webkitgtk: Segfault when visiting specific page (possibly related to GStreamer)

[ghost]

Describe the bug

Visiting a specific homepage that contains audio (and most likely subtitles for said audio) causes WebKitGTK to segfault. To replicate, simply run:

  > nix-shell -p surf --run 'surf https://sive.rs/itunes'
  web process terminated: crashed
  /tmp/nix-shell-136635-0/rc: line 1: 136667 Segmentation fault      (core dumped) surf https://sive.rs/itunes

Additional context

Confirmed working on Void Linux and causing a crash on Arch Linux. The latter will work if you install gst-plugins-bad, but I have tried the same on NixOS with no effect.

Mar 10 03:04:48 localhost kernel: .surf-wrapped[137046]: segfault at 570 ip 00007f55666bae94 sp 00007ffcc088f768 error 4 in libwebkit2gtk-4.0.so.37.55.9[7f5565b28000>
Mar 10 03:04:48 localhost kernel: Code: 84 00 00 00 00 00 48 8d 15 28 e0 31 02 48 8d 35 62 07 3b 02 31 ff e8 8b e8 a9 ff 31 c0 5b c3 0f 1f 80 00 00 00 00 48 8b 47 30>
Mar 10 03:04:48 localhost systemd[1]: Started Process Core Dump (PID 137103/UID 0).
Mar 10 03:04:49 localhost systemd-coredump[137104]: [🡕] Process 137046 (.surf-wrapped) of user 4711 dumped core.

