webkitgtk-2.40.2

[Bruce Dubbs]

New point version.

[Xi Ruoyao]

• Fix scrollbar jumping to top when drag released outside window in GTK4.
• Fix video rendering when GL is disabled.
• Fix flickering on looped videos when starting again.
• Fix CPU usage on autoplaying videos.
• Choose amount of painting threads depending on available CPU cores on GTK4.
• Fix several crashes and rendering issues.

#18051 is likely one of the "rendering issues" fixed.

[Douglas R. Reno]

I can confirm it does since the branch this was based off had the problem fixed in it

[ken@…]

For me 2.40.2 ftbfs without bubblewrap.

cmake reported

-- Enabled features:
--  ENABLE_BUBBLEWRAP_SANDBOX ..................... OFF
--  ENABLE_DOCUMENTATION                            OFF
(etc)

but the build failed with

Sandbox.cpp.o -c /scratch/working/webkitgtk-2.40.2/Source/WTF/wtf/glib/Sandbox.cpp
/scratch/working/webkitgtk-2.40.2/Source/WTF/wtf/glib/Sandbox.cpp: In function ‘bool WTF::isInsideUnsupportedContainer()’:
/scratch/working/webkitgtk-2.40.2/Source/WTF/wtf/glib/Sandbox.cpp:49:13: error: ‘BWRAP_EXECUTABLE’ was not declared in this scope
   49 |             BWRAP_EXECUTABLE,
      |             ^~~~~~~~~~~~~~~~

This on an intel skylake where 2.40.1 built but epiphany using that is almost completely unusable (works for LFS, lwn.net, almost every other site I've tried crahses the tab.

[Douglas R. Reno]

Two critical security vulnerabilities that are under active exploitation have been fixed.

---

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0004

Date Reported: May 30, 2023

Advisory ID: WSA-2023-0004

CVE identifiers: CVE-2023-28204, CVE-2023-32373.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2023-28204

Versions affected: WebKitGTK and WPE WebKit before 2.40.2.

Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds read was addressed with improved input validation.

CVE-2023-32373

Versions affected: WebKitGTK and WPE WebKit before 2.40.2.

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use-after-free issue was addressed with improved memory management.

[Douglas R. Reno]

Replying to ken@…:

For me 2.40.2 ftbfs without bubblewrap.

cmake reported

-- Enabled features:
--  ENABLE_BUBBLEWRAP_SANDBOX ..................... OFF
--  ENABLE_DOCUMENTATION                            OFF
(etc)

but the build failed with

Sandbox.cpp.o -c /scratch/working/webkitgtk-2.40.2/Source/WTF/wtf/glib/Sandbox.cpp
/scratch/working/webkitgtk-2.40.2/Source/WTF/wtf/glib/Sandbox.cpp: In function ‘bool WTF::isInsideUnsupportedContainer()’:
/scratch/working/webkitgtk-2.40.2/Source/WTF/wtf/glib/Sandbox.cpp:49:13: error: ‘BWRAP_EXECUTABLE’ was not declared in this scope
   49 |             BWRAP_EXECUTABLE,
      |             ^~~~~~~~~~~~~~~~

This on an intel skylake where 2.40.1 built but epiphany using that is almost completely unusable (works for LFS, lwn.net, almost every other site I've tried crahses the tab.

Your issue on Skylake is very likely fixed here

We'll need ​https://github.com/WebKit/WebKit/commit/9df022bd38f7eea9b7a693ea1101611d19127189 (can do it with a sed I think) to fix that build failure

[Douglas R. Reno]

Looks like WebKit got these out at the same time as Apple did for all supported devices, definitely want to get this in as soon as we can

[Bruce Dubbs]

Fixed at commit d1d2511e2f350bb87d119770aebf4833596a382d

[Douglas R. Reno]

SA-11.3-036 issued

[Bruce Dubbs]

Milestone renamed