaves the backing store valid.

Verification

Ubuntu 24.04, WebKitGTK 2.52.3, GeForce RTX 3050 Ti (driver 580.173.02), X11.

build module log line workspace switch
0.4.24 AppImage (ships DISABLE_DMABUF) WEBKIT_DISABLE_DMABUF_RENDERER=1 — NVIDIA GPU, AppImage SIGSEGV
main with HEURISTIC = [FORCE_SHM] WEBKIT_DMABUF_RENDERER_FORCE_SHM=1 — NVIDIA GPU works

Same result running the AppImage with the two variables set by hand, so the variable is the only difference and not the build.

Both runs pin EGL to Mesa (__EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json). Debian and Ubuntu ship disable-nvidia-dmabuf.patch in webkit2gtk, which empties the same transport mode on NVIDIA regardless of this variable; without the pin that patch masks the difference. It also means this change alone will not fix Debian/Ubuntu users. I am reporting that to Debian separately.

Not verified

Whether FORCE_SHM still avoids the #2338 abort. I do not have hardware that reproduces #2338, and that is the reason the setting exists, so it is worth confirming before changing it.

If the swap looks right I am happy to send the PR. The module's unit tests pin the current variable, so they would need updating too, and OWNED would need a decision: adding FORCE_SHM keeps the "everything this module may set" invariant, but changes which user assignments make it stand down.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions