[Bug]: WebKit web process dies at random during a run, SIGILL in libWPEWebKit, on three browser builds

Version

1.63.0

Steps to reproduce

I have no minimal reproduction to offer, so this is a report of a crash signature and of what has been ruled out, in case it is already known.

A Playwright suite of about 104 tests runs three projects against a Vue app whose main screen is a MapLibre WebGL map. Every API call is stubbed through page.route, so nothing leaves the container. The WebKit project uses devices['iPhone 13'] with a 390x844 viewport, deviceScaleFactor: 3, hasTouch and isMobile. It runs in mcr.microsoft.com/playwright:v1.63.0-noble with --ipc=host, four workers, retries: 0.

docker run --ipc=host ... mcr.microsoft.com/playwright:v1.63.0-noble \
  npx playwright test --project=mobile-webkit

Expected behavior

The run finishes with no browser process dying.

Actual behavior

One to four WebKit web processes die at a random point in every run. The tests they were running fail with Target crashed, with a protocol error naming a closed session, or with an assertion that returns undefined after a few seconds against an element that is unconditionally rendered. Which tests fail changes from run to run, and a test that failed in one run passes in the next. The two Chromium projects run the same specs clean.

Each crash leaves a core dump of about 7 GB of address space (a few hundred megabytes on disk).

Crash signature, headless (WPE):

• SIGILL, si_code 2 (ILL_ILLOPN), the faulting address inside webkit-2359/minibrowser-wpe/lib/libWPEWebKit-2.0.so.1.10.2, on a ud2 two bytes past a function's ret. The address differs between crashes.
• One run printed g_atomic_rc_box_release_full: assertion 'real_box->magic == G_BOX_MAGIC' failed, then a series of unrefs on objects that were no longer objects.
• One run printed the WebProcess didn't exit as expected after the UI process connection was closed g_error.

Crash signature, headed (GTK, under xvfb-run), same suite:

• SIGSEGV, SEGV_MAPERR at 0x20, on the main thread, in libwebkitgtk-6.0.so.4 under g_main_context_dispatch inside WTF::RunLoop::run(), with libjavascriptcoregtk-6.0.so.1 frames below it.

Both shapes look like a pointer that has been freed or overwritten rather than a resource running out.

The crash is not specific to one browser build. It happens on:

• webkit-2359 (WebKit 26.6), the build 1.63.0 installs
• webkit-2361 (WebKit 26.6), from the browser registry
• webkit-2336 (WebKit 26.5), the build 1.62.1 installs
• the GTK port, headed under Xvfb, as well as the WPE port headless
• JSC_useJIT=false

Measured and ruled out over about thirty runs:

• Memory. Peak resident memory per web process 589 to 675 MB, fully returned over ten open and close cycles of the map screen. Lowest free memory during a run 7.8 GB.
• Open files, 41 against a limit of 1024. /dev/shm stayed empty for whole runs, and the container shares the host's IPC namespace.
• deviceScaleFactor 1 as well as 3.
• WEBKIT_DISABLE_DMABUF_RENDERER=1, tracing and the screencast turned off, the Mesa shader cache, and the software rasteriser at 24, 2 and 1 threads.
• Eight workers as well as four, and an otherwise idle host.
• Turning off JavaScriptCore's top compiler tier, which looked like a fix over four runs and then left four crashes in the fifth.

One test per run also reported a WebGL INVALID_FRAMEBUFFER_OPERATION on the console, which may be a second symptom of the same fault.

Is this signature known? I am happy to upload a core dump, run a build with symbols, or collect any log the team would find useful.

Additional context

The host is WSL2, which may well be the relevant difference; I have no second Linux host to compare against.

Environment

• Operating System: Linux (WSL2, kernel 6.18.33.2-microsoft-standard-WSL2), 24 cores, 23 GB RAM
• Browser: WebKit
• Other: Docker image mcr.microsoft.com/playwright:v1.63.0-noble, Node 22, run with --ipc=host