                                                 Found module linux-vdso.so.1 with build-id: 7f01a6eab4fe6ecc4ee62951c654a887e9c93c60
                                                 Found module libgmp.so.10 without build-id.
                                                 Found module libhogweed.so.6 without build-id.
                                                 Found module libnettle.so.8 without build-id.
                                                 Found module libgnutls.so.30 without build-id.
                                                 Found module libgiognutls.so without build-id.
                                                 Found module enchant_hspell.so without build-id.
                                                 Found module libncursesw.so.6 without build-id.
                                                 Found module libhunspell-1.7.so.0 without build-id.
                                                 Found module enchant_hunspell.so without build-id.
                                                 Found module enchant_aspell.so without build-id.
                                                 Found module libudev.so.1 without build-id.
                                                 Found module libuuid.so.1 without build-id.
                                                 Found module libelf.so.1 with build-id: 0f60a8e8a31901ebf2128bb5e6bfd70402ddd9cd
                                                 Found module libblkid.so.1 without build-id.
                                                 Found module libbrotlicommon.so.1 without build-id.
                                                 Found module libidn2.so.0 without build-id.
                                                 Found module libunistring.so.2 without build-id.
                                                 Found module libGLX.so.0 without build-id.
                                                 Found module libdatrie.so.1 without build-id.
                                                 Found module libjson-glib-1.0.so.0 without build-id.
                                                 Found module libatspi.so.0 without build-id.
                                                 Found module libdbus-1.so.3 without build-id.
                                                 Found module libcap.so.2 without build-id.
                                                 Found module liblz4.so.1 without build-id.
                                                 Found module libzstd.so.1 without build-id.
                                                 Found module liblzma.so.5 without build-id.
                                                 Found module libgudev-1.0.so.0 without build-id.
                                                 Found module libevdev.so.2 without build-id.
                                                 Found module libICE.so.6 without build-id.
                                                 Found module libSM.so.6 without build-id.
                                                 Found module libaspell.so.15 without build-id.
                                                 Found module libX11-xcb.so.1 without build-id.
                                                 Found module liborc-0.4.so.0 without build-id.
                                                 Found module libdw.so.1 with build-id: d3b425f1e6ed43ecf5df7a5cf68acbdf645d8361
                                                 Found module libunwind.so.8 without build-id.
                                                 Found module libexpat.so.1 without build-id.
                                                 Found module libbz2.so.1 without build-id.
                                                 Found module libwoff2common.so.1.0.2 without build-id.
                                                 Found module libGLdispatch.so.0 without build-id.
                                                 Found module libXdmcp.so.6 without build-id.
                                                 Found module libXau.so.6 without build-id.
                                                 Found module libpcre.so.1 without build-id.
                                                 Found module libresolv.so.2 with build-id: 2290f42d057945d23e19da1c2a4038ad3a2bb317
                                                 Found module libselinux.so.1 without build-id.
                                                 Found module libmount.so.1 without build-id.
                                                 Found module libbrotlidec.so.1 without build-id.
                                                 Found module libpsl.so.5 without build-id.
                                                 Found module libGL.so.1 without build-id.
                                                 Found module libxcb-render.so.0 without build-id.
                                                 Found module libxcb-shm.so.0 without build-id.
                                                 Found module libpixman-1.so.0 with build-id: c99e1cd46146e3bc35180769096427021d346f2a
                                                 Found module libgraphite2.so.3 without build-id.
                                                 Found module libthai.so.0 without build-id.
                                                 Found module libXinerama.so.1 without build-id.
                                                 Found module libXrandr.so.2 without build-id.
                                                 Found module libXcursor.so.1 without build-id.
                                                 Found module libXext.so.6 without build-id.
                                                 Found module libwayland-cursor.so.0 with build-id: 105e6251639db3944843a1ef4d225931a4edbd33
                                                 Found module libxkbcommon.so.0 without build-id.
                                                 Found module libXfixes.so.3 without build-id.
                                                 Found module libtracker-sparql-3.0.so.0 without build-id.
                                                 Found module libatk-bridge-2.0.so.0 without build-id.
                                                 Found module libXi.so.6 without build-id.
                                                 Found module libepoxy.so.0 without build-id.
                                                 Found module libfribidi.so.0 without build-id.
                                                 Found module libpangoft2-1.0.so.0 without build-id.
                                                 Found module libgcc_s.so.1 without build-id.
                                                 Found module libm.so.6 with build-id: e689d8c44e0981a60cbeb02ce80bfc33784b5946
                                                 Found module libstdc++.so.6 without build-id.
                                                 Found module libsystemd.so.0 without build-id.
                                                 Found module libicuuc.so.70 without build-id.
                                                 Found module libicui18n.so.70 without build-id.
                                                 Found module libicudata.so.70 without build-id.
                                                 Found module libseccomp.so.2 without build-id.
                                                 Found module libmanette-0.2.so.0 without build-id.
                                                 Found module libwayland-client.so.0 with build-id: 7c0f7566b764fb5f9d7778140b6bbca46ce507e9
                                                 Found module libwayland-egl.so.1 with build-id: a231df0e1793b5ba43e3e088823ea4699b211f1e
                                                 Found module libwayland-server.so.0 with build-id: ec40e0d92f5d5a8c8ab2f23403aaa3e538d1a1b4
                                                 Found module liblcms2.so.2 without build-id.
                                                 Found module libXt.so.6 without build-id.
                                                 Found module libXrender.so.1 without build-id.
                                                 Found module libXdamage.so.1 without build-id.
                                                 Found module libXcomposite.so.1 without build-id.
                                                 Found module libtasn1.so.6 without build-id.
