[Bug]: WebKit (WPE) web process crashes at exit (WebKit bug 305909), please roll WebKit to include e0b1fdd

Version

1.61.1 (webkit-2311). By commit comparison, the WebKit bases of 1.63.0 (4d05d732e5) and of main (56453fdfe0) both predate the upstream fix below, so upgrading does not help yet.

Summary

Linux WebKit (WPE, headless) web processes crash at process exit after their page closes. On a self-hosted CI runner with four concurrent e2e jobs we see several crashes an hour, in bursts (5 in 30 minutes today). Tests are not affected, because the page is already gone. Each crash writes a 6–11 GB core, which filled the host's system drive.

The cores match WebKit bug 305909, "[GTK][WPE] Crash on exit in PlatformDisplay::terminateEGLDisplay", fixed upstream by WebKit/WebKit#74728 (e0b1fddaa46813e6b7165037198bb7c34768c1f6, merged 2026-09-24). From that commit message: "In the web process, a thread that exits destroys its Skia context at the same time, and because Mesa frees the display in its own atexit handler, that thread writes into freed memory and corrupts the heap."

Request: roll the WebKit build to a revision that includes e0b1fdd. #42637 was resolved the same way.

Evidence

Two shapes, same race, both with no GPU (Mesa llvmpipe):

1. SIGABRT: libglvnd assertion in a WebKit thread's TLS destructor, while the main thread is in exit handlers (gdb on the core):

Program terminated with signal SIGABRT, Aborted.
Thread 1 (exiting thread, start_routine inside libWPEWebKit-2.0.so.1; llvmpipe JIT strings on its stack):
#5  __assert_fail_base (assertion="dispatch->currentThreads >= 0", file="../src/GLdispatch/GLdispatch.c", line=222, function="DispatchCurrentUnref")
#7  ?? () from /lib/x86_64-linux-gnu/libGLdispatch.so.0
#8  ?? () from /lib/x86_64-linux-gnu/libGLdispatch.so.0
#9  __GI___nptl_deallocate_tsd () at ./nptl/nptl_deallocate_tsd.c:73
#11 start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:453

Thread 2 (main):
#0  munmap ()
#1  _dl_unmap_segments / _dl_unmap
#3  _dl_close_worker
#5  _dl_close
    ... raw stack also holds __dlclose, _dl_fini, __run_exit_handlers, __libc_start_call_main

libEGL_mesa.so.0 is missing from the core's shared-library list because it is the object the main thread is unmapping. Sequence: main returns, then libEGL's destructor tears down the Mesa vendor and its dispatch table, then a still-running WebKit GL thread exits, and its libglvnd thread-exit hook unrefs the destroyed dispatch.

2. SIGSEGV: the thread jumps into the already-unmapped vendor library (ip == fault address):

SkiaGPUWorker[7308]: segfault at 79ecdaeeb5d0 ip 000079ecdaeeb5d0 sp 000079ececff8b58 error 15
eadedCompositor[10475]: segfault at 7606ee1df3d0 ip 00007606ee1df3d0 sp 000076049d7f99a0 error 14
eadedCompositor[10620]: segfault at 7b781c44d3d0 ip 00007b781c44d3d0 sp 00007b75fcff89a0 error 14

Steps to reproduce

We don't have a minimal repro. A synthetic stress test did not trigger it: 4 workers × 60 contexts each with WebGL, 2D canvas, CSS transform animations and recordVideo, 240 page closes, zero crashes. The real suite triggers it reliably: a Next.js 16 / React 19 app, fullyParallel, 2 workers per job, video: 'retain-on-failure', trace: 'on-first-retry', devices['Desktop Safari'] plus a few devices['iPad Pro 11'] specs. We are happy to run a candidate build against it and report back.

Expected behavior

Web processes exit cleanly.

Actual behavior

WPEWebProcess aborts or segfaults during exit, as shown above.

Environment

• Host: Windows 11 Pro 25H2 (26200.9550), WSL 2.7.13, WSL kernel 6.18.33.2-microsoft-standard-WSL2
• Guest: Ubuntu 22.04.5, Node v20.20.2
• Graphics: gpuSupport=false (no /dev/dxg GPU), so Mesa 23.2.1 llvmpipe (swrast_dri.so); libglvnd 1.4.0
• Headless WPE (minibrowser-wpe), webkit-2311