ITADN

Compositor crash triggered from Linux Vulkan/DMABUF path in OpenGLContext::allocate_vkimage_painting_surface

#10336OpenDaisyTheDev 创建于 2026-06-29
bugcrashhas backtrace
D
DaisyTheDevcommented
### Summary If a WebGL context is created on a canvas, A trap occurs ### Operating system Linux ### Steps to reproduce 1. Go to any site creating a WebGL canvas context ### Expected behavior The context gets created ### Actual behavior A trap occurs, and the browser crashes ### URL for a reduced test case N/A ### HTML/SVG/etc. source for a reduced test case ```html <script> document.createElement('canvas').getContext('webgl'); </script> ``` ### Log output and (if possible) backtrace ```shell 643.677 WebContent(4215): Failed to receive message_id: 18 643.677 Ladybird(4179): Failed to receive message_id: 6 VERIFICATION FAILED: response at /home/daisy/Documents/ladybird/Libraries/LibIPC/Connection.h:74 VERIFICATION FAILED: response at /home/daisy/Documents/ladybird/Libraries/LibIPC/Connection.h:74 Stack trace (most recent call first): #0 0x00007fb0878f1148 in send_sync<Messages::CompositorControlServer::CreateContext, AK::DistinctNumeric<unsigned long, Web::Compositor::__CompositorContextId_tag, AK::DistinctNumericFeature::Comparison, AK::DistinctNumericFeature::CastToBool>, AK::Optional<unsigned long>, int &> at /home/daisy/Documents/ladybird/Libraries/LibIPC/Connection.h:74:9 #1 (inlined) in create_context at /home/daisy/Documents/ladybird/Build/release/Services/Compositor/CompositorControlServerEndpoint.h:1057:37 #2 0x00007fb0878d12da in register_compositor_context at /home/daisy/Documents/ladybird/Libraries/LibWebView/Application.cpp:602:26 #3 0x00007fb0879b6f4d in compositor_context_id_for_page at /home/daisy/Documents/ladybird/Libraries/LibWebView/WebContentClient.cpp:98:24 #4 (inlined) in allocate_compositor_context_id at /home/daisy/Documents/ladybird/Libraries/LibWebView/WebContentClient.cpp:113:16 #5 0x00007fb0879b7174 in non-virtual thunk to WebView::WebContentClient::allocate_compositor_context_id(unsigned long, Web::Compositor::PagePresentationRegistration) at /home/daisy/Documents/ladybird/Libraries/LibWebView/WebContentClient.cpp:0:0 #6 0x00007fb0879cd144 in handle_allocate_compositor_context_id at /home/daisy/Documents/ladybird/Build/release/Services/WebContent/WebContentClientEndpoint.h:10956:25 #7 0x00007fb0879c81e3 in handle at /home/daisy/Documents/ladybird/Build/release/Services/WebContent/WebContentClientEndpoint.h:10687:20 #8 0x00007fb0883c0f46 in handle_messages at /home/daisy/Documents/ladybird/Libraries/LibIPC/Connection.cpp:75:44 #9 (inlined) in operator() at /home/daisy/Documents/ladybird/Libraries/LibIPC/Connection.cpp:24:9 #10 0x00007fb0883c1775 in call at /home/daisy/Documents/ladybird/AK/Function.h:224:20 #11 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #12 (inlined) in operator() at /home/daisy/Documents/ladybird/Libraries/LibIPC/TransportSocket.cpp:272:13 #13 0x00007fb0883ccdcd in call at /home/daisy/Documents/ladybird/AK/Function.h:224:20 #14 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #15 0x00007fb0877d9fe5 in event at /home/daisy/Documents/ladybird/Libraries/LibCore/Notifier.cpp:63:13 #16 (inlined) in qt_notifier_activated at /home/daisy/Documents/ladybird/UI/Qt/EventLoopImplementationQt.cpp:303:14 #17 (inlined) in operator() at /home/daisy/Documents/ladybird/UI/Qt/EventLoopImplementationQt.cpp:323:9 #18 (inlined) in operator() at /usr/include/qt6/QtCore/qobjectdefs_impl.h:117:24 #19 (inlined) in call_internal<void, (lambda at /usr/include/qt6/QtCore/qobjectdefs_impl.h:116:35)> at /usr/include/qt6/QtCore/qobjectdefs_impl.h:66:17 #20 (inlined) in call at /usr/include/qt6/QtCore/qobjectdefs_impl.h:116:13 #21 (inlined) in call<QtPrivate::List<>, void> at /usr/include/qt6/QtCore/qobjectdefs_impl.h:338:13 #22 0x000055fb6901ddda in impl at /usr/include/qt6/QtCore/qobjectdefs_impl.h:548:21 #23 0x00007fb085ff081a at /usr/lib/libQt6Core.so.6 #24 0x00007fb086003dbf in