[Regression]Brave browser crashes interacting with GMail (bisected)

[tekstryder]

Hyprland version

Hyprland 0.56.0 built from branch makepkg at commit f7a711625ea553fe503f41ea8b65c0c6f468ef50 dirty (protocols: a few protocol error touchups ( 15474)).
Date: Sun Jul 26 10:07:34 2026
Tag: v0.56.0-22-gf7a711625, commits: 7647

Libraries:
Hyprgraphics: built against 0.5.1, system has 0.5.1
Hyprutils: built against 0.14.0, system has 0.14.0
Hyprcursor: built against 0.1.13, system has 0.1.13
Hyprlang: built against 0.6.8, system has 0.6.8
Aquamarine: built against 0.14.0, system has 0.14.0

Version ABI string: f7a711625ea553fe503f41ea8b65c0c6f468ef50_aq_0.14_hu_0.14_hg_0.5_hc_0.1_hlg_0.6
flags set:
no xwayland

local/aquamarine 0.14.0.r2.gfc39af0-1
local/hyprcursor 0.1.13-7
local/hyprgraphics 0.5.1.r9.gc6e7b9f-1
local/hypridle 0.1.8.r0.ge5c01af-1
local/hyprland 0.56.0.r22.gf7a7116-1
local/hyprland-guiutils 0.2.2-2
local/hyprlang 0.6.8-5
local/hyprtoolkit 0.5.4.r44.g08aed5d-1
local/hyprutils 0.14.0.r1.g83da5ee-1
local/hyprwayland-scanner 0.4.6-1
local/hyprwire 0.3.1.r6.g7d935bb-1

• brave-origin-bin 1:1.93.129
• nvidia 580.173.02

Is this a regression?

Yes. Bisected to first bad commit f7a7116.

What's the bug?

Interacting with elements on the GMail interface via Brave browser almost immediately crashes Brave.

Spent the last couple days pursuing this as a Brave bug. Ugh.

Nope, popped on Sway for a few hours and couldn't repro so started to bisect.

Reproduction steps

1. Open Brave browser
2. Navigate to gmail.com
3. Mouse over elements (e.g. message-selection checkboxes and/or flags if enabled).
4. Brave crashes.

Wed 2026-07-29 19:16:54 EDT 1580411 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 59.2M
Wed 2026-07-29 19:17:34 EDT 1737849 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 45.8M
Thu 2026-07-30 16:38:26 EDT   54180 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 52.8M
Thu 2026-07-30 17:08:08 EDT  149502 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 49.9M
Fri 2026-07-31 01:58:24 EDT  910079 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 49.5M
Fri 2026-07-31 11:21:06 EDT  921081 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 56.8M
Fri 2026-07-31 11:21:52 EDT  960320 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 50.7M
Fri 2026-07-31 11:30:23 EDT  965280 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 51.5M
Fri 2026-07-31 11:30:39 EDT  978359 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 41.2M
Fri 2026-07-31 11:35:22 EDT  979125 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 51.2M
Fri 2026-07-31 11:53:09 EDT    2806 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 51.3M
Fri 2026-07-31 12:59:24 EDT  114574 1000 1000 SIGTRAP present  /opt/brave-origin-bin/brave                                 51.1M

I acknowledge that:

• I have searched all (open and closed) discussions and issues and my problem is not there.
• I have read the Code of Conduct and agree to follow it.
• I wrote this request with my own hands, my own keyboard, and in my own words.

[tekstryder]

Cc: @gulafaran

[gulafaran]

got a WAYLAND_DEBUG=1 log of when it occurs?

[gulafaran]

because there is one thing i couldnt reproduce but https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/master/types/wlr_compositor.c#L212 left out until we can.

[tekstryder]

Damn you're fast replying. Was still editing my op from the template haha.

