On systems using the proprietary NVIDIA driver, any WebKitGTK application
crashes with SIGSEGV the first time page content requires a compositing
layer.

disable-nvidia-dmabuf.patch adds its isNVIDIA() check before
mode.add(RendererBufferTransportMode::SharedMemory), so on NVIDIA the
function returns with an empty mode rather than with SharedMemory only:

rendererBufferTransportMode() -> empty
checkRequirements() -> false (silently, no warning)
AcceleratedBackingStore::create() -> nullptr
priv->acceleratedBackingStore -> NULL

webkitWebViewBaseEnterAcceleratedCompositingMode() then dereferences that
pointer, guarded only by an ASSERT that compiles out in release builds:

ASSERT(webkitWebViewBase->priv->acceleratedBackingStore);
webkitWebViewBase->priv->acceleratedBackingStore->update(layerTreeContext);

Backtrace (libwebkit2gtk-4.1-0 2.52.3-0ubuntu0.24.04.1 with dbgsym):

#0 AcceleratedBackingStore::update() AcceleratedBackingStore.cpp:808
#1 WebPageProxy::enterAcceleratedCompositingMode()
#2 DrawingAreaProxyCoordinatedGraphics::enterAcceleratedCompositingMode()
#3 DrawingAreaProxy::didReceiveMessage()
<- IPC Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode

The intent of the patch is to disable the hardware DMABuf transport, not the
software one. Moving the check three lines down keeps SharedMemory, which is
what the backing store needs, and puts NVIDIA on the same path as the
existing WEBKIT_DMABUF_RENDERER_FORCE_SHM escape hatch immediately below it:
--- a/debian/patches/disable-nvidia-dmabuf.patch
+++ b/debian/patches/disable-nvidia-dmabuf.patch
@@
- if (isNVIDIA())
- return;
-
mode.add(RendererBufferTransportMode::SharedMemory);

+ if (isNVIDIA())
+ return;
+
const char* forceSHM = getenv("WEBKIT_DMABUF_RENDERER_FORCE_SHM");

Verification on affected hardware (GeForce RTX 3050 Ti, driver 580.173.02,
X11, Ubuntu 24.04, libwebkit2gtk-4.1-0 2.52.3-0ubuntu0.24.04.1). Values read
from the running process and from the core dump:

mode = {} (current) create() = 0x0 -> SIGSEGV
mode = {SHM, HW} (WEBKIT_FORCE_DMABUF_RENDERER=1) no crash, blank window
mode = {SharedMemory} renders, no crash

The third row is the state the proposed change produces. I reproduced it with
WEBKIT_FORCE_DMABUF_RENDERER=1 WEBKIT_DMABUF_RENDERER_FORCE_SHM=1 rather than
by rebuilding the package, so the resulting mode is identical but isNVIDIA()
is short-circuited instead of running and returning afterwards. I have not
built a patched webkit2gtk to confirm the built artifact.

I could not determine why the check was originally placed before the
SharedMemory line. One possibility is that an empty mode still had a usable
fallback when the patch was written and that fallback has since been removed;
if SharedMemory must also be disabled on NVIDIA for a reason I am not aware
of, then the fix belongs instead in the null handling in
webkitWebViewBaseEnterAcceleratedCompositingMode().

Existing references: Debian #1039720, WebKit #262607, WebKit PR 18614 (which
does not appear to have landed upstream -- the 2.52.3 tag has no isNVIDIA()).

Workaround for affected users, forcing EGL to Mesa so isNVIDIA() is false:
__EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json

Kyle W. Santiago
CTO
kyle@privkey.io

[Website](https://privkey.io/) | [GitHub](https://github.com/privkeyio) | [LinkedIn](https://www.linkedin.com/in/kwsantiago/) | [PGP](https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x23ae8a8ea7e24e38)

I'm discussing this with upstream, I'll come back here as soon as I
have an answer.