                                                 Found module libsecret-1.so.0 without build-id.
                                                 Found module libgmodule-2.0.so.0 with build-id: be70d1c0aa0aec2365087e1e453bfb368706a31f
                                                 Found module libenchant-2.so.2 without build-id.
                                                 Found module libwebp.so.7 without build-id.
                                                 Found module libwebpdemux.so.2 without build-id.
                                                 Found module libopenjp2.so.7 without build-id.
                                                 Found module libpng16.so.16 without build-id.
                                                 Found module libjpeg.so.62 without build-id.
                                                 Found module libgstfft-1.0.so.0 without build-id.
                                                 Found module libgstgl-1.0.so.0 without build-id.
                                                 Found module libgstvideo-1.0.so.0 without build-id.
                                                 Found module libgsttag-1.0.so.0 without build-id.
                                                 Found module libgstaudio-1.0.so.0 without build-id.
                                                 Found module libgstpbutils-1.0.so.0 without build-id.
                                                 Found module libgstreamer-1.0.so.0 without build-id.
                                                 Found module libgstbase-1.0.so.0 without build-id.
                                                 Found module libgstapp-1.0.so.0 without build-id.
                                                 Found module libgpg-error.so.0 without build-id.
                                                 Found module libharfbuzz-icu.so.0 without build-id.
                                                 Found module libfreetype.so.6 without build-id.
                                                 Found module libfontconfig.so.1 without build-id.
                                                 Found module libwoff2dec.so.1.0.2 without build-id.
                                                 Found module libGLESv2.so.2 without build-id.
                                                 Found module libxslt.so.1 without build-id.
                                                 Found module libsqlite3.so.0 with build-id: c75e8416550c1bbd1e4d5494e0020198301a613a
                                                 Found module libxml2.so.2 without build-id.
                                                 Found module libnotify.so.4 without build-id.
                                                 Found module librt.so.1 with build-id: 402b3f3e14c4cd47e64a4a1a78de577fb923bb19
                                                 Found module libEGL.so.1 without build-id.
                                                 Found module ld-linux-x86-64.so.2 with build-id: e317665cf1fcd350c5dde8680273b9ebfda79b2e
                                                 Found module libffi.so.8 without build-id.
                                                 Found module libgcrypt.so.20 without build-id.
                                                 Found module libpthread.so.0 with build-id: 8476567e4f6b5d1f48ca43f180475cb829fc5395
                                                 Found module libdl.so.2 with build-id: bca5bcd55be4b127234c03637628eb0a57008dba
                                                 Found module libxcb.so.1 without build-id.
                                                 Found module libc.so.6 with build-id: 9a0f90c4bf283b50ccc2fb52a86c4c9e9e235f7b
                                                 Found module libgthread-2.0.so.0 with build-id: 95f062e89e02028d56f3a22cb685bbe379981462
                                                 Found module libglib-2.0.so.0 with build-id: ac1302d061e73370aaf031028e11d14c2a193bbb
                                                 Found module libgobject-2.0.so.0 with build-id: 5dc61afb051a1d0ff409a2af30de521f51464dcf
                                                 Found module libjavascriptcoregtk-4.0.so.18 with build-id: 5ac5b999f4d68cc938393b658894bf546b6b2467
                                                 Found module libgio-2.0.so.0 with build-id: 3ccce5a13290641f0159072d201a7c0fdb337b0f
                                                 Found module libsoup-2.4.so.1 without build-id.
                                                 Found module libgdk_pixbuf-2.0.so.0 with build-id: 666cb6c61b9cfd9c5a4b4322c7d4a23f4a0d9437
                                                 Found module libcairo.so.2 with build-id: abf7aabe83d5b846ee9940ea5d214ec275aa71a8
                                                 Found module libcairo-gobject.so.2 with build-id: 44448161caf539e58baf941456090dd422a98b33
                                                 Found module libatk-1.0.so.0 without build-id.
                                                 Found module libharfbuzz.so.0 without build-id.
                                                 Found module libpango-1.0.so.0 without build-id.
                                                 Found module libpangocairo-1.0.so.0 without build-id.
                                                 Found module libz.so.1 without build-id.
                                                 Found module libgdk-3.so.0 with build-id: 9a54735cede5138b22b4cc2c8bb0c1fe8b538800
                                                 Found module libgtk-3.so.0 with build-id: 6fc08bda77ef086c8dabe4c8a899ca7c4adfb8c7
                                                 Found module libwebkit2gtk-4.0.so.37 with build-id: 5dd6508bb04640717f7bbd99cda2b5c80eeb318f
                                                 Found module libp11-kit.so.0 without build-id.
                                                 Found module libgck-1.so.0 without build-id.
                                                 Found module libgcr-base-3.so.1 without build-id.
                                                 Found module libgcr-ui-3.so.1 without build-id.
                                                 Found module libX11.so.6 without build-id.
                                                 Found module .surf-wrapped without build-id.
                                                 Stack trace of thread 137046:
                                                 #0  0x00007f55666bae94 _Z38webkitWebViewSetIsWebProcessResponsiveP14_WebKitWebViewb (libwebkit2gtk-4.0.so.37 + 0x>
                                                 #1  0x00007f556668f91b _ZN16NavigationClient19processDidTerminateERN6WebKit12WebPageProxyENS0_24ProcessTerminatio>
                                                 #2  0x00007f55665e6e6f _ZN6WebKit12WebPageProxy27dispatchProcessDidTerminateENS_24ProcessTerminationReasonE (libw>
                                                 #3  0x00007f556661c680 _ZN6WebKit15WebProcessProxy35processDidTerminateOrFailedToLaunchENS_24ProcessTerminationRe>
                                                 #4  0x00007f55664ddedb _ZN3WTF6Detail15CallableWrapperIZN3IPC10Connection18connectionDidCloseEvEUlvE_vJEE4callEv >
                                                 #5  0x00007f5564892bc2 _ZN3WTF7RunLoop11performWorkEv (libjavascriptcoregtk-4.0.so.18 + 0x178bbc2)
                                                 #6  0x00007f55648f5d89 _ZZN3WTF7RunLoopC4EvENUlPvE_4_FUNES1_ (libjavascriptcoregtk-4.0.so.18 + 0x17eed89)
                                                 #7  0x00007f55648f675f _ZN3WTF7RunLoopUlP8_GSourcePFiPvES3_E_4_FUNES2_S5_S3_ (libjavascriptcoregtk-4.0.so.18 + 0x>
                                                 #8  0x00007f5562fc89af g_main_context_dispatch (libglib-2.0.so.0 + 0x569af)
                                                 #9  0x00007f5562fc8d58 g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0x56d58)
                                                 #10 0x00007f5562fc904b g_main_loop_run (libglib-2.0.so.0 + 0x5704b)
                                                 #11 0x00007f5565554235 gtk_main (libgtk-3.so.0 + 0x1fb235)
                                                 #12 0x0000000000409781 main (.surf-wrapped + 0x9781)
                                                 #13 0x00007f5562dbf790 __libc_start_main (libc.so.6 + 0x27790)
                                                 #14 0x0000000000405d5a _start (.surf-wrapped + 0x5d5a)

