Your message dated Fri, 02 Oct 2026 23:37:30 +0000
with message-id <[email protected]>
and subject line Bug#1149690: fixed in webkit2gtk 2.54.1-1
has caused the Debian Bug report #1149690,
regarding libwebkit2gtk-4.1-0: evolution does not start
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149690: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149690
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libwebkit2gtk-4.1-0
Version: 2.52.6-1~deb13u1
Severity: normal
Tags: upstream patch
Dear Maintainer,
Disclaimer: this bug report has been wroten with the help of a locally-run LLM.
After a reinstallation of my Debian system yesterday 2026-10-01 I found out
evolution does not start anymore.
It was working 2 or 3 days ago. Nothing changed, same system: Debian Trixie on
ZFS root filesystem, has been reinstalled in the same way (fixing a few
partition sizes discrepancies). evolution could not start after reinstall.
Local LLM helped to troubleshoot and identified libwebkit2gtk-4.1-0 update
release on 2026-10-01? After rollback to previous version, evolution could
start again.
I am available for further information. Sorry for bad English and LLM use.
Summary
-------
Any WebKitGTK application aborts with SIGABRT at web process launch when the
environment variable PULSE_SERVER is set to a "unix:" path. The abort happens
before the web process is spawned, so the application dies immediately at
startup. Not reproducible with 2.52.6-1~deb13u1, which is the previous
version in trixie-security.
How to reproduce
----------------
Any WebKitGTK app that creates a WebView, e.g. Evolution:
PULSE_SERVER=unix:/run/user/1000/pulse/native evolution; echo $?
-> Abandon (SIGABRT), exit status 134
Without PULSE_SERVER in the environment the same app starts normally.
Minimal reproducer with python3-gi:
import gi; gi.require_version('Gtk','3.0');
gi.require_version('WebKit2','4.1')
from gi.repository import Gtk, WebKit2
v = WebKit2.WebView(); v.load_html("<html><body>x</body></html>", None)
run with a WebKit 2.54 library (LD_LIBRARY_PATH) and PULSE_SERVER=unix:...
Root cause
----------
Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp, bindPulse():
const char* pulseServer = g_getenv("PULSE_SERVER");
if (pulseServer) {
auto pulseServerString = CStringView::unsafeFromUTF8(pulseServer);
if (startsWith(pulseServerString.span(), "unix:"_s))
bindIfExists(args,
CStringView::fromUTF8(pulseServerString.span().subspan(5)),
BindFlags::ReadWrite);
// else it uses tcp
}
CStringView::span() returns the span *without* the trailing NUL, so
span().subspan(5) — the path after "unix:" — is not NUL terminated.
CStringView::fromUTF8(std::span) contains
RELEASE_ASSERT(spanWithNullTerminator[spanWithNullTerminator.size() - 1] ==
'\0');
(Source/WTF/wtf/text/CStringView.h, line 60), so the assertion fails and the
process calls abort(). This is reached while assembling the bubblewrap
sandbox arguments for the web process, which is why the crash happens on the
first WebView that needs a web process.
Backtrace (strace -k, Evolution 3.56.2, webkit2gtk 2.54.0-1~deb13u1):
tgkill(pid, pid, SIGABRT)
> libc.so.6(abort+0x22)
> libwebkit2gtk-4.1.so.0.24.3() [0x7323fb] <- WTF crash helper
> libwebkit2gtk-4.1.so.0.24.3() [0xa1e516] <- CStringView::fromUTF8
(WTFCrashWithInfo line=60, file=.../wtf/text/CStringView.h)
...
> libwebkit2gtk-4.1.so.0.24.3(webkit_web_view_run_javascript+0x2e)
> libevolution-util.so.0.0.0(e_web_view_jsc_run_script+0xe0)
> libevolution-util.so.0.0.0(e_web_view_update_fonts_settings+0x53e)
Upstream status
---------------
Current upstream master no longer contains the CStringView span arithmetic,
it uses plain C pointer arithmetic which keeps the terminator:
if (g_str_has_prefix(pulseServer, "unix:"))
bindIfExists(args, pulseServer + 5, BindFlags::ReadWrite);
(Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp, current tree.)
So the bug is specific to the 2.54.0 release and already fixed upstream;
please consider backporting that change (or importing 2.54.1) for trixie.
Workaround
----------
Do not export PULSE_SERVER with a "unix:" value to WebKit applications (or
keep webkit2gtk at 2.52.6-1~deb13u1, which is what users hit by this bug
will end up doing). A TCP-form PULSE_SERVER value does not trigger it.