[3446148.976] wl_pointer#41.motion(7785543, 298.46093750, 287.21484375)
[3446149.089] wl_pointer#41.frame()
[3446153.936]  -> wl_shm#9.create_pool(new id wl_shm_pool#107, fd 473, 15876)
[3446153.944]  -> wl_shm_pool#107.create_buffer(new id wl_buffer#65, 0, 63, 63, 252, 0)
[3446153.952]  -> wl_shm_pool#107.destroy()
[3446153.955]  -> wl_surface#43.set_buffer_scale(2)
[3446153.993]  -> wl_surface#43.damage(0, 0, 63, 63)
[3446153.997]  -> wl_surface#43.attach(wl_buffer#65, 0, 0)
[3446154.002]  -> wl_pointer#41.set_cursor(3985, wl_surface#43, 7, 5)
[3446154.006]  -> wl_surface#43.commit()
[3446154.088] {Display Queue} wl_display#1.delete_id(64)
[3446154.092] {Display Queue} wl_display#1.delete_id(71)
[3446154.094] {Display Queue} wl_display#1.delete_id(107)
[3446154.095] {Display Queue} wl_display#1.error(wl_surface#43, 2, "buffer size is not an integer multiple of the buffer scale")
[186234:186234:0731/134855.349108:ERROR:ui/events/platform/wayland/wayland_event_watcher.cc:47] libwayland: wl_surface#43: error 2: buffer size is not an integer multiple of the buffer scale

[0731/134855.352838:ERROR:third_party/crashpad/crashpad/snapshot/elf/elf_dynamic_array_reader.h:64] tag not found
[0731/134855.352985:ERROR:third_party/crashpad/crashpad/snapshot/elf/elf_dynamic_array_reader.h:64] tag not found
/opt/brave-origin-bin/brave-origin: line 30: 186234 Trace/breakpoint trap      (core dumped) "$HERE/brave" "$@"

[gulafaran]

does this help? if so its the same bug.

diff --git a/src/protocols/core/Compositor.cpp b/src/protocols/core/Compositor.cpp
index dec564b8..685ca07e 100644
--- a/src/protocols/core/Compositor.cpp
+++ b/src/protocols/core/Compositor.cpp
@@ -143,10 +143,14 @@ CWLSurfaceResource::CWLSurfaceResource(SP<CWlSurface> resource_) : m_resource(re
             // without a viewport, at commit time the supplied
             // buffer size must be an integer multiple of the buffer_scale. If
             // that's not the case, an invalid_size error is sent.
-            if (sc<int>(m_pending.bufferSize.x) % m_pending.scale != 0 || sc<int>(m_pending.bufferSize.y) % m_pending.scale != 0) {
-                r->error(WL_SURFACE_ERROR_INVALID_SIZE, "buffer size is not an integer multiple of the buffer scale");
-                dropPendingBuffer();
-                return;
+            // https://gitlab.freedesktop.org/wayland/wayland/-/issues/194
+            // https://github.com/hyprwm/Hyprland/discussions/15673
+            if (m_role->role() != SURFACE_ROLE_CURSOR && m_role->role() != SURFACE_ROLE_UNASSIGNED) {
+                if (sc<int>(m_pending.bufferSize.x) % m_pending.scale != 0 || sc<int>(m_pending.bufferSize.y) % m_pending.scale != 0) {
+                    r->error(WL_SURFACE_ERROR_INVALID_SIZE, "buffer size is not an integer multiple of the buffer scale");
+                    dropPendingBuffer();
+                    return;
+                }
             }
 
             Vector2D tfs   = m_pending.transform % 2 == 1 ? Vector2D{m_pending.bufferSize.y, m_pending.bufferSize.x} : m_pending.bufferSize;

[tekstryder]

Yuppers. No crashy crash now.

[gulafaran]

#15674

[tekstryder]

Faster than Dominos Pizza...under 30min :)

[tekstryder]

Verified fixed by commit 3ead449.

• proto: dont check cursor buffer scale #15674

Rather, worked around a Wayland inconsistency.