Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e0b1fddaa46813e6b7165037198bb7c34768c1f6
https://github.com/WebKit/WebKit/commit/e0b1fddaa46813e6b7165037198bb7c34768c1f6
Author: Nikolas Zimmermann <[email protected]>
Date: 2026-09-24 (Thu, 24 Sep 2026)
Changed paths:
M Source/WebCore/platform/graphics/PlatformDisplay.cpp
M Source/WebCore/platform/graphics/PlatformDisplay.h
M Source/WebCore/platform/graphics/egl/GLContext.cpp
M Source/WebCore/platform/graphics/egl/GLDisplay.cpp
M Source/WebCore/platform/graphics/egl/GLDisplay.h
M Source/WebCore/platform/graphics/skia/PlatformDisplaySkia.cpp
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h
M Source/WebKit/GPUProcess/GPUProcess.h
M Source/WebKit/GPUProcess/glib/GPUProcessGLib.cpp
M Source/WebKit/Shared/AuxiliaryProcess.cpp
M Source/WebKit/WebProcess/WebProcess.cpp
M Source/WebKit/WebProcess/WebProcess.h
M Source/WebKit/WebProcess/glib/WebProcessGLib.cpp
Log Message:
-----------
[GTK][WPE] Crash on exit in PlatformDisplay::terminateEGLDisplay
https://bugs.webkit.org/show_bug.cgi?id=305909
rdar://problem/168564545
Reviewed by Carlos Garcia Campos.
The EGL display was terminated in an atexit handler while other threads could
still use it. In the GPU process, the WebGL thread could still be using the
sharing context when the handler destroyed it. In the web process, a thread
that exits destroys its Skia context at the same time, and because Mesa frees
the display in its own atexit handler, that thread writes into freed memory
and corrupts the heap, which is bug 315577.
Destroy the display on the main thread before exiting instead, after the GPU
process has closed its web process connections and stopped the WebGL thread,
and after the web process has closed its pages. The display is terminated
before it is deleted, so that the native display of a subclass, like the
libwpe backend, is still alive when EGL terminates. A thread that destroys its
context while the display is terminated now waits for it, and does nothing
once the display is gone.
* Source/WebCore/platform/graphics/PlatformDisplay.cpp:
(WebCore::PlatformDisplay::setSharedDisplay):
(WebCore::PlatformDisplay::sharedDisplayIfExists):
(WebCore::PlatformDisplay::destroySharedDisplay):
(WebCore::PlatformDisplay::PlatformDisplay):
(WebCore::PlatformDisplay::terminateEGLDisplay):
(WebCore::PlatformDisplay::~PlatformDisplay): Deleted.
* Source/WebCore/platform/graphics/PlatformDisplay.h:
* Source/WebCore/platform/graphics/egl/GLContext.cpp:
(WebCore::GLContext::~GLContext):
* Source/WebCore/platform/graphics/egl/GLDisplay.cpp:
(WebCore::GLDisplay::terminate):
(WebCore::GLDisplay::runIfNotTerminated):
* Source/WebCore/platform/graphics/egl/GLDisplay.h:
* Source/WebCore/platform/graphics/skia/PlatformDisplaySkia.cpp:
(WebCore::SkiaGLContext::~SkiaGLContext):
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:
(WebKit::GPUConnectionToWebProcess::close):
* Source/WebKit/GPUProcess/GPUProcess.h:
* Source/WebKit/GPUProcess/glib/GPUProcessGLib.cpp:
(WebKit::GPUProcess::stopRunLoop):
* Source/WebKit/Shared/AuxiliaryProcess.cpp:
(WebKit::AuxiliaryProcess::didClose):
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::initializeConnection):
* Source/WebKit/WebProcess/WebProcess.h:
* Source/WebKit/WebProcess/glib/WebProcessGLib.cpp:
(WebKit::WebProcess::stopRunLoop):
Canonical link: https://commits.webkit.org/321775@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
