Dear Maintainer,

Disclaimer: this bug report has been wroten with the help of a locally-run LLM.

After a reinstallation of my Debian system yesterday 2026-10-01 I found out evolution does not start anymore.
It was working 2 or 3 days ago. Nothing changed, same system: Debian Trixie on ZFS root filesystem, has been reinstalled in the same way (fixing a few partition sizes discrepancies). evolution could not start after reinstall. Local LLM helped to troubleshoot and identified libwebkit2gtk-4.1-0 update release on 2026-10-01? After rollback to previous version, evolution could start again.
I am available for further information. Sorry for bad English and LLM use.

Summary
-------
Any WebKitGTK application aborts with SIGABRT at web process launch when the
environment variable PULSE_SERVER is set to a "unix:" path. The abort happens
before the web process is spawned, so the application dies immediately at
startup. Not reproducible with 2.52.6-1~deb13u1, which is the previous
version in trixie-security.

How to reproduce
----------------
Any WebKitGTK app that creates a WebView, e.g. Evolution:

    PULSE_SERVER=unix:/run/user/1000/pulse/native evolution; echo $?
    -> Abandon (SIGABRT), exit status 134

Without PULSE_SERVER in the environment the same app starts normally.
Minimal reproducer with python3-gi:

    import gi; gi.require_version('Gtk','3.0'); gi.require_version('WebKit2','4.1')
    from gi.repository import Gtk, WebKit2
    v = WebKit2.WebView(); v.load_html("<html><body>x</body></html>", None)

run with a WebKit 2.54 library (LD_LIBRARY_PATH) and PULSE_SERVER=unix:...

Root cause
----------
Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp, bindPulse():

    const char* pulseServer = g_getenv("PULSE_SERVER");
    if (pulseServer) {
        auto pulseServerString = CStringView::unsafeFromUTF8(pulseServer);
        if (startsWith(pulseServerString.span(), "unix:"_s))
            bindIfExists(args, CStringView::fromUTF8(pulseServerString.span().subspan(5)), BindFlags::ReadWrite);
        // else it uses tcp
    }

CStringView::span() returns the span *without* the trailing NUL, so
span().subspan(5) — the path after "unix:" — is not NUL terminated.
CStringView::fromUTF8(std::span) contains

    RELEASE_ASSERT(spanWithNullTerminator[spanWithNullTerminator.size() - 1] == '\0');

(Source/WTF/wtf/text/CStringView.h, line 60), so the assertion fails and the
process calls abort(). This is reached while assembling the bubblewrap
sandbox arguments for the web process, which is why the crash happens on the
first WebView that needs a web process.

Backtrace (strace -k, Evolution 3.56.2, webkit2gtk 2.54.0-1~deb13u1):

    tgkill(pid, pid, SIGABRT)
     > libc.so.6(abort+0x22)
     > libwebkit2gtk-4.1.so.0.24.3() [0x7323fb]        <- WTF crash helper
     > libwebkit2gtk-4.1.so.0.24.3() [0xa1e516]        <- CStringView::fromUTF8
        (WTFCrashWithInfo line=60, file=.../wtf/text/CStringView.h)
     ...
     > libwebkit2gtk-4.1.so.0.24.3(webkit_web_view_run_javascript+0x2e)
     > libevolution-util.so.0.0.0(e_web_view_jsc_run_script+0xe0)
     > libevolution-util.so.0.0.0(e_web_view_update_fonts_settings+0x53e)

Upstream status
---------------
Current upstream master no longer contains the CStringView span arithmetic,
it uses plain C pointer arithmetic which keeps the terminator:

    if (g_str_has_prefix(pulseServer, "unix:"))
        bindIfExists(args, pulseServer + 5, BindFlags::ReadWrite);

(Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp, current tree.)
So the bug is specific to the 2.54.0 release and already fixed upstream;
please consider backporting that change (or importing 2.54.1) for trixie.

Workaround
----------
Do not export PULSE_SERVER with a "unix:" value to WebKit applications (or
keep webkit2gtk at 2.52.6-1~deb13u1, which is what users hit by this bug
will end up doing). A TCP-form PULSE_SERVER value does not trigger it.
(END)

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these template lines ***

Control: found -1 2.54.0-1~deb13u1
Control: notfound -1 2.52.6-1~deb13u1

Thanks, the information is useful, I can confirm the problem. I'm
talking to the WebKitGTK team and we'll prepare an updated version as
soon as possible.

Sorry for this, and thanks for reporting it!

Berto

Hello,

I have prepared a test build with fixes for #1149690 and #1149700.

I would appreciate if you could test it and verify that it fixes the
problem for you.

You can download the packages here:

https://people.debian.org/~berto/webkit2gtk-2.54.0/trixie-amd64/

Of course you don't need to install all of them, only the ones that
you already have :-)

The sha256sums file contains the checksums of all files and is signed
by me, so you can verify the authenticity if you have the
debian-keyring package installed:

gpg --keyring /usr/share/keyrings/debian-keyring.gpg --verify sha256sums.asc

Thanks!

I was able to reproduce both bugs and confirm that the fixes work. I
just released WebKitGTK 2.54.0-1~deb13u2 with the fixes.