                                                 Stack trace of thread 137048:
                                                 #0  0x00007f5562d59cf5 __futex_abstimed_wait_common64 (libpthread.so.0 + 0x14cf5)
                                                 #1  0x00007f5562d53c22 pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0 + 0xec22)
                                                 #2  0x00007f555fc4873c _ZNSt18condition_variable4waitERSt11unique_lockISt5mutexE (libstdc++.so.6 + 0xd173c)
                                                 #3  0x00007f55649069b9 _ZN7bmalloc9Scavenger13threadRunLoopEv (libjavascriptcoregtk-4.0.so.18 + 0x17ff9b9)
                                                 #4  0x00007f5564906cc9 _ZN7bmalloc9Scavenger16threadEntryPointEPS0_ (libjavascriptcoregtk-4.0.so.18 + 0x17ffcc9)
                                                 #5  0x00007f555fc4dc50 n/a (libstdc++.so.6 + 0xd6c50)
                                                 #6  0x00007f5562d4dd40 start_thread (libpthread.so.0 + 0x8d40)
                                                 #7  0x00007f5562e9403f __clone (libc.so.6 + 0xfc03f)

                                                 Stack trace of thread 137049:
                                                 #0  0x00007f5562d59cf5 __futex_abstimed_wait_common64 (libpthread.so.0 + 0x14cf5)
                                                 #1  0x00007f5562d53ed8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0 + 0xeed8)
                                                 #2  0x00007f55648f949b _ZN3WTF15ThreadCondition9timedWaitERNS_5MutexENS_8WallTimeE (libjavascriptcoregtk-4.0.so.1>
                                                 #3  0x00007f556488fc33 _ZN3WTF10ParkingLot21parkConditionallyImplEPKvRKNS_12ScopedLambdaIFbvEEERKNS3_IFvvEEERKNS_>
                                                 #4  0x00007f55648939ec _ZN3WTF5sleepENS_7SecondsE (libjavascriptcoregtk-4.0.so.18 + 0x178c9ec)
                                                 #5  0x00007f5566780e8a _ZZN6WebKit21MemoryPressureMonitor5startEvENKUlvE_clEv.constprop.0 (libwebkit2gtk-4.0.so.3>
                                                 #6  0x00007f55667815a9 _ZN3WTF6Detail15CallableWrapperIZN6WebKit21MemoryPressureMonitor5startEvEUlvE_vJEE4callEv >
                                                 #7  0x00007f55648949c3 _ZN3WTF6Thread10entryPointEPNS0_16NewThreadContextE (libjavascriptcoregtk-4.0.so.18 + 0x17>
                                                 #8  0x00007f55648f8b99 _ZN3WTFL19wtfThreadEntryPointEPv (libjavascriptcoregtk-4.0.so.18 + 0x17f1b99)
                                                 #9  0x00007f5562d4dd40 start_thread (libpthread.so.0 + 0x8d40)
                                                 #10 0x00007f5562e9403f __clone (libc.so.6 + 0xfc03f)

