Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug]: WebKit (WPE) web process aborts at exit in PlatformDisplay::sharedDisplay() since 1.64 (webkit-2370)

Abierto
  • ¿Algo no está bien?
#43,394 2 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@yury-s ya está trabajando en esto.

Desde el 14/10/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

browser-webkit v1.65
Version

1.64.1 (webkit-2370). Also 1.65.0-alpha-2026-10-14 (webkit-2375).

Steps to reproduce

The host must store core dumps, for example with systemd-coredump. The machine has no GPU. WebKit renders with Mesa llvmpipe.

  1. Make a folder foo with these three files.

    playwright.config.ts:

    import { defineConfig } from '@playwright/test';

export default defineConfig({
  testDir: '.',
  workers: 16,
  timeout: 120_000,
  use: { browserName: 'webkit' },
  webServer: { command: 'node server.js', url: 'http://127.0.0.1:8080/' },
});

    bar.spec.ts:

    import { test, expect } from '@playwright/test';

// One browser, many contexts: each closed context ends its web process while the browser stays up.
test('opens and closes 50 contexts', async ({ browser }) => {
  for (let i = 0; i < 50; i++) {
    const context = await browser.newContext();
    const page = await context.newPage();
    await page.goto(`http://127.0.0.1:8080/foo/${i}`);
    await expect(page.locator('h1')).toContainText('bar');
    await context.close();
  }
});

    server.js:

    // Serves the same page for every path: a large DOM and a large JavaScript heap, so that tearing the page down takes a while.
require('http').createServer((req, res) => {
  res.setHeader('content-type', 'text/html');
  res.end(`<!doctype html><title>foo</title><h1>bar ${req.url}</h1><div id="foo"></div>
<script>
  const foo = document.getElementById('foo');
  for (let i = 0; i < 50000; i++) foo.appendChild(document.createElement('span')).textContent = i + ' ';
  window.bar = Array.from({ length: 1000000 }, (_, i) => ({ i, s: 'x' + i }));
</script>`);
}).listen(8080);

  2. Run it in the official image. This closes 800 contexts:

    cd foo
docker run --rm --ipc=host --init --user 1000:1000 -e HOME=/tmp \
  -e WEBKIT_SKIA_ENABLE_CPU_RENDERING=1 \
  -v "$PWD:/foo:ro" mcr.microsoft.com/playwright:v1.64.1-noble \
  bash -c 'cp -r /foo /tmp/w && cd /tmp/w && npm i --silent @playwright/[email protected] && npx playwright test --repeat-each=16 --reporter=dot'

  3. Count the cores: coredumpctl list | grep WPEWebProcess.

WEBKIT_SKIA_ENABLE_CPU_RENDERING=1 makes this small repro hit the crash. Without it, the repro gives no cores on our machine.

Expected behavior

All tests pass, and every web process exits cleanly.

Actual behavior

All tests pass, but web processes abort after their page closes:

Running 16 tests using 16 workers
················
  16 passed (1.6m)

$ coredumpctl list | grep WPEWebProcess | wc -l
32
$ coredumpctl list | grep WPEWebProcess | head -3 | cut -d' ' -f5-
212999 1000 1000 SIGABRT present  /ms-playwright/webkit-2370/minibrowser-wpe/bin/WPEWebProcess 19.4M
214541 1000 1000 SIGABRT present  /ms-playwright/webkit-2370/minibrowser-wpe/bin/WPEWebProcess 20.4M
215532 1000 1000 SIGABRT present  /ms-playwright/webkit-2370/minibrowser-wpe/bin/WPEWebProcess 19.4M

A second run of the same command gave 22 cores, all SIGABRT.

gdb on one core (webkit-2370). The offsets are from the load base of libWPEWebKit-2.0.so.1, which has no debug symbols:

Program terminated with signal SIGABRT, Aborted.
#4  __GI_abort () at ./stdlib/abort.c:79
#5  libWPEWebKit-2.0.so.1 +0x8255e7    WTFCrashWithInfo
#6  libWPEWebKit-2.0.so.1 +0x2f54e36   WebCore::PlatformDisplay::sharedDisplay()
#7  libWPEWebKit-2.0.so.1 +0x2f62ea2   (see below)
#8  libWPEWebKit-2.0.so.1 +0x25be7db   RunLoop timer dispatch
#9  libWPEWebKit-2.0.so.1 +0x25bcc56
#10 libglib-2.0.so.0
#11 g_main_context_dispatch ()
#12 libWPEWebKit-2.0.so.1 +0x25bd2c1   run loop iteration
#13 libWPEWebKit-2.0.so.1 +0x25bd5d7
#14 WebKit::WebProcessMain(int, char**) ()

Frame 6 passes these arguments to WTFCrashWithInfo:

line 0x44 (68)
"/home/pwuser/webkit/Source/WebCore/platform/graphics/PlatformDisplay.cpp"
"static PlatformDisplay &WebCore::PlatformDisplay::sharedDisplay()"

This is RELEASE_ASSERT(s_sharedDisplay) in PlatformDisplay::sharedDisplay(). A core from webkit-2375 shows the same arguments.

Frame 7 looks like BitmapTexturePool::releaseUnusedTexturesTimerFired(). We matched it by its machine code, because the library has no symbols. It takes the lock, checks m_textures and m_imageTextures, calls GLContextWrapper::currentContext(), and then calls PlatformDisplay::sharedDisplay().sharingGLContext().

Additional context

We think the fix for WebKit bug 305909 (e0b1fdd) causes this. Playwright 1.64 shipped that fix for #42940. The fix makes WebProcess::stopRunLoop() call PlatformDisplay::destroySharedDisplay(). BitmapTexturePool keeps a RunLoop::Timer on the main run loop with priority RunLoopSourcePriority::ReleaseUnusedResourcesTimer. The RunLoop::dispatch() source, which delivers didClose, has priority RunLoopSourcePriority::RunLoopDispatcher. In wtf/glib/RunLoopSourcePriority.h, both values are 0 on WPE (on GTK they are 200 and 100). When both sources are ready in one main loop iteration, stopRunLoop() runs first and destroys the display. Then the pool timer runs and calls sharedDisplay(), which aborts. A slow page teardown makes this more likely. That is why the repro uses a large page.

Possible fixes: use sharedDisplayIfExists() in releaseUnusedTexturesTimerFired(), or stop the pool timer in destroySharedDisplay().

Repro results, 800 context closes per run:

Playwright WebKit Skia WebKit cores
1.63.0 2359 GPU (default) 0
1.63.0 2359 CPU 0
1.64.1 2370 GPU (default) 0
1.64.1 2370 CPU 31, 25, 32, 22 SIGABRT (four runs)
1.65.0-alpha-2026-10-14 2375 CPU 37 SIGABRT

We also see this abort, with the same frames, in a larger private test suite on 1.64.1. The tests still pass, but each crash writes a core dump.

Environment
OS: Linux x86_64, Docker
Image: mcr.microsoft.com/playwright:v1.64.1-noble (Ubuntu 24.04.5)
Node: 24.21.0
@playwright/test: 1.64.1
WebKit: webkit-2370 (minibrowser-wpe), headless
Graphics: no GPU, Mesa 25.2.8 llvmpipe
Lenguaje dominante
TypeScript
Estrellas
97.4k
Forks
6.6k
Merge medio
18 h 53 min
PR fusionados (30 d)
307

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de microsoft/playwright

Todos los issues de microsoft/playwright

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.