Berto

We believe that the bug you reported is fixed in the latest version of
webkit2gtk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149690@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alberto Garcia <berto@igalia.com> (supplier of updated webkit2gtk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 02 Oct 2026 23:21:14 +0200
Source: webkit2gtk
Architecture: source
Version: 2.54.1-1
Distribution: unstable
Urgency: high
Maintainer: Debian WebKit Maintainers <pkg-webkit-maintainers@lists.alioth.debian.org>
Changed-By: Alberto Garcia <berto@igalia.com>
Closes: 1149690 1149700
Changes:
 webkit2gtk (2.54.1-1) unstable; urgency=high
 .
   * New upstream release (Closes: #1149700).
   * Refresh all patches.
     - Try to fix the build on hurd and sh4.
   * debian/patches/fix-web-process-abort.patch:
     - Fix crash when starting the web process (Closes: #1149690).
Checksums-Sha1:
 02187dcf51340f11e6260f7b4cad23492872bc1b 4745 webkit2gtk_2.54.1-1.dsc
 502f1dad3a0cc7d4357eb537663987e7d39a5599 49729412 webkit2gtk_2.54.1.orig.tar.xz
 81249c58059573fee2ad35c6291e55005c0dfa04 833 webkit2gtk_2.54.1.orig.tar.xz.asc
 73ed51e678775b57cac655387e2d75c5dcd25c24 95196 webkit2gtk_2.54.1-1.debian.tar.xz
 2380dc0c574b7d8401a62a5845ba01c1b23c176e 16650 webkit2gtk_2.54.1-1_source.buildinfo
Checksums-Sha256:
 3664a859438e212430bf32a7a8106d8c063941b58560100a298d6e0502d5bfbe 4745 webkit2gtk_2.54.1-1.dsc
 ea0bbb02dbdbc596874a4e7ad35b66645b3e0a232bd0e4081de5ed92eb0a397d 49729412 webkit2gtk_2.54.1.orig.tar.xz
 4638f86bd4c79bad570f75a6ebea3c1b3f37dd292360e0ea2211c0b76c826287 833 webkit2gtk_2.54.1.orig.tar.xz.asc
 485a5ce81eb9a6ecb7d89b36a98d1e78676c1bcd50a6e0a20b6e11a6b3d8d119 95196 webkit2gtk_2.54.1-1.debian.tar.xz
 21eeced5a92c6f886a2c5e2a76fd7faeb92fd710dc6e8771b8fb304bba051f9b 16650 webkit2gtk_2.54.1-1_source.buildinfo
Files:
 21075cd000d3315a935dfd21acabe9a8 4745 web optional webkit2gtk_2.54.1-1.dsc
 78025e9335d5dbc6f47c352c4e5e6311 49729412 web optional webkit2gtk_2.54.1.orig.tar.xz
 27d0606a78c50aefcb3694604c175d78 833 web optional webkit2gtk_2.54.1.orig.tar.xz.asc
 264ebfca9f2e2774645d2db27187246b 95196 web optional webkit2gtk_2.54.1-1.debian.tar.xz
 a2088e67adcd5928350a215e8dd71b39 16650 web optional webkit2gtk_2.54.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAmrAKDkACgkQAAyEYu0C
2AKhaA//TDdUjitRWENqZfDlphk4eNkWxcs3Cwp2CMeG5NR2qqiJHvRraXoYzNvO
oukTon21tZ2uxWGprlrgUBVDGrmYvYoCqySF9Cv6J4ai9X5VT7ixLwLkdWSCrHxv
dgGDUz0GLFDbEphtyVCrZtQM/oe5emS95RuBGJVYW+F3JLUj/mS24q2w3BEtXA+D
aDf4vUZ20qBArqqAzscv8ZcKOaLlKQWHjvkc4YLrqZOJs5j0Kuqe0Z9VUV7VjGLC
GyJeLNwU4jpkgUvcg33oV01ea8ogvVdw/fHP48fGN5cUQ0XDm3Zg+k9T4Nx7m8XW
nBFqIZpCosULN6QO5XSOY7CloLABrYav/ydQdL2HCSCVj2PyfYrhDD4gGd1HMh07
3tQ5KkGIw2MiGHIGRXlptQlWDw62/3aGGfZym/mJR81H+rFdnmsuy+TRaDvbH9UI
gyvXZWb46FlTbUtLcKRRJVxqnUGdyVzOGhseIBeakbOFQYC/Ri+F/qG/PVqVJ48g
yTPQnmeqlJJ40IJ9g5KroOfCiJy77W+lAOWyX7PKRAqvWojBGpayCJ6RGlDS3A70
LTLqtjjjsH6xyiD8+J5MdogbCJ4yB6jiD1dD+ba2uh7yBBf9dwIP89IV97YcozMP
of/gS/rT8tlpXSylAPEwg+pkkW7tjI6nW5955bm5pUK3Q7mbZHY=
=6wS7
-----END PGP SIGNATURE-----

I can confirm that the newly released artifacts fix the problem. Thanks a lot!

apt-cache policy libjavascriptcoregtk-4.1-0 libwebkit2gtk-4.1-0
libjavascriptcoregtk-4.1-0:
   Installed: 2.54.0-1~deb13u2
   Candidate: 2.54.0-1~deb13u2
   Version table:
  *** 2.54.0-1~deb13u2 500
         500 https://security.debian.org/debian-security trixie-security/main amd64 Packages
         100 /var/lib/dpkg/status
      2.52.6-1~deb13u1 500
         500 https://deb.debian.org/debian trixie/main amd64 Packages
libwebkit2gtk-4.1-0:
   Installed: 2.54.0-1~deb13u2
   Candidate: 2.54.0-1~deb13u2
   Version table:
  *** 2.54.0-1~deb13u2 500
         500 https://security.debian.org/debian-security trixie-security/main amd64 Packages
         100 /var/lib/dpkg/status
      2.52.6-1~deb13u1 500
         500 https://deb.debian.org/debian trixie/main amd64 Packages

I can also confirm it works. Email as a proof!
Thank you very much!

Baptiste