(END)
* What led up to the situation?
* What exactly did you do (or not do) that was effective (or
ineffective)?
* What was the outcome of this action?
* What outcome did you expect instead?
*** End of the template - remove these template lines ***
-- System Information:
Debian Release: 13.7
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.111+deb13-amd64 (SMP w/32 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libwebkit2gtk-4.1-0 depends on:
ii bubblewrap 0.12.0-1~deb13u1
ii gstreamer1.0-plugins-base 1.26.2-1+deb13u2
ii gstreamer1.0-plugins-good 1.26.2-1+deb13u2
ii libatk1.0-0t64 2.56.2-1+deb13u2
ii libatomic1 14.2.0-19
ii libavif16 1.2.1-1.2
ii libc6 2.41-12+deb13u4
ii libcairo-gobject2 1.18.4-1+b1
ii libcairo2 1.18.4-1+b1
ii libdrm2 2.4.124-2
ii libenchant-2-2 2.8.2+dfsg1-3
ii libepoxy0 1.5.10-2
ii libexpat1 2.8.3-1~deb13u1
ii libflite1 2.2-7
ii libfontconfig1 2.15.0-2.3
ii libfreetype6 2.13.3+dfsg-1+deb13u1
ii libgbm1 25.0.7-2+deb13u1
ii libgcc-s1 14.2.0-19
ii libgcrypt20 1.11.0-7+deb13u1
ii libgdk-pixbuf-2.0-0 2.42.12+dfsg-4+deb13u1
ii libgles2 1.7.0-1+b2
ii libglib2.0-0t64 2.84.4-3~deb13u5
ii libgpg-error0 1.51-4
ii libgstreamer-gl1.0-0 1.26.2-1+deb13u2
ii libgstreamer-plugins-base1.0-0 1.26.2-1+deb13u2
ii libgstreamer1.0-0 1.26.2-2
ii libgtk-3-0t64 3.24.49-3
ii libharfbuzz-icu0 10.2.0-1+deb13u1
ii libharfbuzz0b 10.2.0-1+deb13u1
ii libhyphen0 2.8.8-7+b2
ii libicu76 76.1-4
hi libjavascriptcoregtk-4.1-0 2.52.6-1~deb13u1
ii libjpeg62-turbo 1:2.1.5-4
ii libjxl0.11 0.11.2-0.1~deb13u2
ii liblcms2-2 2.16-2+deb13u2
ii libmanette-0.2-0 0.2.12-1
ii libpango-1.0-0 1.56.3-1
ii libpangocairo-1.0-0 1.56.3-1
ii libpng16-16t64 1.6.48-1+deb13u5
ii libseccomp2 2.6.0-2
ii libsecret-1-0 0.21.7-1
ii libsoup-3.0-0 3.6.5-3
ii libsqlite3-0 3.46.1-7+deb13u2
ii libstdc++6 14.2.0-19
ii libsystemd0 257.13-1~deb13u1
ii libtasn1-6 4.20.0-2+deb13u1
ii libwayland-client0 1.23.1-3
ii libwayland-egl1 1.23.1-3
ii libwayland-server0 1.23.1-3
ii libwebp7 1.5.0-0.1
ii libwebpdemux2 1.5.0-0.1
ii libwebpmux3 1.5.0-0.1
ii libx11-6 2:1.8.12-1
ii libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3
ii libxslt1.1 1.1.35-1.2+deb13u3
ii xdg-dbus-proxy 0.1.6-1+deb13u3
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
Versions of packages libwebkit2gtk-4.1-0 recommends:
ii gstreamer1.0-gl 1.26.2-1+deb13u2
ii gstreamer1.0-libav 1.26.2-1+deb13u1
ii gstreamer1.0-plugins-bad 1.26.2-3+deb13u3
ii libgl1-mesa-dri 25.0.7-2+deb13u1
ii xdg-desktop-portal-gtk 1.15.3-1
Versions of packages libwebkit2gtk-4.1-0 suggests:
ii gstreamer1.0-alsa 1.26.2-1+deb13u2
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: webkit2gtk
Source-Version: 2.54.1-1
Done: Alberto Garcia <[email protected]>
We believe that the bug you reported is fixed in the latest version of
webkit2gtk, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Alberto Garcia <[email protected]> (supplier of updated webkit2gtk package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 02 Oct 2026 23:21:14 +0200
Source: webkit2gtk
Architecture: source
Version: 2.54.1-1
Distribution: unstable
Urgency: high
Maintainer: Debian WebKit Maintainers
<[email protected]>
Changed-By: Alberto Garcia <[email protected]>
Closes: 1149690 1149700
Changes:
webkit2gtk (2.54.1-1) unstable; urgency=high
.