                                                 Stack trace of thread 137053:
                                                 #0  0x00007f5562e88c89 __poll (libc.so.6 + 0xf0c89)
                                                 #1  0x00007f5562fc8cee g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0x56cee)
                                                 #2  0x00007f5562fc8e0f g_main_context_iteration (libglib-2.0.so.0 + 0x56e0f)
                                                 #3  0x00007f5562fc8e61 glib_worker_main (libglib-2.0.so.0 + 0x56e61)
                                                 #4  0x00007f5562ff2d7d g_thread_proxy (libglib-2.0.so.0 + 0x80d7d)
                                                 #5  0x00007f5562d4dd40 start_thread (libpthread.so.0 + 0x8d40)
                                                 #6  0x00007f5562e9403f __clone (libc.so.6 + 0xfc03f)

                                                 Stack trace of thread 137062:
                                                 #0  0x00007f5562e88c89 __poll (libc.so.6 + 0xf0c89)
                                                 #1  0x00007f5562fc8cee g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0x56cee)
                                                 #2  0x00007f5562fc904b g_main_loop_run (libglib-2.0.so.0 + 0x5704b)
                                                 #3  0x00007f55648f68a8 _ZN3WTF7RunLoop3runEv (libjavascriptcoregtk-4.0.so.18 + 0x17ef8a8)
                                                 #4  0x00007f55648949c3 _ZN3WTF6Thread10entryPointEPNS0_16NewThreadContextE (libjavascriptcoregtk-4.0.so.18 + 0x17>
                                                 #5  0x00007f55648f8b99 _ZN3WTFL19wtfThreadEntryPointEPv (libjavascriptcoregtk-4.0.so.18 + 0x17f1b99)
                                                 #6  0x00007f5562d4dd40 start_thread (libpthread.so.0 + 0x8d40)
                                                 #7  0x00007f5562e9403f __clone (libc.so.6 + 0xfc03f)

                                                 Stack trace of thread 137050:
                                                 #0  0x00007f5562e88c89 __poll (libc.so.6 + 0xf0c89)
                                                 #1  0x00007f5562fc8cee g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0x56cee)
                                                 #2  0x00007f5562fc904b g_main_loop_run (libglib-2.0.so.0 + 0x5704b)
                                                 #3  0x00007f55648f68a8 _ZN3WTF7RunLoop3runEv (libjavascriptcoregtk-4.0.so.18 + 0x17ef8a8)
                                                 #4  0x00007f55648949c3 _ZN3WTF6Thread10entryPointEPNS0_16NewThreadContextE (libjavascriptcoregtk-4.0.so.18 + 0x17>
                                                 #5  0x00007f55648f8b99 _ZN3WTFL19wtfThreadEntryPointEPv (libjavascriptcoregtk-4.0.so.18 + 0x17f1b99)
                                                 #6  0x00007f5562d4dd40 start_thread (libpthread.so.0 + 0x8d40)
                                                 #7  0x00007f5562e9403f __clone (libc.so.6 + 0xfc03f)