QSocketNotifier::event(QEvent*) at /usr/lib/libQt6Core.so.6 #25 0x00007fb087d0411e in QApplicationPrivate::notify_helper(QObject*, QEvent*) at /usr/lib/libQt6Widgets.so.6 #26 0x00007fb085f83657 in QCoreApplication::notifyInternal2(QObject*, QEvent*) at /usr/lib/libQt6Core.so.6 #27 0x00007fb08629f9af at /usr/lib/libQt6Core.so.6 #28 0x00007fb0822febfc at /usr/lib/libglib-2.0.so.0 #29 0x00007fb082300e56 at /usr/lib/libglib-2.0.so.0 #30 0x00007fb082300fe4 in g_main_context_iteration at /usr/lib/libglib-2.0.so.0 #31 0x00007fb08629d0b1 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) at /usr/lib/libQt6Core.so.6 #32 0x00007fb085f91982 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) at /usr/lib/libQt6Core.so.6 #33 0x00007fb085f86ea9 in QCoreApplication::exec() at /usr/lib/libQt6Core.so.6 #34 0x00007fb0878d30d5 in execute at /home/daisy/Documents/ladybird/Libraries/LibWebView/Application.cpp:1129:26 #35 0x000055fb68ffc619 in ladybird_main at /home/daisy/Documents/ladybird/UI/Qt/main.cpp:116:17 #36 0x000055fb6904e8ea in main at /home/daisy/Documents/ladybird/Libraries/LibMain/Main.cpp:46:19 #37 0x00007fb081827740 at /usr/lib/libc.so.6 #38 0x00007fb081827878 in __libc_start_main at /usr/lib/libc.so.6 #39 0x000055fb68ff7b04 in _start at /home/daisy/Documents/ladybird/Build/release/bin/Ladybird Stack trace (most recent call first): #0 0x00005557a7372309 in send_sync<Messages::CompositorWebContentServer::CreateWebglContext, Web::WebGL::WebGLVersion &, Gfx::Size<int> &, bool &, bool &, bool &> at /home/daisy/Documents/ladybird/Libraries/LibIPC/Connection.h:74:9 #1 0x00005557a736ec5f in create_webgl_context at /home/daisy/Documents/ladybird/Services/WebContent/CompositorConnection.cpp:192:21 #2 0x00005557a73a7fa3 in create_context at /home/daisy/Documents/ladybird/Services/WebContent/WebContentCompositorHost.cpp:33:40 #3 0x00007f2c9a4a2169 in create_remote_webgl_context at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebGL/WebGLRenderingContext.cpp:82:30 #4 0x00007f2c9a4a1f88 in create_webgl_context_proxy at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebGL/WebGLRenderingContext.cpp:98:19 #5 0x00007f2c9a4a242d in create at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebGL/WebGLRenderingContext.cpp:120:20 #6 (inlined) in create_webgl_context<Web::WebGL::WebGLRenderingContext> at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/HTMLCanvasElement.cpp:273:30 #7 0x00007f2c99f277d7 in get_context at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/HTMLCanvasElement.cpp:302:17 #8 (inlined) in operator() at /home/daisy/Documents/ladybird/Build/release/Libraries/LibWeb/Bindings/HTMLCanvasElement.cpp:417:94 #9 (inlined) in throw_dom_exception_if_needed<(lambda at /home/daisy/Documents/ladybird/Build/release/Libraries/LibWeb/Bindings/HTMLCanvasElement.cpp:417:31), JS::ThrowCompletionOr<AK::Variant<GC::Ref<Web::HTML::CanvasRenderingContext2D>, GC::Ref<Web::WebGL::WebGLRenderingContext>, GC::Ref<Web::WebGL::WebGL2RenderingContext>, AK::Empty> >, AK::Variant<GC::Ref<Web::HTML::CanvasRenderingContext2D>, GC::Ref<Web::WebGL::WebGLRenderingContext>, GC::Ref<Web::WebGL::WebGL2RenderingContext>, AK::Empty> > at /home/daisy/Documents/ladybird/Libraries/LibWeb/Bindings/ExceptionOrUtils.h:111:16 #10 0x00007f2c9a915b4f in get_context at /home/daisy/Documents/ladybird/Build/release/Libraries/LibWeb/Bindings/HTMLCanvasElement.cpp:417:35 #11 0x00007f2c98b1575d at /home/daisy/Documents/ladybird/Build/release/Libraries/LibJS/Bytecode/AsmInterpreter/asmint_x86_64.S:6019:0 #12 0x00007f2c98828fb8 in run_executable at /home/daisy/Documents/ladybird/Libraries/LibJS/Bytecode/Interpreter.cpp:301:9 #13 (inlined) in ordinary_call_evaluate_body at /home/daisy/Documents/ladybird/Libraries/LibJS/Runtime/ECMAScriptFunctionObject.cpp:518:26 #14 0x00007f2c988e456e in internal_call at /home/daisy/Documents/ladybird/Libraries/LibJS/Runtime/ECMAScriptFunctionObject.cpp:197:19 #15 0x00007f2c9886f0b6 in call_impl at /home/daisy/Documents/ladybird/Libraries/LibJS/Runtime/AbstractOperations.cpp:141:21 #16 (inlined) in call at /home/daisy/Documents/ladybird/Libraries/LibJS/Runtime/AbstractOperations.h:150:12 #17 (inlined) in invoke_callback_impl<(lambda at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebIDL/AbstractOperations.cpp:341:70)> at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebIDL/AbstractOperations.cpp:313:24 #18 0x00007f2c9a4b8002 in invoke_callback at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebIDL/AbstractOperations.cpp:341:12 #19 (inlined) in operator() at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/Window.cpp:1780:16 #20 0x00007f2c9a0f4cdc in call at /home/daisy/Documents/ladybird/AK/Function.h:224:20 #21 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #22 (inlined) in invoke at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/Window.cpp:126:89 #23 0x00007f2c9a0ece7a in invoke_idle_callbacks at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/Window.cpp:694:33 #24 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #25 0x00007f2c99f02167 in execute at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/EventLoop/Task.cpp:52:5 #26 0x00007f2c99efc251 in process at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/EventLoop/EventLoop.cpp:151:22 #27 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #28 (inlined) in operator() at /home/daisy/Documents/ladybird/Libraries/LibWeb/Platform/Timer.cpp:21:13 #29 0x00007f2c9a300db0 in call at /home/daisy/Documents/ladybird/AK/Function.h:224:20 #30 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #31 0x00007f2c98dba9ab in timer_event at /home/daisy/Documents/ladybird/Libraries/LibCore/Timer.cpp:94:9 #32 0x00007f2c98db9f64 in process at /home/daisy/Documents/ladybird/Libraries/LibCore/ThreadEventQueue.cpp:0:0 #33 (inlined) in pump at /home/daisy/Documents/ladybird/Libraries/LibCore/EventLoopImplementationUnix.cpp:349:40 #34 0x00007f2c98dbc27b in exec at /home/daisy/Documents/ladybird/Libraries/LibCore/EventLoopImplementationUnix.cpp:340:9 #35 0x00005557a72d29c4 in ladybird_main at /home/daisy/Documents/ladybird/Services/WebContent/main.cpp:281:23 #36 0x00005557a741b32a in main at /home/daisy/Documents/ladybird/Libraries/LibMain/Main.cpp:46:19 #37 0x00007f2c95a27740 at /usr/lib/libc.so.6 #38 0x00007f2c95a27878 at /usr/lib/libc.so.6 #39 0x00005557a72d1d74 in _start at /home/daisy/Documents/ladybird/Build/release/libexec/WebContent CRASH: Received signal SIGILL (4) Stack trace (most recent call first): #0 0x00007f2c95a3e26f at /usr/lib/libc.so.6 #1 0x00007f2c9850e080 in ak_trap at /home/daisy/Documents/ladybird/AK/Assertions.cpp:137:5 #2 0x00007f2c9850dfcc in ak_verification_failed at /home/daisy/Documents/ladybird/AK/Assertions.cpp:175:5 #3 0x00005557a7372309 in send_sync<Messages::CompositorWebContentServer::CreateWebglContext, Web::WebGL::WebGLVersion &, Gfx::Size<int> &, bool &, bool &, bool &> at /home/daisy/Documents/ladybird/Libraries/LibIPC/Connection.h:74:9 #4 0x00005557a736ec5f in create_webgl_context at /home/daisy/Documents/ladybird/Services/WebContent/CompositorConnection.cpp:192:21 #5 0x00005557a73a7fa3 in create_context at /home/daisy/Documents/ladybird/Services/WebContent/WebContentCompositorHost.cpp:33:40 #6 0x00007f2c9a4a2169 in create_remote_webgl_context at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebGL/WebGLRenderingContext.cpp:82:30 #7 0x00007f2c9a4a1f88 in create_webgl_context_proxy at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebGL/WebGLRenderingContext.cpp:98:19 #8 0x00007f2c9a4a242d in create at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebGL/WebGLRenderingContext.cpp:120:20 #9 (inlined) in create_webgl_context<Web::WebGL::WebGLRenderingContext> at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/HTMLCanvasElement.cpp:273:30 #10 0x00007f2c99f277d7 in get_context at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/HTMLCanvasElement.cpp:302:17 #11 (inlined) in operator() at /home/daisy/Documents/ladybird/Build/release/Libraries/LibWeb/Bindings/HTMLCanvasElement.cpp:417:94 #12 (inlined) in throw_dom_exception_if_needed<(lambda at /home/daisy/Documents/ladybird/Build/release/Libraries/LibWeb/Bindings/HTMLCanvasElement.cpp:417:31), JS::ThrowCompletionOr<AK::Variant<GC::Ref<Web::HTML::CanvasRenderingContext2D>, GC::Ref<Web::WebGL::WebGLRenderingContext>, GC::Ref<Web::WebGL::WebGL2RenderingContext>, AK::Empty> >, AK::Variant<GC::Ref<Web::HTML::CanvasRenderingContext2D>, GC::Ref<Web::WebGL::WebGLRenderingContext>, GC::Ref<Web::WebGL::WebGL2RenderingContext>, AK::Empty> > at /home/daisy/Documents/ladybird/Libraries/LibWeb/Bindings/ExceptionOrUtils.h:111:16 #13 0x00007f2c9a915b4f in get_context at /home/daisy/Documents/ladybird/Build/release/Libraries/LibWeb/Bindings/HTMLCanvasElement.cpp:417:35 #14 0x00007f2c98b1575d at /home/daisy/Documents/ladybird/Build/release/Libraries/LibJS/Bytecode/AsmInterpreter/asmint_x86_64.S:6019:0 #15 0x00007f2c98828fb8 in run_executable at /home/daisy/Documents/ladybird/Libraries/LibJS/Bytecode/Interpreter.cpp:301:9 #16 (inlined) in ordinary_call_evaluate_body at /home/daisy/Documents/ladybird/Libraries/LibJS/Runtime/ECMAScriptFunctionObject.cpp:518:26 #17 0x00007f2c988e456e in internal_call at /home/daisy/Documents/ladybird/Libraries/LibJS/Runtime/ECMAScriptFunctionObject.cpp:197:19 #18 0x00007f2c9886f0b6 in call_impl at /home/daisy/Documents/ladybird/Libraries/LibJS/Runtime/AbstractOperations.cpp:141:21 #19 (inlined) in call at /home/daisy/Documents/ladybird/Libraries/LibJS/Runtime/AbstractOperations.h:150:12 #20 (inlined) in invoke_callback_impl<(lambda at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebIDL/AbstractOperations.cpp:341:70)> at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebIDL/AbstractOperations.cpp:313:24 #21 0x00007f2c9a4b8002 in invoke_callback at /home/daisy/Documents/ladybird/Libraries/LibWeb/WebIDL/AbstractOperations.cpp:341:12 #22 (inlined) in operator() at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/Window.cpp:1780:16 #23 0x00007f2c9a0f4cdc in call at /home/daisy/Documents/ladybird/AK/Function.h:224:20 #24 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #25 (inlined) in invoke at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/Window.cpp:126:89 #26 0x00007f2c9a0ece7a in invoke_idle_callbacks at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/Window.cpp:694:33 #27 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #28 0x00007f2c99f02167 in execute at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/EventLoop/Task.cpp:52:5 #29 0x00007f2c99efc251 in process at /home/daisy/Documents/ladybird/Libraries/LibWeb/HTML/EventLoop/EventLoop.cpp:151:22 #30 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #31 (inlined) in operator() at /home/daisy/Documents/ladybird/Libraries/LibWeb/Platform/Timer.cpp:21:13 #32 0x00007f2c9a300db0 in call at /home/daisy/Documents/ladybird/AK/Function.h:224:20 #33 (inlined) in operator() at /home/daisy/Documents/ladybird/AK/Function.h:147:25 #34 0x00007f2c98dba9ab in timer_event at /home/daisy/Documents/ladybird/Libraries/LibCore/Timer.cpp:94:9 #35 0x00007f2c98db9f64 in process at /home/daisy/Documents/ladybird/Libraries/LibCore/ThreadEventQueue.cpp:0:0 #36 (inlined) in pump at /home/daisy/Documents/ladybird/Libraries/LibCore/EventLoopImplementationUnix.cpp:349:40 #37 0x00007f2c98dbc27b in exec at /home/daisy/Documents/ladybird/Libraries/LibCore/EventLoopImplementationUnix.cpp:340:9 #38 0x00005557a72d29c4 in ladybird_main at /home/daisy/Documents/ladybird/Services/WebContent/main.cpp:281:23 #39 0x00005557a741b32a in main at /home/daisy/Documents/ladybird/Libraries/LibMain/Main.cpp:46:19 #40 0x00007f2c95a27740 at /usr/lib/libc.so.6 #41 0x00007f2c95a27878 at /usr/lib/libc.so.6 #42 0x00005557a72d1d74 in _start at /home/daisy/Documents/ladybird/Build/release/libexec/WebContent ``` ### Screenshots or screen recordings _No response_ ### Build flags or config settings _No response_
1 条评论