* New upstream release (Closes: #1149700).
* Refresh all patches.
- Try to fix the build on hurd and sh4.
* debian/patches/fix-web-process-abort.patch:
- Fix crash when starting the web process (Closes: #1149690).
Checksums-Sha1:
02187dcf51340f11e6260f7b4cad23492872bc1b 4745 webkit2gtk_2.54.1-1.dsc
502f1dad3a0cc7d4357eb537663987e7d39a5599 49729412 webkit2gtk_2.54.1.orig.tar.xz
81249c58059573fee2ad35c6291e55005c0dfa04 833 webkit2gtk_2.54.1.orig.tar.xz.asc
73ed51e678775b57cac655387e2d75c5dcd25c24 95196
webkit2gtk_2.54.1-1.debian.tar.xz
2380dc0c574b7d8401a62a5845ba01c1b23c176e 16650
webkit2gtk_2.54.1-1_source.buildinfo
Checksums-Sha256:
3664a859438e212430bf32a7a8106d8c063941b58560100a298d6e0502d5bfbe 4745
webkit2gtk_2.54.1-1.dsc
ea0bbb02dbdbc596874a4e7ad35b66645b3e0a232bd0e4081de5ed92eb0a397d 49729412
webkit2gtk_2.54.1.orig.tar.xz
4638f86bd4c79bad570f75a6ebea3c1b3f37dd292360e0ea2211c0b76c826287 833
webkit2gtk_2.54.1.orig.tar.xz.asc
485a5ce81eb9a6ecb7d89b36a98d1e78676c1bcd50a6e0a20b6e11a6b3d8d119 95196
webkit2gtk_2.54.1-1.debian.tar.xz
21eeced5a92c6f886a2c5e2a76fd7faeb92fd710dc6e8771b8fb304bba051f9b 16650
webkit2gtk_2.54.1-1_source.buildinfo
Files:
21075cd000d3315a935dfd21acabe9a8 4745 web optional webkit2gtk_2.54.1-1.dsc
78025e9335d5dbc6f47c352c4e5e6311 49729412 web optional
webkit2gtk_2.54.1.orig.tar.xz
27d0606a78c50aefcb3694604c175d78 833 web optional
webkit2gtk_2.54.1.orig.tar.xz.asc
264ebfca9f2e2774645d2db27187246b 95196 web optional
webkit2gtk_2.54.1-1.debian.tar.xz
a2088e67adcd5928350a215e8dd71b39 16650 web optional
webkit2gtk_2.54.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAmrAKDkACgkQAAyEYu0C
2AKhaA//TDdUjitRWENqZfDlphk4eNkWxcs3Cwp2CMeG5NR2qqiJHvRraXoYzNvO
oukTon21tZ2uxWGprlrgUBVDGrmYvYoCqySF9Cv6J4ai9X5VT7ixLwLkdWSCrHxv
dgGDUz0GLFDbEphtyVCrZtQM/oe5emS95RuBGJVYW+F3JLUj/mS24q2w3BEtXA+D
aDf4vUZ20qBArqqAzscv8ZcKOaLlKQWHjvkc4YLrqZOJs5j0Kuqe0Z9VUV7VjGLC
GyJeLNwU4jpkgUvcg33oV01ea8ogvVdw/fHP48fGN5cUQ0XDm3Zg+k9T4Nx7m8XW
nBFqIZpCosULN6QO5XSOY7CloLABrYav/ydQdL2HCSCVj2PyfYrhDD4gGd1HMh07
3tQ5KkGIw2MiGHIGRXlptQlWDw62/3aGGfZym/mJR81H+rFdnmsuy+TRaDvbH9UI
gyvXZWb46FlTbUtLcKRRJVxqnUGdyVzOGhseIBeakbOFQYC/Ri+F/qG/PVqVJ48g
yTPQnmeqlJJ40IJ9g5KroOfCiJy77W+lAOWyX7PKRAqvWojBGpayCJ6RGlDS3A70
LTLqtjjjsH6xyiD8+J5MdogbCJ4yB6jiD1dD+ba2uh7yBBf9dwIP89IV97YcozMP
of/gS/rT8tlpXSylAPEwg+pkkW7tjI6nW5955bm5pUK3Q7mbZHY=
=6wS7
-----END PGP SIGNATURE-----
pgpeREODaPqAG.pgp
Description: PGP signature
--- End Message ---