                                                 Stack trace of thread 137055:
                                                 #0  0x00007f5562e8dac9 syscall (libc.so.6 + 0xf5ac9)
                                                 #1  0x00007f556301c472 g_cond_wait_until (libglib-2.0.so.0 + 0xaa472)
                                                 #2  0x00007f5562f97621 g_async_queue_pop_intern_unlocked (libglib-2.0.so.0 + 0x25621)
                                                 #3  0x00007f5562ff379a g_thread_pool_thread_proxy (libglib-2.0.so.0 + 0x8179a)
                                                 #4  0x00007f5562ff2d7d g_thread_proxy (libglib-2.0.so.0 + 0x80d7d)
                                                 #5  0x00007f5562d4dd40 start_thread (libpthread.so.0 + 0x8d40)
                                                 #6  0x00007f5562e9403f __clone (libc.so.6 + 0xfc03f)

                                                 Stack trace of thread 137061:
                                                 #0  0x00007f5562e88c89 __poll (libc.so.6 + 0xf0c89)
                                                 #1  0x00007f5562fc8cee g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0x56cee)
                                                 #2  0x00007f5562fc904b g_main_loop_run (libglib-2.0.so.0 + 0x5704b)
                                                 #3  0x00007f55648f68a8 _ZN3WTF7RunLoop3runEv (libjavascriptcoregtk-4.0.so.18 + 0x17ef8a8)
                                                 #4  0x00007f55648949c3 _ZN3WTF6Thread10entryPointEPNS0_16NewThreadContextE (libjavascriptcoregtk-4.0.so.18 + 0x17>
                                                 #5  0x00007f55648f8b99 _ZN3WTFL19wtfThreadEntryPointEPv (libjavascriptcoregtk-4.0.so.18 + 0x17f1b99)
                                                 #6  0x00007f5562d4dd40 start_thread (libpthread.so.0 + 0x8d40)
                                                 #7  0x00007f5562e9403f __clone (libc.so.6 + 0xfc03f)

                                                 Stack trace of thread 137051:
                                                 #0  0x00007f5562e88c89 __poll (libc.so.6 + 0xf0c89)
                                                 #1  0x00007f5562fc8cee g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0x56cee)
                                                 #2  0x00007f5562fc904b g_main_loop_run (libglib-2.0.so.0 + 0x5704b)
                                                 #3  0x00007f55648f68a8 _ZN3WTF7RunLoop3runEv (libjavascriptcoregtk-4.0.so.18 + 0x17ef8a8)
                                                 #4  0x00007f55648949c3 _ZN3WTF6Thread10entryPointEPNS0_16NewThreadContextE (libjavascriptcoregtk-4.0.so.18 + 0x17>
                                                 #5  0x00007f55648f8b99 _ZN3WTFL19wtfThreadEntryPointEPv (libjavascriptcoregtk-4.0.so.18 + 0x17f1b99)
                                                 #6  0x00007f5562d4dd40 start_thread (libpthread.so.0 + 0x8d40)
                                                 #7  0x00007f5562e9403f __clone (libc.so.6 + 0xfc03f)
Mar 10 03:04:49 localhost systemd[1]: systemd-coredump@31-137103-0.service: Deactivated successfully.

Also confirmed to segfault with the current tip of master.

Notify maintainers

@hedning, @jtojnar, @dasj19, and @maxeaubrey for WebKitGTK and @joachifm for surf (although I think surf has nothing to do with the crash from reading the code and my preliminary debugging).

Metadata

> nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 5.10.103, NixOS, 21.11 (Porcupine)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.3.16`
 - channels(root): `"nixos-21.11.336340.2ebb6c1e5ae, home-manager-21.11, nixos-unstable-22.05pre358986.062a0c5437b"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

[ghost]

Thanks to the friendly people over in #webkitgtk, this could be related to GStreamer ticket 233230. If so, the issue should disappear once a more recent version of GStreamer is included with WebKitGTK upstream.

[mcatanzaro]

Thanks to the friendly people over in #webkitgtk, this could be related to GStreamer ticket 233230. If so, the issue should disappear once a more recent version of GStreamer is included with WebKitGTK upstream.

To clarify: that is a WebKit bug, not a GStreamer bug. And WebKitGTK does not bundle GStreamer.

That bug will be fixed in WebKitGTK 2.36.0, which should be released in 1-2 weeks. In the meantime, just install gst-plugins-bad.