Thanks for the report,

Berto

We believe that the bug you reported is fixed in the latest version of
webkit2gtk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142771@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alberto Garcia <berto@igalia.com> (supplier of updated webkit2gtk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 10 Aug 2026 13:44:37 +0200
Source: webkit2gtk
Architecture: source
Version: 2.53.90-1
Distribution: experimental
Urgency: medium
Maintainer: Debian WebKit Maintainers <pkg-webkit-maintainers@lists.alioth.debian.org>
Changed-By: Alberto Garcia <berto@igalia.com>
Closes: 1142771
Changes:
 webkit2gtk (2.53.90-1) experimental; urgency=medium
 .
   * New upstream development release.
   * debian/copyright:
     - Update copyright information of all files.
   * debian/libwebkit2gtk-4.1-0.symbols:
     - Update symbols.
   * debian/patches/disable-dmabuf-nvidia.patch:
     - Use the SHM transport with NVIDIA GPUs (Closes: #1142771).
Checksums-Sha1:
 e94d6b00ca33288988f32d7651ffd5ccc903f4a7 4724 webkit2gtk_2.53.90-1.dsc
 ad5088452956adf054059dbb24e140bb8c5dcf2b 49850104 webkit2gtk_2.53.90.orig.tar.xz
 c593f98600832c8785131228c414db4bdee77b9d 833 webkit2gtk_2.53.90.orig.tar.xz.asc
 6438b4ecdb3a4ccc38ea02567a2dafbbb966253d 94076 webkit2gtk_2.53.90-1.debian.tar.xz
 f67d1d301b7047f8d51cd5e356ea56b3f5b1af61 16480 webkit2gtk_2.53.90-1_source.buildinfo
Checksums-Sha256:
 9e46faa7d339e22c490b0d41696b8733316065a7e128e777b7ea9e9ae791315b 4724 webkit2gtk_2.53.90-1.dsc
 56b99f7b482221da2b6acc307cac3b8fb777e8dcb7720c56d5d77161a837c8e6 49850104 webkit2gtk_2.53.90.orig.tar.xz
 56e09e68d795ac38ba1b7a4fed9858bf33601ac2d79bb226fb034bc379e4a962 833 webkit2gtk_2.53.90.orig.tar.xz.asc
 942e869e7d9570e932213767c75efedb44d0b9038b91462e82e8fd64e5b9d4a0 94076 webkit2gtk_2.53.90-1.debian.tar.xz
 76671f050f6a894833b183f06553e1257dbf2b0ec2c1ab7da6d07bc70798834d 16480 webkit2gtk_2.53.90-1_source.buildinfo
Files:
 fb54a98afc4a07b9f8c18a21acf6009e 4724 web optional webkit2gtk_2.53.90-1.dsc
 ecf60feeae32986ee101cdd11258864b 49850104 web optional webkit2gtk_2.53.90.orig.tar.xz
 c0ca4a69871cf567a72421ec184e63e4 833 web optional webkit2gtk_2.53.90.orig.tar.xz.asc
 140d2f0d1fc41eb0e1f6b595142ed3b9 94076 web optional webkit2gtk_2.53.90-1.debian.tar.xz
 fc874c5ebc6b5b5eeb62e002c51c139c 16480 web optional webkit2gtk_2.53.90-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAmp5vNsACgkQAAyEYu0C
2AI4xg/+NR7nXXfM/ID1tVpuG1hfzt++lUSCDKm7dVFt9uEjucD5Na0UGligqXXS
eSS5hGUlOiohDiD41eq6l7tYeoefasOg0i5v90BMMD7i5P8aPkbilea3VDa3Zb0M
f5ueQdBtDcwSLhlcdSvj4TnlR7MeioHiJVXpEB+X/2cmzVP6346hUj1oKHEel0j6
PKLIkm2AVMK+lhRAf8QekGomDOwljLB0AQre9o9WlgDY347D0vGmNWzuXEJlchPA
dmW0ltPxU4Fpusmq9v8BJ/fbRucHxuVnxWabIrYrd3lnr8Og7ryChZeKJFNXmGXO
Tx/td8+04Z3tbnHjOIHBuHXslcw0sQXb9HEwZK8GxrMGK72Nm9mwxHy6dlSxGdxU
aFmOSnLL1S06X5V5h3ttL4SJU0SAVIi2vMzuCAH0lMlwF8kvwWnP63nJQdqAb4LG
LVfWmoX8Zl9y47QGfAUm8yNApAeOWxmhtAludg8qTbw51ApLJ81trjVaAMfKyKEM
eVu0Po/vHgGqNauRV9YXOiln9iPrlgNYrZRkok1d7R/Xio9+nj0QMuYlp+1IjQ4I
MgY03ufgfU/7vYTXrORZfGZH8JT4f6uburVsSzKnrOZUfZd5e3PihVm7y05y0nzd
aw1hCJMGetoS3Y9NbFqQdc73c3Wb2c7XSW+AqIJ+8CbcobbaNBY=
=ggAf
-----END PGP SIGNATURE-----